Xorg crashed with SIGABRT in __libc_message() from malloc_printerr() via XIDestroyDeviceProperty

StacktraceTop:
 __libc_message (do_abort=2, fmt=0xb730cf3c "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:201
 malloc_printerr (action=<optimized out>, str=<optimized out>, ptr=0xb98da700) at malloc.c:5007
 XIDestroyDeviceProperty (prop=0xb98da700) at ../../Xi/xiproperty.c:631
 XIDeleteAllDeviceProperties (device=0xb98d7c18) at ../../Xi/xiproperty.c:648
 CloseDevice (dev=0xb98d7c18) at ../../dix/devices.c:919

Status changed to 'Confirmed' because the bug affects multiple users.

#5 0xb767bd1b in XIDestroyDeviceProperty (prop=0xb98da700) at ../../Xi/xiproperty.c:631

static void
XIDestroyDeviceProperty (XIPropertyPtr prop)
{
    free(prop->value.data);
    free(prop); /* line 631 */
}

Odd. Race condition?

Discussing this with RAOF and cnd, this may be a symptom of a pervasive memory corruption bug in the input stack (see LP: #929408), which is fixed (we believe) in xorg-server 1.11.4-0ubuntu5 which will be uploaded today or tomorrow.

Please update to this version of the server and see if you can reproduce the crash. If you do reproduce it, and if apport prompts you to file another bug report, please do and mention the new bug # on this bug.

If you don't see it, just leave this bug report in state Incomplete, and we'll close it out in a month or two.

I actually happen to have no package xorg-server (see list of installed xorg related packages below).

As I am coming from https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/959261 which is said to be a duplicate of this one here *and* have installed latest packages by today noon CET, I am not sure if the proposed fixed above is one ..

~$ dpkg -l | grep xorg
ii python-xkit 0.4.2.3build1 library for the manipulation of the xorg.conf
ii xorg 1:7.6+10ubuntu1 X.Org X Window System
ii xorg-docs-core 1:1.6-1ubuntu2 Core documentation for the X.org X Window System
ii xserver-xorg 1:7.6+10ubuntu1 X.Org X server
ii xserver-xorg-core 2:1.11.4-0ubuntu6 Xorg X server - core server
ii xserver-xorg-input-all 1:7.6+10ubuntu1 X.Org X server -- input driver metapackage
ii xserver-xorg-input-evdev 1:2.7.0-0ubuntu1 X.Org X server -- evdev input driver
ii xserver-xorg-input-mouse 1:1.7.1-1build3 X.Org X server -- mouse input driver
ii xserver-xorg-input-synaptics 1.5.99.901-0ubuntu1 Synaptics TouchPad driver for X.Org server
ii xserver-xorg-input-vmmouse 1:12.7.0-2build1 X.Org X server -- VMMouse input driver to use with VMWare
ii xserver-xorg-input-wacom 1:0.13.0-0ubuntu1 X.Org X server -- Wacom input driver
ii xserver-xorg-video-all 1:7.6+10ubuntu1 X.Org X server -- output driver metapackage
ii xserver-xorg-video-ati 1:6.14.99~git20111219.aacbd629-0ubuntu2 X.Org X server -- AMD/ATI display driver wrapper
ii xserver-xorg-video-cirrus 1:1.3.2-4build1 X.Org X server -- Cirrus display driver
ii xserver-xorg-video-fbdev 1:0.4.2-4ubuntu2 X.Org X server -- fbdev display driver
ii xserver-xorg-video-intel 2:2.17.0-1ubuntu4 X.Org X server -- Intel i8xx, i9xx display driver
ii xserver-xorg-video-mach64 6.9.0-1build2 X.Org X server -- ATI Mach64 display driver
ii xserver-xorg-video-mga 1:1.4.13.dfsg-4build2 X.Org X server -- MGA display driver
ii xserver-xorg-video-neomagic 1:1.2.5-2build2 X.Org X server -- Neomagic display driver
ii xserver-xorg-video-nouveau 1:0.0.16+git20111201+b5534a1-1build2 X.Org X server -- Nouveau display driver
ii xserver-xorg-video-openchrome 1:0.2.904+svn1050-1 X.Org X server -- VIA display driver
ii xserver-xorg-video-qxl 0.0.16-2 X.Org X se...

well, if that is the package i question, I have a later version than recommended and still a bug:

ii xserver-xorg-core 2:1.11.4-0ubuntu6 Xorg X server - core server

Package: xserver-xorg-core 2:1.11.4-0ubuntu6
ProcCmdline: /usr/bin/X :0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch

Status changed to 'Confirmed' because the bug affects multiple users.

