We got this crash in Xvnc based on Xorg 1.14: > Core was generated by `/opt/thinlinc/libexec/Xvnc'. > Program terminated with signal 11, Segmentation fault. > #0 ProcXFixesGetCursorImageAndName (client=0x2d583b0) at cursor.c:517 > 517 width = pCursor->bits->width; More detail in our bugzilla here: https://www.cendio.com/bugzilla/show_bug.cgi?id=6234 It seems to be the same issue reported for Xorg 1.17 here: https://bugzilla.redhat.com/show_bug.cgi?id=1357694 I.e. the XFixes code tries to access a cursor that has already been freed. The code isn't obvious though, but our thinking is that a reference count is needed in CursorDisplayCursor(). Is this the right approach here? (There's also bug 99034 and bug 18451 reported here, but they seem to be other crashes.)
*** Bug 99034 has been marked as a duplicate of this bug. ***
*** Bug 100799 has been marked as a duplicate of this bug. ***
Can somebody reproduce the problem with Xorg running in valgrind, to see where the cursor was freed?
Unfortunately not us. We got this via a customer report and have so far failed to reproduce it here. :/
I'm not familiar with valgrind but I can look into it this weekend.
So after reading a bit about valgrind I determined the relevant tool here would be callgrind to find a call to a method that releases the cursor, however running the following doesn't seem to be outputting any data to the logfile it creates called callgrind.out.<pid of xorg>. kill <pid of xorg> && valgrind --tool=callgrind /usr/bin/Xorg If anyone has an idea of what I should actually be looking for it would be helpful.
valgrind's default memcheck tool by default reports memory which is used after it was freed.
I don't believe anything was output that we didn't already know here, but here's a crash with valgrind running. sudo valgrind /usr/bin/Xorg ==9674== Memcheck, a memory error detector ==9674== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==9674== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for copyright info ==9674== Command: /usr/bin/Xorg ==9674== X.Org X Server 1.19.2 Release Date: 2017-03-02 X Protocol Version 11, Revision 0 Build Operating System: Linux 3.16.0-4-amd64 x86_64 Debian Current Operating System: Linux media-server 4.9.0-2-amd64 #1 SMP Debian 4.9.18-1 (2017-03-30) x86_64 Kernel command line: BOOT_IMAGE=/vmlinuz-4.9.0-2-amd64 root=/dev/mapper/media--server--vg-root ro quiet Build Date: 03 March 2017 03:14:41PM xorg-server 2:1.19.2-1 (https://www.debian.org/support) Current version of pixman: 0.34.0 Before reporting problems, check http://wiki.x.org to make sure that you have the latest version. Markers: (--) probed, (**) from config file, (==) default setting, (++) from command line, (!!) notice, (II) informational, (WW) warning, (EE) error, (NI) not implemented, (??) unknown. (==) Log file: "/var/log/Xorg.0.log", Time: Mon May 1 07:12:16 2017 (==) Using system config directory "/usr/share/X11/xorg.conf.d" (EE) (EE) Backtrace: (EE) 0: /usr/lib/xorg/Xorg (xorg_backtrace+0x4a) [0x5598f330046a] (EE) 1: /usr/lib/xorg/Xorg (0x5598f3147000+0x1bd219) [0x5598f3304219] (EE) 2: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7fa1a3bd3000+0x110c0) [0x7fa1a3be40c0] (EE) 3: /usr/lib/xorg/Xorg (0x5598f3147000+0xe6f4f) [0x5598f322df4f] (EE) 4: /usr/lib/xorg/Xorg (0x5598f3147000+0x545e5) [0x5598f319b5e5] (EE) 5: /usr/lib/xorg/Xorg (0x5598f3147000+0x58568) [0x5598f319f568] (EE) 6: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xf1) [0x7fa1a38552b1] (EE) 7: /usr/lib/xorg/Xorg (_start+0x2a) [0x5598f318921a] (EE) (EE) Segmentation fault at address 0x14 (EE) Fatal server error: (EE) Caught signal 11 (Segmentation fault). Server aborting (EE) (EE) Please consult the The X.Org Foundation support at http://wiki.x.org for help. (EE) Please also check the log file at "/var/log/Xorg.0.log" for additional information. (EE) (II) AIGLX: Suspending AIGLX clients for VT switch (EE) Server terminated with error (1). Closing log file. Aborted
This issue matches my symptoms exactly. I found these upstream commits to address this problem: https://cgit.freedesktop.org/xorg/xserver/commit/?id=aa6651f83c698e8cc40de61aad36c73ca7a6adcf https://cgit.freedesktop.org/xorg/xserver/commit/?id=ceaf4277447407a7430b9bc3205462fbdbae0e39 After applying the above two changes to 1.17.2, the issue was resolved. I also noted that Adam Jackson had also applied these changes to the RHEL 7.4 xorg-x11-server package. Confirm, but I think this issue can be closed.
-- GitLab Migration Automatic Message -- This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/xorg/xserver/issues/518.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.