xserver-xfree86: X crashes on load, UltraSPARC with 2.6.xx kernel and udev

Bug #10271 reported by Debian Bug Importer
4
Affects Status Importance Assigned to Milestone
xfree86 (Debian)
Fix Released
Unknown
xfree86 (Ubuntu)
Invalid
High
Fabio Massimo Di Nitto

Bug Description

Automatically imported from Debian bug report #280384 http://bugs.debian.org/280384

CVE References

Revision history for this message
In , Domenico Andreoli (cavok) wrote : why this is tagged experimental?

tags 280384 - experimental
thanks

uh? why this bug is tagged experimental? there is no xfree86 version
in experimental.

dom

-----[ Domenico Andreoli, aka cavok
 --[ http://people.debian.org/~cavok/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936 4FEE 0677 9033 A20E BC50

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Automatically imported from Debian bug report #280384 http://bugs.debian.org/280384

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Sat, 13 Nov 2004 16:52:08 +0100
From: Domenico Andreoli <email address hidden>
To: <email address hidden>
Subject: why this is tagged experimental?

tags 280384 - experimental
thanks

uh? why this bug is tagged experimental? there is no xfree86 version
in experimental.

dom

-----[ Domenico Andreoli, aka cavok
 --[ http://people.debian.org/~cavok/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936 4FEE 0677 9033 A20E BC50

Revision history for this message
Fabio Massimo Di Nitto (fabbione) wrote :

sparc is not a supported arch (yet).

Revision history for this message
In , Peter De Schrijver (p2-ulyssis) wrote : kernel version

Hi,

I couldn't reproduce the problem on my ultra 10 running the 2.6.8 debian
kernel for sparc64. Could you try to reproduce the problem using the
debian 2.6.8 kernel for sparc 64 ? I use kernel-image-2.6.8-1-sparc64.

Cheers,

Peter (p2).

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Sat, 27 Nov 2004 00:44:26 +0100
From: <email address hidden> (Peter De Schrijver)
To: <email address hidden>, <email address hidden>
Subject: kernel version

Hi,

I couldn't reproduce the problem on my ultra 10 running the 2.6.8 debian
kernel for sparc64. Could you try to reproduce the problem using the
debian 2.6.8 kernel for sparc 64 ? I use kernel-image-2.6.8-1-sparc64.

Cheers,

Peter (p2).

Revision history for this message
In , Admar Schoonen (admar) wrote : Re: XFree not starting any more

On Fri, Nov 26, 2004 at 06:40:25PM -0500, Ron Murray wrote:
> From your logs, this looks like the same problem I'm getting with
> an E250 on 2.6 kernels (see the thread on this list a few days ago
> titled "Re: E250, Raptor gfx, kernel 2.6: questions...". I believe
> that http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=280384 also
> refers to the same problem.

This looks like the same problem I have. I found out that a work around for me
was to install xserver-xfree86-dbg and use that server.

Admar

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Sat, 27 Nov 2004 11:52:43 +0100
From: Admar Schoonen <email address hidden>
To: Ron Murray <email address hidden>, <email address hidden>,
        <email address hidden>
Subject: Re: XFree not starting any more

On Fri, Nov 26, 2004 at 06:40:25PM -0500, Ron Murray wrote:
> From your logs, this looks like the same problem I'm getting with
> an E250 on 2.6 kernels (see the thread on this list a few days ago
> titled "Re: E250, Raptor gfx, kernel 2.6: questions...". I believe
> that http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=280384 also
> refers to the same problem.

This looks like the same problem I have. I found out that a work around for me
was to install xserver-xfree86-dbg and use that server.

Admar

Revision history for this message
In , Ron Murray (murrayr) wrote : xserver-xfree86: More trace info...
Download full text (38.5 KiB)

Package: xserver-xfree86
Version: 4.3.0.dfsg.1-8rjmx2
Followup-For: Bug #280384

I hacked the sources to log a trace line at entry and exit points of
most of the functions I could find in the execution sequence,
commencing at the point where it loads baseModules (bitmap and
pcidata) (actual source mods available on request, but probably not
very useful). I also had it log values for symbols found in
xf86PciProbe(), for reasons that will become obvious. Here's an
excerpt from the log (trace lines begin with "File:"):

> (WW) Open APM failed (/dev/apm_bios) (No such device)
> (II) Module ABI versions:
> XFree86 ANSI C Emulation: 0.2
> XFree86 Video Driver: 0.6
> XFree86 XInput driver : 0.4
> XFree86 Server Extension : 0.2
> XFree86 Font Renderer : 0.4
> (II) Loader running on linux
> File xf86Init.c: Loading baseModules.
> (II) LoadModule: "bitmap"
> (II) Loading /usr/X11R6/lib/modules/fonts/libbitmap.a
> (II) Module bitmap: vendor="The XFree86 Project"
> compiled for 4.3.0.1, module version = 1.0.0
> Module class: XFree86 Font Renderer
> ABI class: XFree86 Font Renderer, version 0.4
> (II) Loading font Bitmap
> (II) LoadModule: "pcidata"
> (II) Loading /usr/X11R6/lib/modules/libpcidata.a
> (II) Module pcidata: vendor="The XFree86 Project"
> compiled for 4.3.0.1, module version = 1.0.0
> ABI class: XFree86 Video Driver, version 0.6
> File xf86Init.c: Finished loading baseModules.
> File xf86Init.c: Commencing xf86BusProbe().
> File xf86pciBus.c: Entering xf86PciProbe().
> File xf86pciBus.c: xf86PciProbe(): XFree86LOADER defined.
> File xf86pciBus.c, xf86PciProbe(): xf86SetupPciIds = 0x7029c008.
> File xf86pciBus.c, xf86PciProbe(): xf86ClosePciIds = 0x7029c05c.
> File xf86pciBus.c, xf86PciProbe(): xf86FindPciNamesByDevice = 0x7029c0ac.
> File xf86pciBus.c, xf86PciProbe(): xf86FindPciNamesBySubsys = 0x7029c4e4.
> File xf86pciBus.c, xf86PciProbe(): xf86FindPciClassBySubsys = 0x7029c6dc.
> File xf86pciBus.c, xf86PciProbe(): xf86FindPciClassByDevice = 0x7029c864.
> File xf86pciBus.c, xf86PciProbe(): Calling xf86SetupPciIds().

   Note that the crash (usually a segfault) occurs when it calls
xf86SetupPciIds() in the file noted. I'd added tracing code at the
beginning of that routine, which seems to be never reached. This led
me to think that there's a problem in the binary loader somehow, which
is why I had it print the values of the entry points it found (I
thought they might be nulls, for example. No such luck.).

   So it appears to be related to the loader in some way, although why
it should be ok on a 2.4 kernel (actually 2.4.27) and not ok on a 2.6
kernel (2.6.9), I have no idea.

Hope this helps,

 .....Ron

-- Package-specific info:
Contents of /var/lib/xfree86/X.roster:
xserver-xfree86
xserver-xfree86-dbg

/etc/X11/X target unchanged from checksum in /var/lib/xfree86/X.md5sum.