Package: xserver-xorg-core 2:1.11.4-0ubuntu7
ProcCmdline: /usr/bin/X :0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch -background none

I tried to run X under valgrind to see if disconnecting a device would provide any clues. Unfortunately, it didn't. I hit a crash when X tries to use snprintf from signal context when mtdev_get returns an error, but that's irrelevant to this bug. I removed the logging line, but then I don't get any valgrind errors.

Basically, I can't reproduce the bug with my hardware by merely adding and removing a device.

<cnd> bryceh, fwiw, in bug 943880 the stack trace from *after* we fixed the synaptics corruption is from when the server is shutting down

Is anyone reproducing this crash relatively reliably?

If so, can you identify steps that tend to cause the crash? Or, if it just happens randomly would you be able to run valgrind for us?

My experience:
- after suspend, my touchpad mouse doesn't work (this itself is a new bug)
- I do 'sudo rmmod psmouse' then 'sudo modprobe psmouse' to reactive the mouse
- ... except, recently, when I do 'sudo rmmod psmouse', X crashes with the bug in this bug report

(by the way, I'm using gnome classic (no effects), fully updated, as of yesterday/this morning)

I can reproduce it fairly reliably by doing:
- suspend
- after suspend, 'sudo rmmod psmouse'

Sometimes, it's enough to just do 'sudo rmmod psmouse' (obviously if this fails, you will need to 'sudo modprobe psmouse' before trying the first method, using suspend)

@Bryce

I ran into this over the weekend, and it was quite easy to reproduce using the Disable-Touchpad ( Fn-F8 ) on my Thinkpad T410s. I haven't been able to reproduce since.

That said, my Disable-Touchpad function key now seems completely broken ( but crashes at least ).

(Note: For the Valgrind bit, maybe the easiest thing could be to post instructions for running valgrind, then if someone gets a moment it's easy to just run it. Or maybe there are some licensing issues involved?)

Valgrind how to: https://wiki.ubuntu.com/Valgrind

@penalvch: step 3 seems to need some specific clarification, given that the process in question is the X server. At least: I'm not sure how to start the X server in valgrind.

I just figure out today how to get what I believe is a full unity session up and running in a valgrind X:

1. Log out, we're going to stop the current X session.
2. Switch to a VT (ctrl+alt+fn2)
3. Log in
4. $ sudo stop lightdm
5. $ sudo valgrind Xorg :0 2>&1 | tee /tmp/log
6. Switch to another VT (ctrl+alt+fn3) and login (or use a different screen window if you are running screen)
7. $ DISPLAY=:0 dbus-launch unity

Make sure there are no user dbus daemons running before running dbus-launch. That seemed to mess things up. Also, the desktop is going to run *REALLY* *REALLY* slow and might take multiple minutes just to start. It may also have all kinds of visual artifacts. Hopefully you can get around them to reproduce the issue. Once you have, attach /tmp/log here.

Thanks!

What all these bugs have in common is that synaptics driver is used, but the only thing I see that looks suspicious is that BOOL is redefined as char for X, the common definition is int. However that seems to be done consistently so not likely to be a problem, sizeof(BOOL) = 1 inside synaptics, which seems to be a result of X being braindead.

XiChangeDeviceProperty seems to be slightly buggy, new_value.size = len; should probably be new_value.size = total_len; However this is unlikely to be a major problem in this bug since I doubt it corrupts things in the way shown here.

In case it's useful in any way, I've started using the mainstream
kernel 3.4.0-030400rc2-generic-pae #201204072235 , which doesn't have
the psmouse-working-after-suspend bug I get in the ubuntu kernel, and
therefore I don't get a crash.

But I suspect this is because I don't have to unload psmouse, rather
than because the xorg crash doesn't exist in this kernel.

This kernel sucks because I cant run VMWare, but it's better than
crashing after every 3rd suspend...

Well there was a corruption occuring in synaptics that could trigger every time the touchpad was disabled, for example with syndaemon. It was fixed in a newer version, and might be what you're experiencing here.

Could you try the appropriate i386/amd64 deb from
http://people.canonical.com/~mlankhorst/synaptics-rebuild/

to see if this fixes it?

