Ubuntu
xorg-server package

x11vnc able to segfault xorg

Bug #525066 reported by Brian J. Murrell on 2010-02-20

This bug affects 4 people

Affects		Status	Importance	Assigned to	Milestone
	xorg-server (Ubuntu)	Fix Released	High	Bryce Harrington

Bug Description

Binary package hint: xorg

Lots of discussion over at: http://ubuntuforums.org/showthread.php?t=965695

But the gist of it is, x11vnc is able to segfault xorg. Quite simple to reproduce. Find a "victim" machine and boot it up to the gdm login prompt. Then ssh into the machine and run:

# DISPLAY=:0 x11vnc

(notice logged in as root) and then connect with a vnc client. Try to log in and very quickly the vnc connection will be closed and when you reconnect you will be at a new login prompt. That's because the last X11 server crashed. Check out /var/log/Xorg.0.log.old on the victim machine.

(gdb) attach 3038
...
0x00007f7652ee9485 in ?? () from /lib/libdrm_intel.so.1
(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x00007f765395b662 in RecordAReply (pcbl=0x7e29a0, nulldata=0x0, calldata=0x7fffc929a050) at ../../record/record.c:601
in ../../record/record.c
(gdb)
[K(gdb) bt
#0 0x00007f765395b662 in RecordAReply (pcbl=0x7e29a0, nulldata=0x0, calldata=0x7fffc929a050) at ../../record/record.c:601
#1 0x000000000043191c in _CallCallbacks (pcbl=0x7e29a0, call_data=0x7fffc929a050) at ../../dix/dixutils.c:743
#2 CallCallbacks (pcbl=0x7e29a0, call_data=0x7fffc929a050) at ../../dix/dixutils.c:877
#3 0x0000000000460091 in WriteToClient (who=0x41c8270, count=60, __buf=0x3d0b838) at ../../os/io.c:800
#4 0x00007f765395a8d2 in RecordFlushReplyBuffer (pContext=0x3d0b810, data1=0x0, len1=0, data2=<value optimized out>, len2=<value optimized out>)
    at ../../record/record.c:251
#5 0x00007f765395a946 in RecordFlushAllContexts (pcbl=<value optimized out>, nulldata=<value optimized out>, calldata=<value optimized out>)
    at ../../record/record.c:867
#6 0x000000000043191c in _CallCallbacks (pcbl=0x7e29a8, call_data=0x0) at ../../dix/dixutils.c:743
#7 CallCallbacks (pcbl=0x7e29a8, call_data=0x0) at ../../dix/dixutils.c:877
#8 0x000000000045ffd4 in WriteToClient (who=0x41c8270, count=60, __buf=0x3d0b838) at ../../os/io.c:824
#9 0x00007f765395a8d2 in RecordFlushReplyBuffer (pContext=0x3d0b810, data1=0x0, len1=0, data2=<value optimized out>, len2=<value optimized out>)
    at ../../record/record.c:251
#10 0x00007f765395a946 in RecordFlushAllContexts (pcbl=<value optimized out>, nulldata=<value optimized out>, calldata=<value optimized out>)
    at ../../record/record.c:867
#11 0x000000000043191c in _CallCallbacks (pcbl=0x7e29a8, call_data=0x0) at ../../dix/dixutils.c:743
#12 CallCallbacks (pcbl=0x7e29a8, call_data=0x0) at ../../dix/dixutils.c:877
#13 0x000000000045ffd4 in WriteToClient (who=0x41c8270, count=60, __buf=0x3d0b838) at ../../os/io.c:824
#14 0x00007f765395a8d2 in RecordFlushReplyBuffer (pContext=0x3d0b810, data1=0x0, len1=0, data2=<value optimized out>, len2=<value optimized out>)
    at ../../record/record.c:251
[Repeats endlessly...]