X server symlink status:
lrwxrwxrwx 1 root root 20 Nov 24 08:04 /etc/X11/X -> /usr/bin/X11/XFree86
-rwxr-xr-x 1 root root 1785872 Nov 28 20:38 /usr/bin/X11/XFree86

Contents of /var/lib/xfree86/XF86Config-4.roster:
xserver-xfree86
xserver-xfree86-dbg

VGA-compatible devices on PCI bus:

/var/lib/xfree86/XF86Config-4.md5sum does not exist.

XF...

Revision history for this message
In , Admar Schoonen (admar) wrote : Re: XFree crashing on kernel 2.4.28

On Wed, Dec 01, 2004 at 09:52:48AM -0800, <email address hidden> wrote:
> A couple of issues come to mind looking at the transcript of our bug
> #280384:
>
> 1) Why couldn't Peter De Schrijver experience this problem for himself
> on the Debian 2.6.8.1 kernel?
>
> 2) Why does Admar Schoonen's work-around (using the debug server)
> function properly? I think it's supremely ironic that the debug build
> doesn't have the bug. LOL.

Well, I have to admit that this bug does occur on my Sun Blade 100 (with 2
almost identical ati mach 64 cards), but not on my Sun Ultra 5 (with only 1 ati
mach 64 card that is slightly different than the one in the blade 100).

The bug also doesn't occur on a Sun Ultra 5 at my friend's place, but iirc, it
does occur on an Ultra 5 or Ultra 10 from someone else, so I'm a bit sceptical
to say that U5's are not affected.

The fact that the debug server doesn't show the bug could indicate that it's a
timing issue, but to be honest, I am a terrible programmer and I wouldn't know
how to start debugging this issue.

I hope this could be useful for someone, and if he/she needs more
information/testing, I'd happy volunteer.

Admar

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Wed, 1 Dec 2004 19:41:28 +0100
From: Admar Schoonen <email address hidden>
To: <email address hidden>, <email address hidden>
Subject: Re: XFree crashing on kernel 2.4.28

On Wed, Dec 01, 2004 at 09:52:48AM -0800, <email address hidden> wrote:
> A couple of issues come to mind looking at the transcript of our bug
> #280384:
>
> 1) Why couldn't Peter De Schrijver experience this problem for himself
> on the Debian 2.6.8.1 kernel?
>
> 2) Why does Admar Schoonen's work-around (using the debug server)
> function properly? I think it's supremely ironic that the debug build
> doesn't have the bug. LOL.

Well, I have to admit that this bug does occur on my Sun Blade 100 (with 2
almost identical ati mach 64 cards), but not on my Sun Ultra 5 (with only 1 ati
mach 64 card that is slightly different than the one in the blade 100).

The bug also doesn't occur on a Sun Ultra 5 at my friend's place, but iirc, it
does occur on an Ultra 5 or Ultra 10 from someone else, so I'm a bit sceptical
to say that U5's are not affected.

The fact that the debug server doesn't show the bug could indicate that it's a
timing issue, but to be honest, I am a terrible programmer and I wouldn't know
how to start debugging this issue.

I hope this could be useful for someone, and if he/she needs more
information/testing, I'd happy volunteer.

Admar

Revision history for this message
In , Branden Robinson (branden) wrote : severity of 280384 is important

# Automatically generated email from bts, devscripts version 2.8.5
 # If it doesn't affect all hardware configurations, it's not grave.
severity 280384 important

Revision history for this message
In , Jurij Smakov (jurij) wrote : Re: XFree crashing on kernel 2.4.28

Hello,

Branden Robinson of the Debian's X Strike Force (XFS) mentioned the bug
#225526
, which might be the same problem, according to him. Presumably,
this bug should be fixed by the following commit to the XFS' SVN
repository:

  * Apply patch from David Mosberger that replaces
    the fix for #225526 with one that works on systems
    that do not have a PCI bus numbered 0. Thanks,
    David! (Closes: #279436)

The ultimate test would be to build the packages from the SVN source and
test it on the machines, which are affected. I'll try to arrange the
build, but it can take a while, since I do not have access to any decent
Ultra hardware.

Best regards,

Jurij Smakov <email address hidden>
Key: http://www.wooyd.org/pgpkey/ KeyID: C99E03CC

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <Pine.LNX.4.61.0412011955430.1818@bobcat>
Date: Wed, 1 Dec 2004 20:08:21 -0500 (EST)
From: Jurij Smakov <email address hidden>
To: <email address hidden>
Cc: <email address hidden>
Subject: Re: XFree crashing on kernel 2.4.28

Hello,

Branden Robinson of the Debian's X Strike Force (XFS) mentioned the bug
#225526
, which might be the same problem, according to him. Presumably,
this bug should be fixed by the following commit to the XFS' SVN
repository:

  * Apply patch from David Mosberger that replaces
    the fix for #225526 with one that works on systems
    that do not have a PCI bus numbered 0. Thanks,
    David! (Closes: #279436)

The ultimate test would be to build the packages from the SVN source and
test it on the machines, which are affected. I'll try to arrange the
build, but it can take a while, since I do not have access to any decent
Ultra hardware.

Best regards,

Jurij Smakov <email address hidden>
Key: http://www.wooyd.org/pgpkey/ KeyID: C99E03CC

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-Id: <email address hidden>
Date: Wed, 1 Dec 2004 19:52:05 -0500
From: Branden Robinson <email address hidden>
To: <email address hidden>
Subject: severity of 280384 is important

# Automatically generated email from bts, devscripts version 2.8.5
 # If it doesn't affect all hardware configurations, it's not grave.
severity 280384 important

Revision history for this message
In , Ron Murray (rjmx) wrote :

Jurij Smakov wrote:
> Hello,
>
> Branden Robinson of the Debian's X Strike Force (XFS) mentioned the bug
> #225526, which might be the same problem, according to him. Presumably,
> this bug should be fixed by the following commit to the XFS' SVN
> repository:
>
> * Apply patch from David Mosberger that replaces
> the fix for #225526 with one that works on systems
> that do not have a PCI bus numbered 0. Thanks,
> David! (Closes: #279436)
>
> The ultimate test would be to build the packages from the SVN source and
> test it on the machines, which are affected. I'll try to arrange the
> build, but it can take a while, since I do not have access to any decent
> Ultra hardware.

    Colour me doubtful about this as a fix. Its bug report has an
XFree86.log that actually appears to scan the PCI bus, then does lots of
other things before reporting "no screens found". In contrast, both the
logs from the originator of this thread and the XFree86.log in bug
#280384
show the crash occurring immediately after loading the pcidata
module, with no attempt to scan the PCI bus. That is also my experience,
as evidenced by the log in my own post to bug #280384. They don't look
like the same problem to me at all.

    That said, if somebody can tell me how to extract sources with this
patch, I'm willing to try compiling it. Only takes the machine six hours
these days :-)

  .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4
D86C 74DE

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Wed, 01 Dec 2004 21:25:44 -0500
From: Ron Murray <email address hidden>
To: <email address hidden>
CC: <email address hidden>, <email address hidden>
Subject: Re: XFree crashing on kernel 2.4.28

Jurij Smakov wrote:
> Hello,
>
> Branden Robinson of the Debian's X Strike Force (XFS) mentioned the bug
> #225526, which might be the same problem, according to him. Presumably,
> this bug should be fixed by the following commit to the XFS' SVN
> repository:
>
> * Apply patch from David Mosberger that replaces
> the fix for #225526 with one that works on systems
> that do not have a PCI bus numbered 0. Thanks,
> David! (Closes: #279436)
>
> The ultimate test would be to build the packages from the SVN source and
> test it on the machines, which are affected. I'll try to arrange the
> build, but it can take a while, since I do not have access to any decent
> Ultra hardware.

