Ubuntu
xserver-xorg-video-nouveau package

Xorg crashed with SIGABRT in memcpy() from NVRefreshArea()

Bug #1056511 reported by martyfelker on 2012-09-25

This bug affects 4 people

Affects		Status	Importance	Assigned to	Milestone
	xserver-xorg-video-nouveau (Ubuntu)	Fix Released	Undecided	Unassigned
	Quantal	Fix Released	Undecided	Unassigned

Bug Description

[IMPACT]
* When falling back to no acceleration, mostly on fermi geforces, a bigger buffer can be accelerated, which can segfault.

[TESTCASE]
* Boot with a GF119 and set resolution set to 1680x1050 with xrandr, then try to move some window past the end of the screen. This should cause a crash, or maybe the first part is already sufficient.

[Regression Potential]
The change is localized to NVRefreshArea, so unlikely to cause many regressions. However some other fixes are SRU'd too, so as a whole we should watch for any new bug reports with nouveau during the proposed stage.

[Other Info]
After I found the commit fixing the issue, it was very issue for me to reproduce based on how it fixes it. The bug only happens on specific resolutions due to how memory is managed.

[Original bug report]
Try to update Gnome in Ubuntu 12.10 (uptodate)

#9 0x00007f9bf13f0291 in memcpy (__len=4404, __src=0x7f9bf11dcdd8, __dest=0x7f9beab19388) at /usr/include/x86_64-linux-gnu/bits/string3.h:52
No locals.
#10 NVRefreshArea (pScrn=0x7f9bf4fc8f50, num=<optimized out>, pbox=0x7fffaf9eec40) at ../../src/nv_shadow.c:56
        pNv = 0x7f9bf4fc9a90
        x1 = 290
        y1 = 98
        x2 = 1391
        y2 = 1061
        width = 4404
        height = <optimized out>
        cpp = 4
        FBPitch = 6912
        max_height = <optimized out>
        src = 0x7f9bf11dcdd8 <Address 0x7f9bf11dcdd8 out of bounds>
        dst = 0x7f9beab19388 <Address 0x7f9beab19388 out of bounds>
#11 0x00007f9bf03622e1 in ShadowPolyFillRect (pDraw=0x7f9bf8ea16b0, pGC=0x7f9bf5007580, nRectsInit=2, pRectsInit=<optimized out>) at ../../../../hw/xfree86/shadowfb/shadow.c:1189
        box = {x1 = 290, y1 = 98, x2 = 1391, y2 = 1078}
        boxNotEmpty = 1
        pRects = <optimized out>
        nRects = <optimized out>
        pPriv = 0x7f9bf4fc56d0
        pGCPriv = 0x7f9bf5007630
        oldFuncs = 0x7f9bf05681c0

ProblemType: Crash
DistroRelease: Ubuntu 12.10
Package: xserver-xorg-core 2:1.13.0-0ubuntu4
ProcVersionSignature: hostname 3.5.0-15.23-generic 3.5.4
Uname: Linux 3.5.0-15-generic x86_64
.tmp.unity.support.test.1:

ApportVersion: 2.5.2-0ubuntu4
Architecture: amd64
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CompositorRunning: None
Date: Sat Sep 22 20:38:24 2012
DistUpgraded: Fresh install
DistroCodename: quantal
DistroVariant: ubuntu
ExecutablePath: /usr/bin/Xorg
ExtraDebuggingInterest: Yes
GraphicsCard:
NVIDIA Corporation GF119 [GeForce GT 520] [10de:1040] (rev a1) (prog-if 00 [VGA controller])
Subsystem: XFX Pine Group Inc. Device [1682:301a]
InstallationMedia: Ubuntu 12.10 "Quantal Quetzal" - Alpha amd64 (20120909)
MachineType: To be filled by O.E.M. To be filled by O.E.M.
ProcCmdline: /usr/bin/X :0 vt7 -br -nolisten tcp -auth /var/run/xauth/A:0-XhOtgb
ProcEnviron:
TERM=linux
PATH=(custom, no user)
LANG=en_US.UTF-8
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-3.5.0-15-generic root=/dev/mapper/Linux-hostname ro
Signal: 6
SourcePackage: xorg-server
StacktraceTop:
?? () from /usr/lib/xorg/modules/drivers/nouveau_drv.so
?? () from /usr/lib/xorg/modules/libshadowfb.so
miPaintWindow ()
miWindowExposures ()
miHandleValidateExposures ()
Title: Xorg crashed with SIGABRT in miPaintWindow()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