ProblemType: Bug
Architecture: i386
Date: Sat Feb 20 17:09:35 2010
DistroRelease: Ubuntu 9.10
MachineType: To Be Filled By O.E.M. To Be Filled By O.E.M.
NonfreeKernelModules: nvidia
Package: xorg 1:7.4+3ubuntu10
ProcCmdLine: auto BOOT_IMAGE=ubuntu root=/dev/mapper/rootvol-ubuntu_root
ProcEnviron:
LANG=en_CA.UTF-8
SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-19.56-generic
RelatedPackageVersions:
xserver-xorg 1:7.4+3ubuntu10
libgl1-mesa-glx 7.6.0-1ubuntu4
libdrm2 2.4.14-1ubuntu1
xserver-xorg-video-intel 2:2.9.0-1ubuntu2.1
xserver-xorg-video-ati 1:6.12.99+git20090929.7968e1fb-0ubuntu1
SourcePackage: xorg
Uname: Linux 2.6.31-19-generic i686
dmi.bios.date: 10/23/2003
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 080009
dmi.board.name: P4P800S
dmi.board.vendor: ASUSTeK Computer Inc.
dmi.board.version: Rev 1.xx
dmi.chassis.asset.tag: Asset-1234567890
dmi.chassis.type: 3
dmi.chassis.vendor: Chassis Manufacture
dmi.chassis.version: Chassis Version
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr080009:bd10/23/2003:svnToBeFilledByO.E.M.:pnToBeFilledByO.E.M.:pvrToBeFilledByO.E.M.:rvnASUSTeKComputerInc.:rnP4P800S:rvrRev1.xx:cvnChassisManufacture:ct3:cvrChassisVersion:
dmi.product.name: To Be Filled By O.E.M.
dmi.product.version: To Be Filled By O.E.M.
dmi.sys.vendor: To Be Filled By O.E.M.
fglrx: Not loaded
system:
distro: Ubuntu
architecture: i686kernel: 2.6.31-19-generic

See original description

Tags:

Related branches

lp:ubuntu/natty/xorg-server

Revision history for this message

Brian J. Murrell (brian-interlinx) wrote on 2010-02-20:

BootDmesg.txt Edit (44.6 KiB, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (11.4 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (5.3 KiB, text/plain; charset="utf-8")
GdmLog.txt Edit (9.1 KiB, text/plain; charset="utf-8")
GdmLogOld.txt Edit (9.3 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (11.5 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (517 bytes, text/plain; charset="utf-8")
PciDisplay.txt Edit (1009 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (1.2 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (1.6 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (7.5 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (119.5 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (234.8 KiB, text/plain; charset="utf-8")
XorgConf.txt Edit (3.8 KiB, text/plain; charset="utf-8")
XorgLog.txt Edit (13.1 KiB, text/plain; charset="utf-8")
XorgLogOld.txt Edit (13.4 KiB, text/plain; charset="utf-8")
Xrandr.txt Edit (15.8 KiB, text/plain; charset="utf-8")
glxinfo.txt Edit (49.8 KiB, text/plain; charset="utf-8")
setxkbmap.txt Edit (247 bytes, text/plain; charset="utf-8")
xdpyinfo.txt Edit (59.9 KiB, text/plain; charset="utf-8")
xkbcomp.txt Edit (53.8 KiB, text/plain; charset="utf-8")

Bryce Harrington (bryce) on 2010-02-21

affects:

xorg (Ubuntu) → nvidia-graphics-drivers-180 (Ubuntu)

Revision history for this message

Brian J. Murrell (brian-interlinx) wrote on 2010-02-21:

Really? This is an nvidia specific crash? Can I ask how you came to that conclusion, just for my education, so that I can better diagnose failures in the future?

Bryce Harrington (bryce) on 2010-03-18

tags:

added: karmic

Revision history for this message

Sheng Yang (yasker) wrote on 2010-11-16:

Can't believe it just affect nvidia card, because I am not using the nvidia card but intel ones.

affects:

nvidia-graphics-drivers-180 (Ubuntu) → xorg (Ubuntu)

Revision history for this message

Sheng Yang (yasker) wrote on 2010-11-16:

I've suffered this since upgrade to 10.10. But I can't find the crash log on Xorg.0.log.old. Can anyone help to indicate where I can find some useful log for this issue?

Revision history for this message

Bryce Harrington (bryce) wrote on 2010-11-23:

Are you able to reproduce this issue easily? If so, please collect a full backtrace - see http://wiki.ubuntu.com/X/Backtracing for directions. If not, could you describe the conditions under which the crash tends to occur?