    Colour me doubtful about this as a fix. Its bug report has an
XFree86.log that actually appears to scan the PCI bus, then does lots of
other things before reporting "no screens found". In contrast, both the
logs from the originator of this thread and the XFree86.log in bug
#280384
show the crash occurring immediately after loading the pcidata
module, with no attempt to scan the PCI bus. That is also my experience,
as evidenced by the log in my own post to bug #280384. They don't look
like the same problem to me at all.

    That said, if somebody can tell me how to extract sources with this
patch, I'm willing to try compiling it. Only takes the machine six hours
these days :-)

  .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4
D86C 74DE

Revision history for this message
In , Jurzitza, Dieter (djurzitza) wrote : X11 crashing on 2.4.28

Dear listmembers,
I can confirm for my U60 that the XFree86-debug server comes up on 2.4.28. So I seem to be consistent with what Admar said and what Ron has been saying. What makes me wonder, though, is why does the binary loader work with 2.4.27 and does not work with 2.4.28.
And, moreover, if it is a loader issue it seems more plausible to me that I can observe additional side effects on 2.4.28 not being related to X11 (like very long reaction times on ping / ssh requests, not settling a network connection for quite a while)
A propably dumb question:
is that binary loader a simple file? would it be possible to get that loader from another version (like Debian Woody), or is it buried deep down in the kernel?
Thank you for your inputs,
take care

Dieter Jurzitza

--
________________________________________________

HARMAN BECKER AUTOMOTIVE SYSTEMS

Dr.-Ing. Dieter Jurzitza
Manager Hardware Systems
   System Development

Industriegebiet Ittersbach
Becker-Göring Str. 16
D-76307 Karlsbad / Germany

Phone: +49 (0)7248 71-1577
Fax: +49 (0)7248 71-1216
eMail: <email address hidden>
Internet: http://www.becker.de

*******************************************
Diese E-Mail enthaelt vertrauliche und/oder rechtlich geschuetzte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte sofort den Absender und loeschen Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet.

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and delete this e-mail. Any unauthorized copying, disclosure or distribution of the contents in this e-mail is strictly forbidden.
*******************************************

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Thu, 2 Dec 2004 07:23:19 +0100
From: "Jurzitza, Dieter" <email address hidden>
To: <email address hidden>, <email address hidden>
Subject: X11 crashing on 2.4.28

Dear listmembers,
I can confirm for my U60 that the XFree86-debug server comes up on 2.4.28. =
So I seem to be consistent with what Admar said and what Ron has been sayin=
g. What makes me wonder, though, is why does the binary loader work with 2.=
4.27 and does not work with 2.4.28.
And, moreover, if it is a loader issue it seems more plausible to me that I=
 can observe additional side effects on 2.4.28 not being related to X11 (li=
ke very long reaction times on ping / ssh requests, not settling a network =
connection for quite a while)
A propably dumb question:
is that binary loader a simple file? would it be possible to get that loade=
r from another version (like Debian Woody), or is it buried deep down in th=
e kernel?
Thank you for your inputs,
take care

Dieter Jurzitza

--=20
________________________________________________

HARMAN BECKER AUTOMOTIVE SYSTEMS

Dr.-Ing. Dieter Jurzitza
Manager Hardware Systems
   System Development

Industriegebiet Ittersbach
Becker-G=F6ring Str. 16
D-76307 Karlsbad / Germany

Phone: +49 (0)7248 71-1577
Fax: +49 (0)7248 71-1216
eMail: <email address hidden>
Internet: http://www.becker.de
=20

*******************************************
Diese E-Mail enthaelt vertrauliche und/oder rechtlich geschuetzte Informati=
onen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtuemli=
ch erhalten haben, informieren Sie bitte sofort den Absender und loeschen S=
ie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe diese=
r Mail ist nicht gestattet.
=20
This e-mail may contain confidential and/or privileged information. If you =
are not the intended recipient (or have received this e-mail in error) plea=
se notify the sender immediately and delete this e-mail. Any unauthorized c=
opying, disclosure or distribution of the contents in this e-mail is strict=
ly forbidden.
*******************************************

Revision history for this message
In , Richard Mortimer (richm-oldelvet) wrote :
Download full text (4.8 KiB)

Ok, I think that I've found the problem. The XFree86 binary does its own
object loading and on sparc it is failing to set the PROT_EXEC bit when
mapping executable code. This is falling over a change in the kernel
which checks the executable bit and gives a Segmentation Fault.

Full rationale, explanation and proposed patch below.

Richard

I was looking through the changes between 2.4.27 and 2.4.28 and there is
a patch that adds a check that executed code is actually mapped as
executable (one bit of it is)

diff -urN linux-2.4.27/arch/sparc64/mm/fault.c
linux-2.4.28/arch/sparc64/mm/fault.c
--- linux-2.4.27/arch/sparc64/mm/fault.c 2004-08-07
16:26:04.000000000 -0700
+++ linux-2.4.28/arch/sparc64/mm/fault.c 2004-11-17
03:54:21.156379721 -0800

@@ -404,6 +404,16 @@
         */
 good_area:
        si_code = SEGV_ACCERR;
+
+ /* If we took a ITLB miss on a non-executable page, catch
+ * that here.
+ */
+ if ((fault_code & FAULT_CODE_ITLB) && !(vma->vm_flags &
VM_EXEC)) {
+ BUG_ON(address != regs->tpc);
+ BUG_ON(regs->tstate & TSTATE_PRIV);
+ goto bad_area;
+ }
+
        if (fault_code & FAULT_CODE_WRITE) {
                if (!(vma->vm_flags & VM_WRITE))
                        goto bad_area;

Now given that this reports a SIGSEGV if you hit this issue (see
SEGV_ACCERR at the top of the patch) I figured that this would be
something that could be triggered.

Now looking at the broken strace from 2.4.28 we see two mmaps during the
loading of module pcidata. These correspond to the text(code) and data
sections of the binary.

mmap(NULL, 163840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x70272000
lseek(5, 229836, SEEK_SET) = 229836
read(5, "\0pci_vendor_003d\0pci_vendor_0e11"..., 157024) = 157024
brk(0) = 0x274000
brk(0x296000) = 0x296000
mmap(NULL, 139264, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x7029a000
lseek(5, 380, SEEK_SET) = 380
read(5, "\201\303\340\10\220\20 \1\201\303\340\10\1\0\0\0\235\343"...,
1612) = 1612

Note that neither has PROT_EXEC set in the mmap. The second one is the
text section that really needs it.

Now looking at the XFree86 code in
xc/programs/Xserver/hw/xfree86/loader/elfloader.c

This gets memory for the data in one of two ways (chosen at compile
time):

xf86loadermalloc - actually a call to the glibc2 malloc
or
mmap.

The mmap specifies PROT_EXEC but I've disassembled the XFree86 binary
and it seems to use the xf86loadermalloc option.

