Bug 91409 - xf86-input-synaptics segfaults in HandleTouches
Summary: xf86-input-synaptics segfaults in HandleTouches
Status: RESOLVED WONTFIX
Alias: None
Product: xorg
Classification: Unclassified
Component: Input/synaptics (show other bugs)
Version: unspecified
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Peter Hutterer
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-21 00:37 UTC by Morgan Shirley
Modified: 2017-03-09 01:23 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
Full stack trace (6.73 KB, text/plain)
2015-07-21 00:37 UTC, Morgan Shirley
no flags Details

Description Morgan Shirley 2015-07-21 00:37:17 UTC
Created attachment 117269 [details]
Full stack trace

Occasionally Xorg will crash. I haven't been able to reproduce it consistently. I analysed the core dump from the most recent crash and it appears to be a segfault inside the synaptics driver code.

Here's the frame that raises the segfault signal:

      #9  0x00007fe21b131fde in HandleTouches (hw=0x2c90940, pInfo=0x2c90940) at synaptics.c:3041
              slot = <optimized out>
              para = 0x2d06290
              restart_touches = <optimized out>
              i = 72
              priv = 0x2d06290
              new_active_touches = <optimized out>
              min_touches = <optimized out>

Line 3041 in synaptics.c is as follows:

    if (hw->slot_state[slot] == SLOTSTATE_UPDATE && !restart_touches)

Slot is set to priv->open_slots[i], which seems to be the problem.

    (gdb) print *(priv->open_slots)
    $9 = 0
    (gdb) print i
    $10 = 72
    (gdb) print priv->open_slots[72]
    $11 = 51371952
    (gdb) print hw->slot_state[51371952]
    Cannot access memory at address 0xf088d30

My laptop model is Acer Aspire E5-571-37SY. Let me know if any other information would be helpful.
Comment 1 Peter Hutterer 2015-07-22 06:30:16 UTC
what version of synaptics and libevdev is this?

it's a bug that has been coming back intermittently but seems to evade all attempts to reproduce it. all I know is that at some point the slot count gets whacky and that causes the crash.
Comment 2 Morgan Shirley 2015-07-22 15:43:26 UTC
Synaptics is 1.8.2.2-x86_64, compiled with debugging symbols. Libevdev is 1.4.3-1, installed from the Arch Linux "extra" repository.
Comment 3 Peter Hutterer 2015-08-12 05:55:21 UTC
fwiw, if you can figure out any way to make this reproducible that'd be much appreciated.
Comment 4 Peter Hutterer 2017-03-09 01:23:33 UTC
There's no CANTFIX resolution here, sorry. But without a reproducible test case we've been unable to find the cause for this.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.