Bug 56523 - xserver crash when going into "tablet mode" with acpid 2.0.17
Summary: xserver crash when going into "tablet mode" with acpid 2.0.17
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Server/General (show other bugs)
Version: 7.7 (2012.06)
Hardware: x86-64 (AMD64) Linux (All)
: medium major
Assignee: Peter Hutterer
QA Contact: Xorg Project Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-10-29 14:09 UTC by Alessandro Londero
Modified: 2013-02-21 22:11 UTC (History)
4 users (show)

See Also:
i915 platform:
i915 features:


Attachments
Xorg log (34.58 KB, text/plain)
2012-10-29 14:09 UTC, Alessandro Londero
no flags Details
Untested patch. (884 bytes, patch)
2013-01-18 02:02 UTC, Ted Felix
no flags Details | Splinter Review

Description Alessandro Londero 2012-10-29 14:09:01 UTC
Created attachment 69229 [details]
Xorg log

When starting X it works fine until I put the screen over the keyboard.
At this time if I work with gdm3 launched I come back to login screen losing everything I launched. But I tried with the startx command (after stoping gdm3) and I joint to this the Xorg.log that appeared after the bug occured.
Comment 1 jemofthewest 2013-01-17 14:37:29 UTC
I also have this problem.  Do you by any chance use a Lenovo X201t?

http://sprunge.us/hcWZ
Comment 2 jemofthewest 2013-01-17 14:45:54 UTC
I'd like to note that it works with the LTS kernel, but any of the later versions it crashes.  Happens for both XFCE and Awesome, Compiz or xcompmgr or nothing.
Comment 3 Alessandro Londero 2013-01-17 15:03:09 UTC
(In reply to comment #0)
> Created attachment 69229 [details]
> Xorg log
> 
> When starting X it works fine until I put the screen over the keyboard.
> At this time if I work with gdm3 launched I come back to login screen losing
> everything I launched. But I tried with the startx command (after stoping
> gdm3) and I joint to this the Xorg.log that appeared after the bug occured.

(In reply to comment #1)
> I also have this problem.  Do you by any chance use a Lenovo X201t?

No I have a Lenovo X61t (reversible)

> 
> http://sprunge.us/hcWZ
Comment 4 jemofthewest 2013-01-17 15:53:24 UTC
Well at least its both Lenovo tablets.

I should note that I've been having this issue since about the time Alessandro posted it.  I first tried getting support here:

https://bbs.archlinux.org/viewtopic.php?id=151287

But never got around to filing a bug report.  I've tried it with twm, xterm, and xclock only and it still crashed.  I'm a bit of a n00b and tried running it with valgrind too with no extra info.
Comment 5 jemofthewest 2013-01-17 16:18:25 UTC
Do you have acpid installed?  Try killing acpid and see if it still happens.  I believe the problem might be with a new acpi event added (tablet-mode).
Comment 6 Alessandro Londero 2013-01-17 21:10:13 UTC
(In reply to comment #5)
> Do you have acpid installed?  Try killing acpid and see if it still happens.
> I believe the problem might be with a new acpi event added (tablet-mode).

I run debian sid so acpid is installed and enabled so I tried in terminal :

service acpid stop

and then rotating the screen is no a problem anymore (X dont crash)
Tomorrow I will post a debug from acpid if convenient

Thanks for the tip
Comment 7 jemofthewest 2013-01-17 22:05:55 UTC
Debian huh :-O

I except this from ArchLinux, but surprised it showed up in debian too.

I'm in contact with the acpid dev right now through email, it might still be an X server problem but we're working through some basic troubleshooting.  I can CC you if you'd like.  Here is my bug report:

https://sourceforge.net/tracker/?func=detail&atid=407341&aid=3601274&group_id=33140
Comment 8 Ted Felix 2013-01-18 02:02:59 UTC
Created attachment 73227 [details] [review]
Untested patch.

I've not actually tested this patch within xserver, but I have tested it in a unit test driver.  It builds and works.
Comment 9 Ted Felix 2013-01-18 02:06:33 UTC
acpid is sending strings that are in a format that lnxACPIGetEventFromOs() doesn't expect.  This triggers a crash due to an unchecked NULL pointer.  I've updated acpid to send strings formatted as xserver expects.  If you can, get the latest acpid source in git and try it out.

In the meantime, the patch above should also prevent xserver from crashing in the future given unexpected input via the acpid socket.

This might be a security issue as a userspace program might be able to create /var/run/acpid.socket, and with an appropriate string, crash xserver.  Of course, acpid would have to be absent.
Comment 10 Alessandro Londero 2013-01-23 13:06:42 UTC
I will try the patch as soon as possible
Comment 11 Ted Felix 2013-01-23 13:49:31 UTC
  Thanks, Alessandro.  One of the normal paths through lnxACPIGetEventFromOs() should be sufficient (looks like monitor switching on a laptop is really all this handles).

  Then you might want to hack acpid to send bad strings for one of the easier "video" events like brightness up/down.  That should test the failure path.  The path in question requires a tablet PC which might be hard to come by.  As an example in acpid's input_layer.c, change the following line:

{{{0,0}, EV_KEY, KEY_BRIGHTNESSUP, 1},
    "video/brightnessup BRTUP 00000086 00000000"},

to something like this:

{{{0,0}, EV_KEY, KEY_BRIGHTNESSUP, 1},
    "video/brightnessup BRTUP"},

Then just use the brightness up button on a laptop.  That would crash the pre-patch version of lnxACPIGetEventFromOs().  The following variations will test all paths:

"video/brightnessup BRTUP 00000086"
"video/brightnessup"

  acpid source can be found here:

http://sourceforge.net/p/acpid2/code
Comment 12 Peter Hutterer 2013-01-29 07:43:00 UTC
http://patchwork.freedesktop.org/patch/12953/
Comment 13 Peter Hutterer 2013-02-15 01:51:42 UTC
commit 3d35dfcf5bad1b0a028fbecd65cb6cf6ebf12503
Author: Ted Felix <ted@tedfelix.com>
Date:   Tue Jan 29 16:36:48 2013 +1000

    xfree86: bail on misformed acpi strings (#73227)


sorry bug reference is wrong, I accidentally used the attachment ID instead.
Comment 14 Alessandro Londero 2013-02-21 22:11:45 UTC
Upgrading acpid to 2.18 solved this bug

Thanks to all people who worked to solve this bug.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.