   77514: 90 00 40 08 add %g1, %o0, %o0
   77518: 40 05 69 49 call 0x1d1a3c
   7751c: d0 24 60 48 st %o0, [ %l1 + 0x48 ]
   77520: 84 10 00 08 mov %o0, %g2
   77524: 80 a2 20 00 cmp %o0, 0
   77528: 02 80 00 77 be 0x77704

Apologies to those who don't read SPARC assembler!

The call at 77518 is a call to malloc (from the symbol table)

001d1a3c DF *UND* 00000234 GLIBC_2.0 malloc

I'm guessing that malloc doesn't set PROT_EXEC (people generally don't
want it and it would create a security risk).

Now in the el...

Read more...

Revision history for this message
Debian Bug Importer (debzilla) wrote :
Download full text (5.1 KiB)

Message-Id: <1102006978.25600.134.camel@duncow>
Date: Thu, 02 Dec 2004 17:02:58 +0000
From: Richard Mortimer <email address hidden>
To: "Jurzitza, Dieter" <email address hidden>
Cc: <email address hidden>, <email address hidden>
Subject: Re: X11 crashing on 2.4.28

Ok, I think that I've found the problem. The XFree86 binary does its own
object loading and on sparc it is failing to set the PROT_EXEC bit when
mapping executable code. This is falling over a change in the kernel
which checks the executable bit and gives a Segmentation Fault.

Full rationale, explanation and proposed patch below.

Richard

I was looking through the changes between 2.4.27 and 2.4.28 and there is
a patch that adds a check that executed code is actually mapped as
executable (one bit of it is)

diff -urN linux-2.4.27/arch/sparc64/mm/fault.c
linux-2.4.28/arch/sparc64/mm/fault.c
--- linux-2.4.27/arch/sparc64/mm/fault.c 2004-08-07
16:26:04.000000000 -0700
+++ linux-2.4.28/arch/sparc64/mm/fault.c 2004-11-17
03:54:21.156379721 -0800

@@ -404,6 +404,16 @@
         */
 good_area:
        si_code = SEGV_ACCERR;
+
+ /* If we took a ITLB miss on a non-executable page, catch
+ * that here.
+ */
+ if ((fault_code & FAULT_CODE_ITLB) && !(vma->vm_flags &
VM_EXEC)) {
+ BUG_ON(address != regs->tpc);
+ BUG_ON(regs->tstate & TSTATE_PRIV);
+ goto bad_area;
+ }
+
        if (fault_code & FAULT_CODE_WRITE) {
                if (!(vma->vm_flags & VM_WRITE))
                        goto bad_area;

Now given that this reports a SIGSEGV if you hit this issue (see
SEGV_ACCERR at the top of the patch) I figured that this would be
something that could be triggered.

Now looking at the broken strace from 2.4.28 we see two mmaps during the
loading of module pcidata. These correspond to the text(code) and data
sections of the binary.

mmap(NULL, 163840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x70272000
lseek(5, 229836, SEEK_SET) = 229836
read(5, "\0pci_vendor_003d\0pci_vendor_0e11"..., 157024) = 157024
brk(0) = 0x274000
brk(0x296000) = 0x296000
mmap(NULL, 139264, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x7029a000
lseek(5, 380, SEEK_SET) = 380
read(5, "\201\303\340\10\220\20 \1\201\303\340\10\1\0\0\0\235\343"...,
1612) = 1612

Note that neither has PROT_EXEC set in the mmap. The second one is the
text section that really needs it.

Now looking at the XFree86 code in
xc/programs/Xserver/hw/xfree86/loader/elfloader.c

This gets memory for the data in one of two ways (chosen at compile
time):

xf86loadermalloc - actually a call to the glibc2 malloc
or
mmap.

The mmap specifies PROT_EXEC but I've disassembled the XFree86 binary
and it seems to use the xf86loadermalloc option.

   77514: 90 00 40 08 add %g1, %o0, %o0
   77518: 40 05 69 49 call 0x1d1a3c
   7751c: d0 24 60 48 st %o0, [ %l1 + 0x48 ]
   77520: 84 10 00 08 mov %o0, %g2
   77524: 80 a2 20 00 cmp %o0, 0
   77528: 02 80 00 77 be 0x77704

Apologies to those w...

Read more...

Revision history for this message
In , Ron Murray (rjmx) wrote :

At Thu, 02 Dec 2004 17:02:58 +0000,
Richard Mortimer <email address hidden> wrote:
>
> Ok, I think that I've found the problem. The XFree86 binary does its own
> object loading and on sparc it is failing to set the PROT_EXEC bit when
> mapping executable code. This is falling over a change in the kernel
> which checks the executable bit and gives a Segmentation Fault.
>
> Full rationale, explanation and proposed patch below.

...

   Wow. Well done! That's certainly consistent with what I see.

>
> Anyone fancy compiling a new xserver binary?
>

   I'll set one going before I leave work this afternoon. Should have
completed by tomorrow morning.

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
In , Ron Murray (rjmx) wrote :

At Thu, 02 Dec 2004 13:45:59 -0500,
Ron Murray wrote:

> > Anyone fancy compiling a new xserver binary?
> >
>
> I'll set one going before I leave work this afternoon. Should have
> completed by tomorrow morning.
>

   We have a minor problem. Richard's patch seems to refer to a
pristine xfree86-4.3.0 source. When I came to check the patch location
on a build tree that had had the Debian patches applied, I found it to
be quite different. Specifically, the line Richard wanted to change
was now

# if defined(linux) || defined(__OpenBSD__)

instead of

# if defined(linux) && defined(__ia64__) || defined(__OpenBSD__)

   Clearly, there's a Debian patch involved here. I found it at
debian/patches/071_nonexecutable_malloced_mem.diff

and it goes:

> $Id: 071_nonexecutable_malloced_mem.diff 1044 2004-02-16 17:40:33Z branden $
>
> This patch fixes the assumption that data returned by malloc() is
> executable. In upstream revision 1.43, the assumption was fixed for
> ia64 only. We understand it is Linus' position that programs that
> assume data to be executable are broken, so we enable this code for
> all Linux platforms.
>
> Original patch (before upstream applied its own version) was by David
> Mosberger.
> diff -urN xc/programs/Xserver/hw/xfree86/loader/elfloader.c
> xc.new/programs/Xserver/hw/xfree86/loader/elfloader.c
> --- xc/programs/Xserver/hw/xfree86/loader/elfloader.c 2004-02-07
> 17:33:29.000000000 -0500
> +++ xc.new/programs/Xserver/hw/xfree86/loader/elfloader.c
> 2004-02-07 17:29:03.000000000 -0500
> @@ -957,7 +957,7 @@
> ErrorF( "ELFCreateGOT() Unable to reallocate memory!!!!\n"
> );
> return FALSE;
> }
> -# if defined(linux) && defined(__ia64__) || defined(__OpenBSD__)
> +# if defined(linux) || defined(__OpenBSD__)
> {
> unsigned long page_size = getpagesize();
> unsigned long round;

   ... which would indicate that Richard's suggestion is already in
the current Debian package. I'd made a build log when I built the
package here, and I have

> Applying patch debian/patches/071_nonexecutable_malloced_mem.diff ... successful.

   in it, so I'm sure it's in the build.

   Richard, does this look likely? Are there any other places that
could stuff up the exec bit?