~Maarten

I didn't notice at least 1 time touchpad self-disabling, now that bug
report window doesn't appear. Should I try that package anyway?
By the way, touchpad disables every time I type anything (even accidental
arrow keystrokes) during kernel/modules (don't know exactly) load while
system startup. This problem happens since 11.10 (or even 11.04), what can
that be? Is it the-same-based bug?

On Sat, May 19, 2012 at 5:21 PM, Maarten Lankhorst <
<email address hidden>> wrote:

> Well there was a corruption occuring in synaptics that could trigger
> every time the touchpad was disabled, for example with syndaemon. It was
> fixed in a newer version, and might be what you're experiencing here.
>
> Could you try the appropriate i386/amd64 deb from
> http://people.canonical.com/~mlankhorst/synaptics-rebuild/
>
> to see if this fixes it?
>
> ~Maarten
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (984170).
> https://bugs.launchpad.net/bugs/943880
>
> Title:
> Xorg crashed with SIGABRT in __libc_message() from malloc_printerr()
> via XIDestroyDeviceProperty
>
> Status in “xorg-server” package in Ubuntu:
> Confirmed
> Status in “xorg-server” source package in Precise:
> Confirmed
>
> Bug description:
> #2 0xb71de835 in __GI_abort () at abort.c:91
> save_stage = 2
> act = {__sigaction_handler = {sa_handler = 0x407, sa_sigaction =
> 0x407}, sa_mask = {__val = {3075852732, 3075864776, 6, 8, 3217292836,
> 3072910926, 0, 0, 3072250189, 3073691636, 3073691636, 11, 3217294372,
> 3073032746, 2, 3217292836, 8, 0, 3217295596, 0, 7, 0, 5, 3217292940,
> 3217292932, 8, 3073420904, 3073420908, 3075850240, 2, 3076003257, 3}},
> sa_flags = 4, sa_restorer = 0xb730893f}
> sigs = {__val = {32, 0 <repeats 31 times>}}
> #3 0xb7214f9a in __libc_message (do_abort=2, fmt=0xb730cf3c "*** glibc
> detected *** %s: %s: 0x%s ***\n") at
> ../sysdeps/unix/sysv/linux/libc_fatal.c:201
> ap = 0xb6eee000 ""
> ap_copy = 0xb6eee000 ""
> fd = 2
> on_2 = <optimized out>
> list = <optimized out>
> nlist = <optimized out>
> cp = <optimized out>
> written = <optimized out>
> #4 0xb721fae2 in malloc_printerr (action=<optimized out>, str=<optimized
> out>, ptr=0xb98da700) at malloc.c:5007
> buf = "b98da700"
> cp = <optimized out>
> #5 0xb767bd1b in XIDestroyDeviceProperty (prop=0xb98da700) at
> ../../Xi/xiproperty.c:631
> No locals.
> #6 0xb767c2a4 in XIDeleteAllDeviceProperties (device=0xb98d7c18) at
> ../../Xi/xiproperty.c:648
> prop = 0xb98da700
> next = 0xb98d8360
> curr_handler = <optimized out>
> next_handler = <optimized out>
> #7 0xb7587b2d in CloseDevice (dev=0xb98d7c18) at ../../dix/devices.c:919
> screen = 0xb947d6d0
> classes = <optimized out>
> j = <optimized out>
> #8 0xb758c0dd in RemoveDevice (dev=0xb98d7c18, sendevent=1 '\001') at
> ../../dix/devices.c:1117
> prev = <optimized out>
> tmp = 0xb98d7c18
> next = 0xb98cbe18
> ret = <optimized out>
> screen = <optimized out>
> de...

Please test. :)

Hi Maarten,

I installed the synaptics driver, and rebooted into the standard
kernel, and the standard kernel was really unstable so I rebooted back
into mainstream kernel. I'm a bit concerned about the security
implications of running an old mainstream kernel, but at least the
mainstream kernel is stable. I'm using the same synaptics driver in
both by the way, since it's the same system, and my touchpad works
fine in mainstream.

Perhaps there is something in one of the modules that is part of the
Ubuntu kernel that is not included in the mainstream kernel that is
causing issues? For example, in the mainstream kernel, I can't run
vmware, and there is no ipv6, and app-armor support is significantly
reduced, and I imagine there are some other modules in the Ubuntu
kernel that are not part of the mainstream kernel?