dmi.bios.date: 04/18/2012
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 1208
dmi.board.asset.tag: To be filled by O.E.M.
dmi.board.name: M5A97
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: Rev 1.xx
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: To Be Filled By O.E.M.
dmi.chassis.version: To Be Filled By O.E.M.
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr1208:bd04/18/2012:svnTobefilledbyO.E.M.:pnTobefilledbyO.E.M.:pvrTobefilledbyO.E.M.:rvnASUSTeKCOMPUTERINC.:rnM5A97:rvrRev1.xx:cvnToBeFilledByO.E.M.:ct3:cvrToBeFilledByO.E.M.:
dmi.product.name: To be filled by O.E.M.
dmi.product.version: To be filled by O.E.M.
dmi.sys.vendor: To be filled by O.E.M.
version.compiz: compiz 1:0.9.8.2+bzr3377-0ubuntu1
version.ia32-libs: ia32-libs N/A
version.libdrm2: libdrm2 2.4.39-0ubuntu1
version.libgl1-mesa-dri: libgl1-mesa-dri 9.0~git20120917.7cfd42ce-0ubuntu3
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 9.0~git20120917.7cfd42ce-0ubuntu3
version.xserver-xorg-core: xserver-xorg-core 2:1.13.0-0ubuntu4
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.7.3-0ubuntu1
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.99.99~git20120913.8637f772-0ubuntu1
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.20.8-0ubuntu1
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:1.0.2-0ubuntu1

See original description

Tags:

Revision history for this message

martyfelker (martyfelker-gmail) wrote on 2012-09-25:

BootDmesg.txt Edit (72.7 KiB, text/plain; charset="utf-8")
BootLog.txt Edit (2.0 KiB, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (4.4 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (3.2 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (854 bytes, text/plain; charset="utf-8")
DpkgLog.txt Edit (3.4 MiB, text/plain; charset="utf-8")
GconfCompiz.txt Edit (39.1 KiB, text/plain; charset="utf-8")
LightdmDisplayLog.txt Edit (2.1 KiB, text/plain; charset="utf-8")
LightdmGreeterLog.txt Edit (7.7 KiB, text/plain; charset="utf-8")
LightdmGreeterLogOld.txt Edit (8.3 KiB, text/plain; charset="utf-8")
LightdmLog.txt Edit (15.5 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (38.0 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (690 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (6.3 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (3.8 KiB, text/plain; charset="utf-8")
ProcMaps.txt Edit (19.3 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (5.4 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (761 bytes, text/plain; charset="utf-8")
Registers.txt Edit (703 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (1.5 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (4.9 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (180.7 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (411.4 KiB, text/plain; charset="utf-8")
UnitySupportTest.txt Edit (680 bytes, text/plain; charset="utf-8")
XorgLog.txt Edit (54.3 KiB, text/plain; charset="utf-8")
XorgLogOld.txt Edit (51.9 KiB, text/plain; charset="utf-8")
Xrandr.txt Edit (9.0 KiB, text/plain; charset="utf-8")
xdpyinfo.txt Edit (24.9 KiB, text/plain; charset="utf-8")

Revision history for this message

Apport retracing service (apport) wrote on 2012-09-26:

StacktraceTop:
memcpy (__len=4404, __src=0x7f9bf11dcdd8, __dest=0x7f9beab19388) at /usr/include/x86_64-linux-gnu/bits/string3.h:52
NVRefreshArea (pScrn=0x7f9bf4fc8f50, num=<optimized out>, pbox=0x7fffaf9eec40) at ../../src/nv_shadow.c:56
ShadowPolyFillRect (pDraw=0x7f9bf8ea16b0, pGC=0x7f9bf5007580, nRectsInit=2, pRectsInit=<optimized out>) at ../../../../hw/xfree86/shadowfb/shadow.c:1189
miPaintWindow (pWin=<optimized out>, pWin@entry=0x7f9bf8ea16b0, prgn=prgn@entry=0x7f9bf8f007d0, what=what@entry=0) at ../../mi/miexpose.c:641
miWindowExposures (pWin=0x7f9bf8ea16b0, prgn=0x7f9bf8f007d0, other_exposed=0x0) at ../../mi/miexpose.c:470

Revision history for this message

Apport retracing service (apport) wrote on 2012-09-26: Stacktrace.txt

Stacktrace.txt Edit (4.8 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2012-09-26: StacktraceSource.txt

StacktraceSource.txt Edit (3.2 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2012-09-26: ThreadStacktrace.txt

ThreadStacktrace.txt Edit (11.9 KiB, text/plain)

Changed in xorg-server (Ubuntu):
importance:	Undecided → Medium
summary:	- Xorg crashed with SIGABRT in miPaintWindow() + Xorg crashed with SIGABRT in memcpy()
tags:	removed: need-amd64-retrace