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <87vfbk4jyw.wl%<email address hidden>>
Date: Thu, 02 Dec 2004 13:45:59 -0500
From: Ron Murray <email address hidden>
To: Richard Mortimer <email address hidden>
Cc: "Jurzitza, Dieter" <email address hidden>,
 <email address hidden>, <email address hidden>
Subject: Re: X11 crashing on 2.4.28

At Thu, 02 Dec 2004 17:02:58 +0000,
Richard Mortimer <email address hidden> wrote:
>
> Ok, I think that I've found the problem. The XFree86 binary does its own
> object loading and on sparc it is failing to set the PROT_EXEC bit when
> mapping executable code. This is falling over a change in the kernel
> which checks the executable bit and gives a Segmentation Fault.
>
> Full rationale, explanation and proposed patch below.

...

   Wow. Well done! That's certainly consistent with what I see.

>
> Anyone fancy compiling a new xserver binary?
>

   I'll set one going before I leave work this afternoon. Should have
completed by tomorrow morning.

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <87sm6o4i2g.wl%<email address hidden>>
Date: Thu, 02 Dec 2004 14:27:03 -0500
From: Ron Murray <email address hidden>
To: <email address hidden>
Cc: Richard Mortimer <email address hidden>, "Jurzitza, Dieter" <email address hidden>,
 <email address hidden>, <email address hidden>
Subject: Re: X11 crashing on 2.4.28

At Thu, 02 Dec 2004 13:45:59 -0500,
Ron Murray wrote:

> > Anyone fancy compiling a new xserver binary?
> >
>
> I'll set one going before I leave work this afternoon. Should have
> completed by tomorrow morning.
>

   We have a minor problem. Richard's patch seems to refer to a
pristine xfree86-4.3.0 source. When I came to check the patch location
on a build tree that had had the Debian patches applied, I found it to
be quite different. Specifically, the line Richard wanted to change
was now

# if defined(linux) || defined(__OpenBSD__)

instead of

# if defined(linux) && defined(__ia64__) || defined(__OpenBSD__)

   Clearly, there's a Debian patch involved here. I found it at
debian/patches/071_nonexecutable_malloced_mem.diff

and it goes:

> $Id: 071_nonexecutable_malloced_mem.diff 1044 2004-02-16 17:40:33Z branden $
>
> This patch fixes the assumption that data returned by malloc() is
> executable. In upstream revision 1.43, the assumption was fixed for
> ia64 only. We understand it is Linus' position that programs that
> assume data to be executable are broken, so we enable this code for
> all Linux platforms.
>
> Original patch (before upstream applied its own version) was by David
> Mosberger.
> diff -urN xc/programs/Xserver/hw/xfree86/loader/elfloader.c
> xc.new/programs/Xserver/hw/xfree86/loader/elfloader.c
> --- xc/programs/Xserver/hw/xfree86/loader/elfloader.c 2004-02-07
> 17:33:29.000000000 -0500
> +++ xc.new/programs/Xserver/hw/xfree86/loader/elfloader.c
> 2004-02-07 17:29:03.000000000 -0500
> @@ -957,7 +957,7 @@
> ErrorF( "ELFCreateGOT() Unable to reallocate memory!!!!\n"
> );
> return FALSE;
> }
> -# if defined(linux) && defined(__ia64__) || defined(__OpenBSD__)
> +# if defined(linux) || defined(__OpenBSD__)
> {
> unsigned long page_size = getpagesize();
> unsigned long round;

   ... which would indicate that Richard's suggestion is already in
the current Debian package. I'd made a build log when I built the
package here, and I have

> Applying patch debian/patches/071_nonexecutable_malloced_mem.diff ... successful.

   in it, so I'm sure it's in the build.

   Richard, does this look likely? Are there any other places that
could stuff up the exec bit?

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
In , Richard Mortimer (richm-oldelvet) wrote :

On Thu, 2004-12-02 at 19:27, Ron Murray wrote:
> At Thu, 02 Dec 2004 13:45:59 -0500,
> Ron Murray wrote:
> We have a minor problem. Richard's patch seems to refer to a
> pristine xfree86-4.3.0 source.

Damn! There are two similar #if defined lines. I made the patch against
the wrong one!

I also accept that I did make the patch against pristine sources -
although in this case it means that you spotted my mistake.

I still stand by my analysis. Hopefully the new patch (below) will work.
Note I've taken the same approach as the one that my original patch
clashed with. Basically I've removed the check for ia64 because I'm
assuming that the non-executable issue could in future apply to all
linux versions.

Richard

--- xc/programs/Xserver/hw/xfree86/loader/elfloader.c.orig
2004-12-02 22:29:26.000000000 +0000
+++ xc/programs/Xserver/hw/xfree86/loader/elfloader.c 2004-12-02
22:38:37.000000000 +0000
@@ -2937,7 +2937,7 @@
        ErrorF( "Unable to allocate ELF sections\n" );
        return NULL;
     }
-# if defined(linux) && defined(__ia64__) || defined(__OpenBSD__)
+# if defined(linux) || defined(__OpenBSD__)
     {
        unsigned long page_size = getpagesize();
        unsigned long round;

--
<email address hidden>

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-Id: <1102027306.25600.183.camel@duncow>
Date: Thu, 02 Dec 2004 22:41:46 +0000
From: Richard Mortimer <email address hidden>
To: <email address hidden>
Cc: "Jurzitza, Dieter" <email address hidden>,
 <email address hidden>, <email address hidden>
Subject: Re: X11 crashing on 2.4.28

On Thu, 2004-12-02 at 19:27, Ron Murray wrote:
> At Thu, 02 Dec 2004 13:45:59 -0500,
> Ron Murray wrote:
> We have a minor problem. Richard's patch seems to refer to a
> pristine xfree86-4.3.0 source.

Damn! There are two similar #if defined lines. I made the patch against
the wrong one!

I also accept that I did make the patch against pristine sources -
although in this case it means that you spotted my mistake.

I still stand by my analysis. Hopefully the new patch (below) will work.
Note I've taken the same approach as the one that my original patch
clashed with. Basically I've removed the check for ia64 because I'm
assuming that the non-executable issue could in future apply to all
linux versions.

Richard

--- xc/programs/Xserver/hw/xfree86/loader/elfloader.c.orig
2004-12-02 22:29:26.000000000 +0000
+++ xc/programs/Xserver/hw/xfree86/loader/elfloader.c 2004-12-02
22:38:37.000000000 +0000
@@ -2937,7 +2937,7 @@
        ErrorF( "Unable to allocate ELF sections\n" );
        return NULL;
     }
-# if defined(linux) && defined(__ia64__) || defined(__OpenBSD__)
+# if defined(linux) || defined(__OpenBSD__)
     {
        unsigned long page_size = getpagesize();
        unsigned long round;

--
<email address hidden>

Revision history for this message
In , Ron Murray (rjmx) wrote :

At Thu, 02 Dec 2004 22:41:46 +0000,
Richard Mortimer <email address hidden> wrote:
>
>
> On Thu, 2004-12-02 at 19:27, Ron Murray wrote:
> > At Thu, 02 Dec 2004 13:45:59 -0500,
> > Ron Murray wrote:
> > We have a minor problem. Richard's patch seems to refer to a
> > pristine xfree86-4.3.0 source.
>
> Damn! There are two similar #if defined lines. I made the patch against
> the wrong one!
>
> I also accept that I did make the patch against pristine sources -
> although in this case it means that you spotted my mistake.
>
> I still stand by my analysis. Hopefully the new patch (below) will work.
> Note I've taken the same approach as the one that my original patch
> clashed with. Basically I've removed the check for ia64 because I'm
> assuming that the non-executable issue could in future apply to all
> linux versions.
>
> Richard

   Yep, I agree that you've probably found the problem. After I wrote
my previous post, I did some poking around with gdb on the XFree86
executable. I found a sequence of bytes that looked a lot like the
ones you posted earlier, a little further on than you had (but my
current copy of XFree86 has lots of debugging code inbuilt). They even
had a call to malloc() in the middle of them. gdb claimed that the
code was in the middle of ELFLoadModule(), so I looked, and there it
was, complete with the same #ifdef you found earlier. I set up the
patch, started the build, and went home. With any luck, I'll have a
new (and hopefully functional) set of X packages when I get to work in
the morning.