Hugh

On Thu, Jun 7, 2012 at 7:25 PM, Maarten Lankhorst
<email address hidden> wrote:
> Please test. :)
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/943880
>
> Title:
>  Xorg crashed with SIGABRT in __libc_message() from malloc_printerr()
>  via XIDestroyDeviceProperty
>
> Status in “xorg-server” package in Ubuntu:
>  Confirmed
> Status in “xorg-server” source package in Precise:
>  Confirmed
>
> Bug description:
>  #2  0xb71de835 in __GI_abort () at abort.c:91
>          save_stage = 2
>          act = {__sigaction_handler = {sa_handler = 0x407, sa_sigaction = 0x407}, sa_mask = {__val = {3075852732, 3075864776, 6, 8, 3217292836, 3072910926, 0, 0, 3072250189, 3073691636, 3073691636, 11, 3217294372, 3073032746, 2, 3217292836, 8, 0, 3217295596, 0, 7, 0, 5, 3217292940, 3217292932, 8, 3073420904, 3073420908, 3075850240, 2, 3076003257, 3}}, sa_flags = 4, sa_restorer = 0xb730893f}
>          sigs = {__val = {32, 0 <repeats 31 times>}}
>  #3  0xb7214f9a in __libc_message (do_abort=2, fmt=0xb730cf3c "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:201
>          ap = 0xb6eee000 ""
>          ap_copy = 0xb6eee000 ""
>          fd = 2
>          on_2 = <optimized out>
>          list = <optimized out>
>          nlist = <optimized out>
>          cp = <optimized out>
>          written = <optimized out>
>  #4  0xb721fae2 in malloc_printerr (action=<optimized out>, str=<optimized out>, ptr=0xb98da700) at malloc.c:5007
>          buf = "b98da700"
>          cp = <optimized out>
>  #5  0xb767bd1b in XIDestroyDeviceProperty (prop=0xb98da700) at ../../Xi/xiproperty.c:631
>  No locals.
>  #6  0xb767c2a4 in XIDeleteAllDeviceProperties (device=0xb98d7c18) at ../../Xi/xiproperty.c:648
>          prop = 0xb98da700
>          next = 0xb98d8360
>          curr_handler = <optimized out>
>          next_handler = <optimized out>
>  #7  0xb7587b2d in CloseDevice (dev=0xb98d7c18) at ../../dix/devices.c:919
>          screen = 0xb947d6d0
>          classes = <optimized out>
>          j = <optimized out>
>  #8  0xb758c0dd in RemoveDevice (dev=0xb98d7c18, sendevent=1 '\001') at ../../dix/devices.c:1117
>          prev = <optimized out>
>          tmp = 0xb98d7c18
>          next = 0xb98cbe18
>          ret = <optimized out>
>  ...

Hey,

There's no need to change kernel for testing, the bug was specifically abourt X.org crashing in a specific way. I was simply asking if the attached deb fixed that crash or not. It's a X.org driver not a kernel driver.

Cheers,
~Maarten

Thanks a lot.

2012/6/7 Maarten Lankhorst <email address hidden>:
> Please test. :)
>

mlankhorst,
BTW, your version of 'xserver-xorg-input-synaptics' is '1.5.99.902-0ubuntu5.1+fixes', and the version in 'precise-updates' is '1.6.0-0ubuntu1~precise1'.

This is really making me look for alternatives, Do we have some workaround for this ? Does disabling synaptic help ?

I'm using the mainstream kernel for now. It's rock solid. It just
doesn't have VMWare, or full apparmor support, or ipv6.

On Tue, Jun 12, 2012 at 9:29 PM, Aneesh Kumar K.V
<email address hidden> wrote:
> This is really making me look for alternatives, Do we have some
> workaround for this ? Does disabling synaptic help ?
>

> Does disabling synaptic help ?
aneesh-kumar,
if you disable Synaptics driver, then you'll probable need to use an external mouse instead of your touchpad.
---
> I'm using the mainstream kernel for now. It's rock solid.
hughperkins,
Xorg (and its drivers) have nothing to do with Linux kernel.

I was curious about the dialog i receive often about some internal error after startup, or while using the system, and looked at the details. After that i found this bug.