Bryce Harrington (bryce) on 2012-10-01

summary:	- Xorg crashed with SIGABRT in memcpy() + Xorg crashed with SIGABRT in memcpy() from NVRefreshArea()
description:	updated
Changed in xorg-server (Ubuntu):
importance:	Medium → High

Bryce Harrington (bryce) on 2012-10-03

visibility:

private → public

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-10-04:

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in xorg-server (Ubuntu):
status:	New → Confirmed

Revision history for this message

Karl Krach (bluespirit) wrote on 2012-10-21:

Xorg crashed when starting thunderbird Edit (64.5 KiB, text/plain)

it also affects me: Nvidia GT 640

It appears, when I start thunderbird. But it doesn't happen, when booting from LiveDVD.

Maarten Lankhorst (mlankhorst) on 2012-10-22

Changed in xorg-server (Ubuntu):
assignee:	nobody → Maarten Lankhorst (mlankhorst)

Revision history for this message

Maarten Lankhorst (mlankhorst) wrote on 2012-10-22:

1.0.2-0ubuntu3+bug1056511~try1 debdiff Edit (2.5 KiB, text/plain)

This specific issue seems likely to be fixed upstream in the commit "shadowfb: fix segfault due to reading outside of shadow buffer"

Can you try to do a build with the attached debdiff to see if it fixes the problem?

Changed in xorg-server (Ubuntu):
status:	Confirmed → In Progress

Revision history for this message

Ubuntu Foundations Team Bug Bot (crichton) wrote on 2012-10-22:

The attachment "1.0.2-0ubuntu3+bug1056511~try1 debdiff" of this bug report has been identified as being a patch in the form of a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-sponsors team please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

tags:

added: patch

Maarten Lankhorst (mlankhorst) on 2012-10-25

description:	updated
Changed in xorg-server (Ubuntu):
status:	In Progress → Won't Fix
status:	Won't Fix → Fix Committed
Changed in xserver-xorg-video-nouveau (Ubuntu):
status:	New → Fix Committed

Revision history for this message

Steve Langasek (vorlon) wrote on 2012-11-05:

#10

The upstream delta includes the following changes that don't have referenced bugs in launchpad or test cases:

* Fix race condition in vblank
* Fix prime rendering with kwin

Why are these appropriate to include in SRU without test cases?

Revision history for this message

Sebastien Bacher (seb128) wrote on 2012-11-14:

#11

(unsubscribing sponsors since it seems that the debdiff there is superseeded by a 1.0.3 update which got uploaded since)

Revision history for this message

Maarten Lankhorst (mlankhorst) wrote on 2012-11-14:

#12

The vblank corruption fix happens on triple buffering and is debian bug #686474 there. Since xserver 1.12+ has enabled triple buffering by default, and nouveau on ubuntu always enables vblank, I was hoping to include it there. I can't reproduce the corruption since vblank is not enabled on fermi cards, and is pretty much random memory corruption in xserver.

I think the kwin fix can be reverted for now, it had a regression in virtualbox rendering which was fixed in another commit later.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-11-15:

#13

This bug was fixed in the package xserver-xorg-video-nouveau - 1:1.0.4-0ubuntu1

---------------
xserver-xorg-video-nouveau (1:1.0.4-0ubuntu1) raring; urgency=low

  * Sync from unreleased debian experimental git.
  * Remaining differences:
    - Try to enable vblank if available (LP: #1019131)
      - 100-vblank-on.diff
-- Maarten Lankhorst <email address hidden> Thu, 15 Nov 2012 11:02:38 +0100

Changed in xserver-xorg-video-nouveau (Ubuntu):
status:	Fix Committed → Fix Released

Revision history for this message

Clint Byrum (clint-fewbar) wrote on 2012-11-30:

#14

Maarten thanks for the response re the two missing changes. Based on your feedback (that the kwin fix can be reverted) I'm rejecting the upload of 1:1.0.3-0ubuntu0.1

The next step is to upload again, minus the kwin fix, and with a bug reference in the changelog about the vblank. Since it seems untestable, just document that fact and recommend a test plan to verify vblank still works in said bug report.

Thanks for being patient and dilligent on this.

Revision history for this message

Dimo (lami4ka) wrote on 2013-03-12:

#15

Another suferrer of this bug... Is there a chance of seeing a fix backported to Quantal?
Thank you for figuring this out!