   Only difference was that I didn't turn it on for all Linux, just
for ia86 and sparc. Wasn't sure whether it was a good idea or not.

   I'll let everyone know how it went. Thanks for finding it.

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <873byow6ou.wl%<email address hidden>>
Date: Thu, 02 Dec 2004 19:45:21 -0500
From: Ron Murray <email address hidden>
To: Richard Mortimer <email address hidden>
Cc: "Jurzitza, Dieter" <email address hidden>,
 <email address hidden>, <email address hidden>
Subject: Re: X11 crashing on 2.4.28

At Thu, 02 Dec 2004 22:41:46 +0000,
Richard Mortimer <email address hidden> wrote:
>
>
> On Thu, 2004-12-02 at 19:27, Ron Murray wrote:
> > At Thu, 02 Dec 2004 13:45:59 -0500,
> > Ron Murray wrote:
> > We have a minor problem. Richard's patch seems to refer to a
> > pristine xfree86-4.3.0 source.
>
> Damn! There are two similar #if defined lines. I made the patch against
> the wrong one!
>
> I also accept that I did make the patch against pristine sources -
> although in this case it means that you spotted my mistake.
>
> I still stand by my analysis. Hopefully the new patch (below) will work.
> Note I've taken the same approach as the one that my original patch
> clashed with. Basically I've removed the check for ia64 because I'm
> assuming that the non-executable issue could in future apply to all
> linux versions.
>
> Richard

   Yep, I agree that you've probably found the problem. After I wrote
my previous post, I did some poking around with gdb on the XFree86
executable. I found a sequence of bytes that looked a lot like the
ones you posted earlier, a little further on than you had (but my
current copy of XFree86 has lots of debugging code inbuilt). They even
had a call to malloc() in the middle of them. gdb claimed that the
code was in the middle of ELFLoadModule(), so I looked, and there it
was, complete with the same #ifdef you found earlier. I set up the
patch, started the build, and went home. With any luck, I'll have a
new (and hopefully functional) set of X packages when I get to work in
the morning.

   Only difference was that I didn't turn it on for all Linux, just
for ia86 and sparc. Wasn't sure whether it was a good idea or not.

   I'll let everyone know how it went. Thanks for finding it.

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
In , Branden Robinson (branden) wrote : retitle 280384 to xserver-xfree86: [elfloader] SEGV on sparc with Linux 2.6 due to non-PROT-EXEC-ed use of mmap() ...

# Automatically generated email from bts, devscripts version 2.8.5
retitle 280384 xserver-xfree86: [elfloader] SEGV on sparc with Linux 2.6 due to non-PROT-EXEC-ed use of mmap()
tags 280384 + upstream patch

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-Id: <email address hidden>
Date: Thu, 2 Dec 2004 21:48:58 -0500
From: Branden Robinson <email address hidden>
To: <email address hidden>
Subject: retitle 280384 to xserver-xfree86: [elfloader] SEGV on sparc with Linux 2.6 due to
 non-PROT-EXEC-ed use of mmap() ...

# Automatically generated email from bts, devscripts version 2.8.5
retitle 280384 xserver-xfree86: [elfloader] SEGV on sparc with Linux 2.6 due to non-PROT-EXEC-ed use of mmap()
tags 280384 + upstream patch

Revision history for this message
In , Branden Robinson (branden) wrote : tagging 280384

# Automatically generated email from bts, devscripts version 2.8.5
 # fixed in Debian X Strike Force XFree86 repository; to view, run "svn diff -r 2042:2043 svn://necrotic.deadbeast.net/xfree86"
tags 280384 + pending

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-Id: <email address hidden>
Date: Thu, 2 Dec 2004 23:25:54 -0500
From: Branden Robinson <email address hidden>
To: <email address hidden>
Subject: tagging 280384

# Automatically generated email from bts, devscripts version 2.8.5
 # fixed in Debian X Strike Force XFree86 repository; to view, run "svn diff -r 2042:2043 svn://necrotic.deadbeast.net/xfree86"
tags 280384 + pending

Revision history for this message
In , Ron Murray (rjmx) wrote : Re: X11 crashing on 2.4.28

   OK, the machine made all the X packages and I installed them with
no problems. It does look like Richard's patch works, in that,
according to the XFree86 log, the loader now correctly loads pcidata,
which goes on to scan the PCI bus as it's supposed to.

   I think it should work with later 2.4 kernels now, although I
haven't tested it. I'm willing to provide the packages I built if
somebody wants to try them, but I can't put them up for ftp (we don't
allow ftp servers here).

   Working with 2.6 kernels is another problem, at least for my
E250. Now startx grinds to a halt with the dreaded "no screens found",
and indeed the log does't have it finding my display adaptor in the
PCI scan. I suspect this is because 2.6 adds domains to the PCI
system, and for totally unexplained reasons, my display adaptor is on
domain 0001 instead of 0000, and it doesn't look like that gets
scanned. But that's for another bug report.

Thank you, Richard. I think it's fixed; we can be more certain once
somebody tests it.

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <874qj34gp4.wl%<email address hidden>>
Date: Fri, 03 Dec 2004 09:08:55 -0500
From: Ron Murray <email address hidden>
To: Richard Mortimer <email address hidden>
Cc: "Jurzitza, Dieter" <email address hidden>,
 <email address hidden>, <email address hidden>
Subject: Re: X11 crashing on 2.4.28

   OK, the machine made all the X packages and I installed them with
no problems. It does look like Richard's patch works, in that,
according to the XFree86 log, the loader now correctly loads pcidata,
which goes on to scan the PCI bus as it's supposed to.

   I think it should work with later 2.4 kernels now, although I
haven't tested it. I'm willing to provide the packages I built if
somebody wants to try them, but I can't put them up for ftp (we don't
allow ftp servers here).

   Working with 2.6 kernels is another problem, at least for my
E250. Now startx grinds to a halt with the dreaded "no screens found",
and indeed the log does't have it finding my display adaptor in the
PCI scan. I suspect this is because 2.6 adds domains to the PCI
system, and for totally unexplained reasons, my display adaptor is on
domain 0001 instead of 0000, and it doesn't look like that gets
scanned. But that's for another bug report.

Thank you, Richard. I think it's fixed; we can be more certain once
somebody tests it.