If this is an nvidia-specific crash, there may be nothing we can do at the distro level, depending on where exactly in the stack the segfault occurs. If you suspect it to not be nvidia-specific, please reproduce the crash under one of the open drivers (e.g. nouveau or intel) and collect a full backtrace there.

Changed in xorg (Ubuntu):
importance:	Undecided → High
status:	New → Incomplete

Revision history for this message

Sheng Yang (yasker) wrote on 2010-11-24:

Xorg log after crash with GDB attached. Edit (741.0 KiB, application/x-tar)

I am using Intel Q965.

This issue can't be triggered very quickly on my machine. Normal I would work using vnc client connected to x11vnc for a while, then close vnc client. After about 1 minute, X would crash.

I've managed to reproduce it twice with gdb attached, here is log for the second time.

Bryce Harrington (bryce) on 2010-11-26

affects:	xorg (Ubuntu) → xorg-server (Ubuntu)
Changed in xorg-server (Ubuntu):
status:	Incomplete → Confirmed

Bryce Harrington (bryce) on 2010-11-27

Changed in xorg-server (Ubuntu):
status:	Confirmed → Triaged

Revision history for this message

Sheng Yang (yasker) wrote on 2010-12-31:

This bug is still there. And seems I can triggered it through some other way days ago, e.g. open a big picture in the gwenview. But after the recent update, I can only trigger it by x11vnc, after using vnclient for a period of time.

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-12:

Hi Sheng,

Thanks for providing the detailed backtrace. Looks like it's a stack overflow in the client callback code when the client disappeared. The leftover callback resulted in an endless loop.

description:	updated
Changed in xorg-server (Ubuntu):
assignee:	nobody → Bryce Harrington (bryce)

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-12:

Think the next action here is to attempt reproducing it on natty, and then forward it upstream.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2011-03-18:

#10

Download full text (5.5 KiB)