The fact that in the last comments the touchpad is mentioned, and the base report is loenovo x220 related, I can only provide a litte bit as addition:

Current system with the latest updates:
Linux x220i 3.2.0-34-generic #53-Ubuntu SMP Thu Nov 15 10:48:16 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
The synaptics package is:
xserver-xorg-input-synaptics 1.6.2-1ubuntu1~precise2

The syndaemon is running with params:
syndaemon -i 2.0 -K -R -t

And the most important info, i have totally disabled my touchpad for 5 months at least , because i am full satisfied with the trackpoint since i used it with IBM thinkpads for decades. So the touchpad is disabled at boot every time.

Do i need the syndaemon if i never want to use the touchpad? That would be at least for only me(!) a possible workaround.

I also think the crash notification comes more frequently after i use an external monitor and disconnect it (before or after shutdown does not matter), and boot next time without the external monitor.

I hope this helps.

I worked around this bug in the end by adding the following script
into /etc/pm/sleep.d directory. I created this script in July, and
have never seen the problem recur since. I'm using an Acer 1810tz
laptop.

#! /bin/sh

rfkills=$(ls /sys/class/rfkill)
#echo $rfkills

case $1 in
     suspend|suspend_hybrid|hibernate)
        rmmod psmouse
        for rfkill in ${rfkills}; do
           echo 0 > /sys/class/rfkill/$rfkill/state
           sleep 1
        done;
        ;;
     resume|thaw)
        modprobe psmouse
        for rfkill in ${rfkills}; do
           name=$(cat /sys/class/rfkill/$rfkill/name)
           if [ $name = phy0 ]; then
              echo 1 > /sys/class/rfkill/$rfkill/state
           fi;
           sleep 1
        done;
        ;;
esac

On 11/23/12, gna <email address hidden> wrote:
> I was curious about the dialog i receive often about some internal error
> after startup, or while using the system, and looked at the details.
> After that i found this bug.
>
> The fact that in the last comments the touchpad is mentioned, and the
> base report is loenovo x220 related, I can only provide a litte bit as
> addition:
>
> Current system with the latest updates:
> Linux x220i 3.2.0-34-generic #53-Ubuntu SMP Thu Nov 15 10:48:16 UTC 2012
> x86_64 x86_64 x86_64 GNU/Linux
> The synaptics package is:
> xserver-xorg-input-synaptics 1.6.2-1ubuntu1~precise2
>
> The syndaemon is running with params:
> syndaemon -i 2.0 -K -R -t
>
> And the most important info, i have totally disabled my touchpad for 5
> months at least , because i am full satisfied with the trackpoint since
> i used it with IBM thinkpads for decades. So the touchpad is disabled at
> boot every time.
>
> Do i need the syndaemon if i never want to use the touchpad? That would
> be at least for only me(!) a possible workaround.
>
> I also think the crash notification comes more frequently after i use an
> external monitor and disconnect it (before or after shutdown does not
> matter), and boot next time without the external monitor.
>
> I hope this helps.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/943880
>
> Title:
> Xorg crashed with SIGABRT in __libc_message() from malloc_printerr()
> via XIDestroyDeviceProperty
>
> Status in “xorg-server” package in Ubuntu:
> Confirmed
> Status in “xorg-server” source package in Precise:
> Confirmed
>
> Bug description:
> #2 0xb71de835 in __GI_abort () at abort.c:91
> save_stage = 2
> act = {__sigaction_handler = {sa_handler = 0x407, sa_sigaction =
> 0x407}, sa_mask = {__val = {3075852732, 3075864776, 6, 8, 3217292836,
> 3072910926, 0, 0, 3072250189, 3073691636, 3073691636, 11, 3217294372,
> 3073032746, 2, 3217292836, 8, 0, 3217295596, 0, 7, 0, 5, 3217292940,
> 3217292932, 8, 3073420904, 3073420908, 3075850240, 2, 3076003257, 3}},
> sa_flags = 4, sa_restorer = 0xb730893f}
> sigs = {__val = {32, 0 <repeats 31 times>}}
> #3 0xb7214f9a in __libc_message (do_abort=2, fmt=0xb730cf3c "*** glibc
> detected *** %s: %s: 0x%s ***\n") at
> ../sysdeps/unix/sysv/linux/libc_fatal.c:201
> ap = 0xb6eee00...

Should have been fixed in 1.6.2-1ubuntu1~precise2, which has been in precise-updates for some time. Dupe of some other bug .:)