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
In , Branden Robinson (branden) wrote :

On Thu, Dec 02, 2004 at 07:45:21PM -0500, Ron Murray wrote:
> Yep, I agree that you've probably found the problem. After I wrote
> my previous post, I did some poking around with gdb on the XFree86
> executable. I found a sequence of bytes that looked a lot like the
> ones you posted earlier, a little further on than you had (but my
> current copy of XFree86 has lots of debugging code inbuilt). They even
> had a call to malloc() in the middle of them. gdb claimed that the
> code was in the middle of ELFLoadModule(), so I looked, and there it
> was, complete with the same #ifdef you found earlier. I set up the
> patch, started the build, and went home. With any luck, I'll have a
> new (and hopefully functional) set of X packages when I get to work in
> the morning.
>
> Only difference was that I didn't turn it on for all Linux, just
> for ia86 and sparc. Wasn't sure whether it was a good idea or not.
>
> I'll let everyone know how it went. Thanks for finding it.

I haven't seen followup from you on how it went, but I went ahead and
applied your patch anyway.

Thanks very much to you and the other people who contributed to this bug
report.

Sorry about the red herring I threw out regarding PCI domain issues -- I
didn't mean to lead anyone astray I was just stabbing in the dark.

Expect this to be fixed in 4.3.0.dfsg.1-9, assuming your tests succeeded.

------------------------------------------------------------------------
r2043 | branden | 2004-12-02 23:24:44 -0500 (Thu, 02 Dec 2004) | 6 lines
Changed paths:
   M /trunk/debian/CHANGESETS
   M /trunk/debian/TODO
   M /trunk/debian/changelog
   M /trunk/debian/patches/071_nonexecutable_malloced_mem.diff
   M /trunk/debian/patches/600_amd64_support.diff

Apply patch from Richard Mortimer to fix the XFree86 X server's ELF object
loader to set the PROT_EXEC flag on mmap()ed modules regardless of machine
architecture. (It was already trying to do this, but there are three
preprocessor statements involved, and we were only patching one.)
(Closes: #280384)

------------------------------------------------------------------------

--
G. Branden Robinson | I've made up my mind. Don't try to
Debian GNU/Linux | confuse me with the facts.
<email address hidden> | -- Indiana Senator Earl Landgrebe
http://people.debian.org/~branden/ |

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Wed, 8 Dec 2004 13:00:46 -0500
From: Branden Robinson <email address hidden>
To: <email address hidden>, <email address hidden>
Subject: Re: X11 crashing on 2.4.28

--h31gzZEtNLTqOjlF
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Dec 02, 2004 at 07:45:21PM -0500, Ron Murray wrote:
> Yep, I agree that you've probably found the problem. After I wrote
> my previous post, I did some poking around with gdb on the XFree86
> executable. I found a sequence of bytes that looked a lot like the
> ones you posted earlier, a little further on than you had (but my
> current copy of XFree86 has lots of debugging code inbuilt). They even
> had a call to malloc() in the middle of them. gdb claimed that the
> code was in the middle of ELFLoadModule(), so I looked, and there it
> was, complete with the same #ifdef you found earlier. I set up the
> patch, started the build, and went home. With any luck, I'll have a
> new (and hopefully functional) set of X packages when I get to work in
> the morning.
>=20
> Only difference was that I didn't turn it on for all Linux, just
> for ia86 and sparc. Wasn't sure whether it was a good idea or not.
>=20
> I'll let everyone know how it went. Thanks for finding it.

I haven't seen followup from you on how it went, but I went ahead and
applied your patch anyway.

Thanks very much to you and the other people who contributed to this bug
report.

Sorry about the red herring I threw out regarding PCI domain issues -- I
didn't mean to lead anyone astray I was just stabbing in the dark.

Expect this to be fixed in 4.3.0.dfsg.1-9, assuming your tests succeeded.

------------------------------------------------------------------------
r2043 | branden | 2004-12-02 23:24:44 -0500 (Thu, 02 Dec 2004) | 6 lines
Changed paths:
   M /trunk/debian/CHANGESETS
   M /trunk/debian/TODO
   M /trunk/debian/changelog
   M /trunk/debian/patches/071_nonexecutable_malloced_mem.diff
   M /trunk/debian/patches/600_amd64_support.diff

Apply patch from Richard Mortimer to fix the XFree86 X server's ELF object
loader to set the PROT_EXEC flag on mmap()ed modules regardless of machine
architecture. (It was already trying to do this, but there are three
preprocessor statements involved, and we were only patching one.)
(Closes: #280384)

------------------------------------------------------------------------

--=20
G. Branden Robinson | I've made up my mind. Don't try to
Debian GNU/Linux | confuse me with the facts.
<email address hidden> | -- Indiana Senator Earl Landgrebe
http://people.debian.org/~branden/ |

--h31gzZEtNLTqOjlF
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iEYEARECAAYFAkG3QU4ACgkQ6kxmHytGonwcewCfWsKEcPwPCujY88/Cm1uQueR3
vuMAoKDh6vC6VQp1HHZXWEp6FmettFyT
=zLGm
-----END PGP SIGNATURE-----

--h31gzZEtNLTqOjlF--

Revision history for this message
In , Ron Murray (rjmx) wrote :

At Wed, 8 Dec 2004 13:00:46 -0500,
Branden Robinson <email address hidden> wrote:
> > Only difference was that I didn't turn it on for all Linux, just
> > for ia86 and sparc. Wasn't sure whether it was a good idea or not.
> >
> > I'll let everyone know how it went. Thanks for finding it.
>
> I haven't seen followup from you on how it went, but I went ahead and
> applied your patch anyway.

   I replied to the list with the results I had, which were that I
_thought_ it was fixed, but X still wouldn't start for me. I haven't
seen any replies from anyone else.

   I now have X working using the framebuffer driver, so it seems that
these patches do indeed fix the problem (I couldn't even do that before).

> Sorry about the red herring I threw out regarding PCI domain issues -- I
> didn't mean to lead anyone astray I was just stabbing in the dark.

   Understood. It actually led me to realize the probable cause of the
remaining X problem I have with this machine, in that fbdev works but
the glint driver doesn't load. I've submitted a separate bug report on
that one (#284111), since it's clearly not related to the mmap
problem.

Thanks,

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <87u0qweihv.wl%<email address hidden>>
Date: Wed, 08 Dec 2004 13:45:48 -0500
From: Ron Murray <email address hidden>
To: <email address hidden>, <email address hidden>
Subject: Re: X11 crashing on 2.4.28

At Wed, 8 Dec 2004 13:00:46 -0500,
Branden Robinson <email address hidden> wrote:
> > Only difference was that I didn't turn it on for all Linux, just
> > for ia86 and sparc. Wasn't sure whether it was a good idea or not.
> >
> > I'll let everyone know how it went. Thanks for finding it.
>
> I haven't seen followup from you on how it went, but I went ahead and
> applied your patch anyway.

   I replied to the list with the results I had, which were that I
_thought_ it was fixed, but X still wouldn't start for me. I haven't
seen any replies from anyone else.

   I now have X working using the framebuffer driver, so it seems that
these patches do indeed fix the problem (I couldn't even do that before).

> Sorry about the red herring I threw out regarding PCI domain issues -- I
> didn't mean to lead anyone astray I was just stabbing in the dark.

   Understood. It actually led me to realize the probable cause of the
remaining X problem I have with this machine, in that fbdev works but
the glint driver doesn't load. I've submitted a separate bug report on
that one (#284111), since it's clearly not related to the mmap
problem.