This bug was fixed in the package xorg-server - 2:1.10.0-0ubuntu1

---------------
xorg-server (2:1.10.0-0ubuntu1) natty; urgency=low

This bug was fixed in the package xorg-server - 2:1.10.0-0ubuntu1

---------------
xorg-server (2:1.10.0-0ubuntu1) natty; urgency=low

* Update to new upstream final release.
    + Drop 16-construct-paths-in-doxygen.conf.diff; included in new upstream.
  * debian/patches/216_fix_sdksyms_build.diff:
    + Cherry-pick from 1.10 branch, fixing the stale sdksyms.c file picked up
      in the udeb build, causing the udeb build to fail with missing symbols.
  * Merge from unreleased Debian experimental.  Remaining Ubuntu changes:
    - rules:
      + Disable SELinux, libaudit-dev is not in main yet. (LP #406226)
      + Enable xcsecurity. (LP #247537)
      + Add --with-extra-module-dir to support GL alternatives.
      + Mention Ubuntu support in builderstring rather than package uploader's
        email address.
    - control:
      + Xvfb depends on xauth, x11-xkb-utils. (LP #500102)
      + Add breaks for incompatible drivers. (LP #614993)
      + Drop libaudit-dev from build-deps.
      + Build-depend on newer mesa to pick up DRI search paths variable.
      + Bump dependency on x11proto-input-dev for Xi 2.1
      + Drop linux-any specifier to make pbuilder less narky.
      + Bump build-depends on mesa-common-dev to pick up dri.pc DRI search
        paths change for 214_glx_dri_searchdirs.patch
    - local/xvfb-run*: Add correct docs about error codes. (LP #328205)
    - debian/patches:
      + 100_rethrow_signals.patch:
        When aborting, re-raise signals for apport
      + 105_nvidia_fglrx_autodetect.patch:
        Load proprietary drivers automatically when installed.
      + 109_fix-swcursor-crash.patch:
        Avoid dereferencing null pointer while reloading cursors during
        resume. (LP #371405)
      + 111_armel-drv-fallbacks.patch:
        Add support for armel driver fallbacks.
      + 121_only_switch_vt_when_active.diff:
        Add a check to prevent the X server from changing the VT when killing
        GDM from the console.
      + 122_xext_fix_card32_overflow_in_xauth.patch:
        Fix server crash when “xauth generate” is called with large timeout.
      + 157_check_null_modes.patch, 162_null_crtc_in_rotation.patch,
        166_nullptr_xinerama_keyrepeat.patch, 167_nullptr_xisbread.patch
        172_cwgetbackingpicture_nullptr_check.patch:
        Fix various segfaults in xserver by checking pointers for NULL
        values before dereferencing them.
      + 165_man_xorg_conf_no_device_ident.patch
        Correct man page
      + 168_glibc_trace_to_stderr.patch:
        Report abort traces to stderr instead of terminal
      + 184_virtual_devices_autodetect.patch:
        Use vesa for qemu device, which is not supported by cirrus
      + 188_default_primary_to_first_busid.patch:
        Pick the first device and carry on (LP #459512)
      + 190_cache-xkbcomp_output_for_fast_start_up.patch:
      + 191-Xorg-add-an-extra-module-path.patch:
        Add support for the alternatives module path.
      + 198_nohwaccess.patch:
        Adds a -nohwaccess argument to make X not access the hardware
        ports directly.
      + 200_randr-null.patch:
        Clarify a pointer initialization.
      + 206_intel_8xx_default_to_fbdev.patch:
        Makes 8xx class intel GPUs default to fbdev for stability. (LP #633593)
      + 208_switch_on_release.diff:
        Switch keyboard layouts on key-release rather than key-press
  	(LP #36812)
      + 209_add_legacy_bgnone_option.patch:
        Add -nr as a synonym for -background none until all ?DM are updated for
  	the new option.
      + 210_pixman_null_ptr_check.patch:
        Catch NULL pointer access after pixman_image_create_bits() failure
  	(LP #705078)
      + 213_xichangehierarchy-check-oom.patch:
        Add NULL pointer check for out-of-memory conditions. (LP #720445)
      + 214_glx_dri_searchdirs.patch:
        Search in same paths as mesa for DRI drivers for AIGLX so we can handle
        UMS fallback for radeon gracefully.
      + 215_glx_drawable_refcounting.diff:
        Prevents segfault on logout and server regenerate, and possibly other
        times. (LP #711422)
      + 500_xi2.1.patch:
      + 501_xf86CoordinatesToWindow.patch:
      + 502_gestures-extension.patch:
        Add Xi 2.1 and Gesture extension support.
  * debian/serverminver:
    - Bump to 1.10.0-0ubuntu1~ for Xi 2.1 ABI
  * New upstream release fixes crash in Record, trigerred by x11vnc
    (LP: #525066)
  * Refresh 500_xi2.1.patch for new upstream version
  * debian/videoabiver:
    - Bump to 10 for XRandR 1.4 revert.

xorg-server (2:1.9.99.903-2) UNRELEASED; urgency=low

* Relax build-dep and dep on x11proto-randr-dev since the XRandR 1.4
    bits were finally reverted upstream.

xorg-server (2:1.9.99.903-1) experimental; urgency=low

* New upstream release candidate (1.10 rc3).
  * Remove patch: 17-fix-ftbfs-on-sparc.diff (merged upstream).
  * Remove patch: 20-update-gpu-pitch.diff (merged upstream).
  * Refresh patch: 07-xfree86-fix-build-with-xv-disabled.diff
  * Replace patch fixing out-of-tree-build:
    - 16-oot-build.diff (dirty local hack).
    + 16-construct-paths-in-doxygen.conf.diff (from upstream,
      without the gitignore hunk to get patching working).
  * Bump video ABI version, and serverminver accordingly.

xorg-server (2:1.9.99.902-3) experimental; urgency=low

* Merge from master up to 93a7399370.
  * New patch: 17-fix-ftbfs-on-sparc.diff; let's try it for real before
    asking for its being merged upstream.
  * Refresh all patches.
 -- Christopher James Halse Rogers <raof@ubuntu.com>   Fri, 11 Mar 2011 10:29:37 +1100

Changed in xorg-server (Ubuntu):
status:	Triaged → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

Duplicates of this bug

Bug #689072

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntuxorg-server package

x11vnc able to segfault xorg

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
xorg-server package