Bug 27845 - Xnest segfault with multiple screens (possibly DIX bug)
Summary: Xnest segfault with multiple screens (possibly DIX bug)
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Server/DDX/Xnest (show other bugs)
Version: 7.4 (2008.09)
Hardware: Other All
: high major
Assignee: Xorg Project Team
QA Contact: Xorg Project Team
URL:
Whiteboard: 2011BRB_Reviewed
Keywords:
: 35123 (view as bug list)
Depends on:
Blocks:
 
Reported: 2010-04-26 21:23 UTC by Peter Hutterer
Modified: 2017-03-20 04:29 UTC (History)
5 users (show)

See Also:
i915 platform:
i915 features:


Attachments
Ensure cursor is realized on screen before defining it (383 bytes, patch)
2011-09-25 14:49 UTC, Alex Plotnick
no flags Details | Splinter Review

Description Peter Hutterer 2010-04-26 21:23:15 UTC
start xnest with "Xnest -scrns 2 :3", then move the mouse between the windows. Xnest crashes with a backtrace of

Backtrace:
0: Xnest (xorg_backtrace+0x3a) [0x81c138e]
1: Xnest (0x8048000+0x17cea0) [0x81c4ea0]
2: (vdso) (__kernel_rt_sigreturn+0x0) [0xd6d40c]
3: Xnest (miPointerUpdateSprite+0x1cd) [0x806e78a]
4: Xnest (0x8048000+0x2610f) [0x806e10f]
5: Xnest (0x8048000+0x1b41a) [0x806341a]
6: Xnest (0x8048000+0x14a6d7) [0x81926d7]
7: Xnest (miPointerWarpCursor+0x19a) [0x806e5b6]
8: Xnest (0x8048000+0x26238) [0x806e238]
9: Xnest (0x8048000+0x1459b5) [0x818d9b5]
10: Xnest (0x8048000+0x145ead) [0x818dead]
11: Xnest (NewCurrentScreen+0x1e6) [0x81929b8]
12: Xnest (0x8048000+0x14f23) [0x805cf23]
13: Xnest (0x8048000+0x16dfd) [0x805edfd]
14: Xnest (WakeupHandler+0x65) [0x8189a8e]
15: Xnest (WaitForSomething+0x3b7) [0x81be595]
16: Xnest (0x8048000+0x13445f) [0x817c45f]
17: Xnest (0x8048000+0x175faa) [0x81bdfaa]
18: /lib/libc.so.6 (__libc_start_main+0xe6) [0x3fdbb6]
19: Xnest (0x8048000+0x124c1) [0x805a4c1]
Segmentation fault at address (nil)


Affected are all 1.7 releases and newer.
Comment 1 Alistair Leslie-Hughes 2011-09-25 03:35:11 UTC
The crash occurs in function xnestSetCursor in file xnest/Curosr.c

The cause is dixLookupScreenPrivate returns a NULL pointer, but is dereferenced in the macro xnestCursor.

Should dixLookupScreenPrivate be able to return a NULL pointer?
Comment 2 Alistair Leslie-Hughes 2011-09-25 03:42:21 UTC
*** Bug 35123 has been marked as a duplicate of this bug. ***
Comment 3 Alex Plotnick 2011-09-25 14:49:23 UTC
Created attachment 51604 [details] [review]
Ensure cursor is realized on screen before defining it

I've done a little digging into this as well, and while Comment #2 is correct as to the proximate cause, I don't think that's the problem. It seems that xnestRealizeCursor, which sets up the private data that xnestCursor is expecting, is only being called for the first screen. So when the pointer enters any screen but the first, xnestCursor tries to access the private data for an unrealized cursor, and it explodes.

This simple patch seems to fix the problem, but it feels kludgey. If someone with actual knowledge of the X internals wants to suggest a better way, that would be appreciated.
Comment 4 Peter Hutterer 2011-10-04 20:55:06 UTC
I remember looking at this a few months ago and the confusing bit back then was that it works for the Xorg ddx but not for Xnest. so something else is broken but I didn't figure out what it was before I got pulled away again.

figuring out why it is only called for the first screen (but works for xfree86 nonetheless) may reveal either the true bug or even a bug in the DIX.
Comment 5 Matthias Clasen 2015-07-25 17:52:14 UTC
I am still experiencing crashes in Xnest -scrns 2 as soon as a client connects. This is sad, because Xephyr doesn't support multiple screens, so Xnest is the only convenient way of debugging multi-screen issues, short of finding actual hw.
Comment 6 Peter Hutterer 2017-03-20 04:29:07 UTC
closing as fixed, just tested this on 1.19.2 and it doesn't crash. If there's still something  like that around, it'll likely be a different bug.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.