~Dimo

Revision history for this message

Maarten Lankhorst (mlankhorst) wrote on 2013-03-12:

#16

I've re-uploaded it 2 weeks ago, I'm just waiting for it to get accepted into proposed

Revision history for this message

Steve Langasek (vorlon) wrote on 2013-09-12:

#17

Hello martyfelker, or anyone else affected,

Accepted xserver-xorg-video-nouveau into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/xserver-xorg-video-nouveau/1:1.0.3-0ubuntu0.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in xserver-xorg-video-nouveau (Ubuntu Quantal):
status:	New → Fix Committed
tags:	added: verification-needed

Revision history for this message

martyfelker (martyfelker-gmail) wrote on 2013-09-14: Re: [Bug 1056511] Re: Xorg crashed with SIGABRT in memcpy() from NVRefreshArea()

#18

Cannot do this. As stated I am running Saucy not Quantel.

On Wed, Sep 11, 2013 at 9:06 PM, Steve Langasek <
<email address hidden>> wrote:

> Hello martyfelker, or anyone else affected,
>
> Accepted xserver-xorg-video-nouveau into quantal-proposed. The package
> will build now and be available at http://launchpad.net/ubuntu/+source
> /xserver-xorg-video-nouveau/1:1.0.3-0ubuntu0.2 in a few hours, and then
> in the -proposed repository.
>
> Please help us by testing this new package. See
> https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to
> enable and use -proposed. Your feedback will aid us getting this update
> out to other Ubuntu users.
>
> If this package fixes the bug for you, please add a comment to this bug,
> mentioning the version of the package you tested, and change the tag
> from verification-needed to verification-done. If it does not fix the
> bug for you, please add a comment stating that, and change the tag to
> verification-failed. In either case, details of your testing will help
> us make a better decision.
>
> Further information regarding the verification process can be found at
> https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in
> advance!
>
>
> ** Changed in: xserver-xorg-video-nouveau (Ubuntu Quantal)
> Status: New => Fix Committed
>
> ** Tags added: verification-needed
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1056511
>
> Title:
> Xorg crashed with SIGABRT in memcpy() from NVRefreshArea()
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/1056511/+subscriptions
>

Revision history for this message

Maarten Lankhorst (mlankhorst) wrote on 2013-12-16:

#19

tested again on my tv at a 1680x1050 resolution, seems to work.

tags:

added: verification-done
removed: verification-needed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2013-12-19:

#20

This bug was fixed in the package xserver-xorg-video-nouveau - 1:1.0.3-0ubuntu0.2

---------------
xserver-xorg-video-nouveau (1:1.0.3-0ubuntu0.2) quantal-proposed; urgency=low

* Revert kwin fix, it caused a regression.
- 101-Revert-nouveau-dri2-fix-pixmap-window-offset-calcs.patch

xserver-xorg-video-nouveau (1:1.0.3-0ubuntu0.1) quantal-proposed; urgency=low

  [ Maarten Lankhorst ]
  * New upstream bugfix release
  * Fix SIBABRT in NVRefreshArea (LP: #1056511)
  * Fix race condition in vblank
  * Add solid fill acceleration (LP: #1010794)
  * Cleanup download/upload screen functions (LP: #1010794)
  * Fix prime rendering with kwin

xserver-xorg-video-nouveau (1:1.0.3-1) UNRELEASED; urgency=low

  [ Maarten Lankhorst ]
  * New upstream release.
  * Drop 02-drm-nouveau-newabi.patch and require libdrm 2.4.34

[ Timo Aaltonen ]
* watch: Use the .gz tarball, and update the url.
-- Maarten Lankhorst <email address hidden> Thu, 28 Feb 2013 12:35:09 +0100

Changed in xserver-xorg-video-nouveau (Ubuntu Quantal):
status:	Fix Committed → Fix Released

Revision history for this message

Brian Murray (brian-murray) wrote on 2013-12-19: Update Released

#21

The verification of the Stable Release Update for xserver-xorg-video-nouveau has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

penalvch (penalvch) on 2014-01-07

no longer affects:	xorg-server (Ubuntu Quantal)
no longer affects:	xorg-server (Ubuntu)

Report a bug

This report contains Public information

Everyone can see this information.

Duplicates of this bug

You are

Subscribing...

Edit bug mail

Other bug subscribers

Patches

1.0.2-0ubuntu3+bug1056511~try1 debdiff Edit

Add patch

Bug attachments

Add attachment

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntuxserver-xorg-video-nouveau package

Xorg crashed with SIGABRT in memcpy() from NVRefreshArea()

Bug Description

Duplicates of this bug

Other bug subscribers

Patches

Bug attachments

Remote bug watches

Ubuntu
xserver-xorg-video-nouveau package