Thanks,

 .....Ron

--
Ron Murray (<email address hidden>)
http://www.rjmx.net/~ron
GPG Public Key Fingerprint: F2C1 FC47 5EF7 0317 133C D66B 8ADA A3C4 D86C 74DE

Revision history for this message
In , Jurzitza, Dieter (djurzitza) wrote :

Dear listmembers,
sorry for the delay. I'd really like to spend more time with the sparc issues if I could ;-).
Replacing the XFree86 binary that comes with the regular distribution with the freshly build one that has been supplied by you solves the problem with X on my U60 / SMP / Creator 3d.

So, it seems to me that my problem has been fixed by Richard (many thanks again) and I am looking forward for an official build to appear on the net prior to really using 2.4.28, because I do not want to get "off sync" with the regular distribution.

Thanks again to everybody for helping out,
take care

Dieter Jurzitza

-----Original Message-----
From: Ron Murray [mailto:<email address hidden>]
Sent: Wednesday, December 08, 2004 7:46 PM
To: <email address hidden>; <email address hidden>
Subject: Re: X11 crashing on 2.4.28

At Wed, 8 Dec 2004 13:00:46 -0500,
Branden Robinson <email address hidden> wrote:
****

*******************************************
Diese E-Mail enthaelt vertrauliche und/oder rechtlich geschuetzte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte sofort den Absender und loeschen Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet.

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and delete this e-mail. Any unauthorized copying, disclosure or distribution of the contents in this e-mail is strictly forbidden.
*******************************************

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Thu, 9 Dec 2004 07:03:41 +0100
From: "Jurzitza, Dieter" <email address hidden>
To: <email address hidden>, <email address hidden>
Subject: RE: X11 crashing on 2.4.28

Dear listmembers,
sorry for the delay. I'd really like to spend more time with the sparc issu=
es if I could ;-).=20
Replacing the XFree86 binary that comes with the regular distribution with =
the freshly build one that has been supplied by you solves the problem with=
 X on my U60 / SMP / Creator 3d.

So, it seems to me that my problem has been fixed by Richard (many thanks a=
gain) and I am looking forward for an official build to appear on the net p=
rior to really using 2.4.28, because I do not want to get "off sync" with t=
he regular distribution.

Thanks again to everybody for helping out,
take care

Dieter Jurzitza

-----Original Message-----
From: Ron Murray [mailto:<email address hidden>]
Sent: Wednesday, December 08, 2004 7:46 PM
To: <email address hidden>; <email address hidden>
Subject: Re: X11 crashing on 2.4.28

At Wed, 8 Dec 2004 13:00:46 -0500,
Branden Robinson <email address hidden> wrote:
****

*******************************************
Diese E-Mail enthaelt vertrauliche und/oder rechtlich geschuetzte Informati=
onen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtuemli=
ch erhalten haben, informieren Sie bitte sofort den Absender und loeschen S=
ie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe diese=
r Mail ist nicht gestattet.
=20
This e-mail may contain confidential and/or privileged information. If you =
are not the intended recipient (or have received this e-mail in error) plea=
se notify the sender immediately and delete this e-mail. Any unauthorized c=
opying, disclosure or distribution of the contents in this e-mail is strict=
ly forbidden.
*******************************************

Revision history for this message
In , Foo-bar-baz-boo-deb (foo-bar-baz-boo-deb) wrote :

I have been neglectful in mentioning that this fix for 280384 fixes my
original problem also. Thanks to everybody for fixing it and for
sending me the files so I could post them to my web server.

--- "Jurzitza, Dieter" <email address hidden> wrote:

> Dear listmembers,
> sorry for the delay. I'd really like to spend more time with the
> sparc issues if I could ;-).
> Replacing the XFree86 binary that comes with the regular distribution
> with the freshly build one that has been supplied by you solves the
> problem with X on my U60 / SMP / Creator 3d.
>
> So, it seems to me that my problem has been fixed by Richard (many
> thanks again) and I am looking forward for an official build to
> appear on the net prior to really using 2.4.28, because I do not want
> to get "off sync" with the regular distribution.

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Thu, 9 Dec 2004 02:56:37 -0800 (PST)
From: <email address hidden>
To: <email address hidden>, <email address hidden>
Subject: RE: X11 crashing on 2.4.28

I have been neglectful in mentioning that this fix for 280384 fixes my
original problem also. Thanks to everybody for fixing it and for
sending me the files so I could post them to my web server.

--- "Jurzitza, Dieter" <email address hidden> wrote:

> Dear listmembers,
> sorry for the delay. I'd really like to spend more time with the
> sparc issues if I could ;-).
> Replacing the XFree86 binary that comes with the regular distribution
> with the freshly build one that has been supplied by you solves the
> problem with X on my U60 / SMP / Creator 3d.
>
> So, it seems to me that my problem has been fixed by Richard (many
> thanks again) and I am looking forward for an official build to
> appear on the net prior to really using 2.4.28, because I do not want
> to get "off sync" with the regular distribution.

Revision history for this message
In , Fabio Massimo Di Nitto (fabbione) wrote : Bug#280384: fixed in xfree86 4.3.0.dfsg.1-9
Download full text (44.7 KiB)

Source: xfree86
Source-Version: 4.3.0.dfsg.1-9

We believe that the bug you reported is fixed in the latest version of
xfree86, which is due to be installed in the Debian FTP archive:

lbxproxy_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/lbxproxy_4.3.0.dfsg.1-9_i386.deb
libdps-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libdps-dev_4.3.0.dfsg.1-9_i386.deb
libdps1-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libdps1-dbg_4.3.0.dfsg.1-9_i386.deb
libdps1_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libdps1_4.3.0.dfsg.1-9_i386.deb
libice-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libice-dev_4.3.0.dfsg.1-9_i386.deb
libice6-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libice6-dbg_4.3.0.dfsg.1-9_i386.deb
libice6_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libice6_4.3.0.dfsg.1-9_i386.deb
libsm-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libsm-dev_4.3.0.dfsg.1-9_i386.deb
libsm6-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libsm6-dbg_4.3.0.dfsg.1-9_i386.deb
libsm6_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libsm6_4.3.0.dfsg.1-9_i386.deb
libx11-6-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libx11-6-dbg_4.3.0.dfsg.1-9_i386.deb
libx11-6_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libx11-6_4.3.0.dfsg.1-9_i386.deb
libx11-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libx11-dev_4.3.0.dfsg.1-9_i386.deb
libxaw6-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxaw6-dbg_4.3.0.dfsg.1-9_i386.deb
libxaw6-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxaw6-dev_4.3.0.dfsg.1-9_i386.deb
libxaw6_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxaw6_4.3.0.dfsg.1-9_i386.deb
libxaw7-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxaw7-dbg_4.3.0.dfsg.1-9_i386.deb
libxaw7-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxaw7-dev_4.3.0.dfsg.1-9_i386.deb
libxaw7_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxaw7_4.3.0.dfsg.1-9_i386.deb
libxext-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxext-dev_4.3.0.dfsg.1-9_i386.deb
libxext6-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxext6-dbg_4.3.0.dfsg.1-9_i386.deb
libxext6_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxext6_4.3.0.dfsg.1-9_i386.deb
libxft1-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxft1-dbg_4.3.0.dfsg.1-9_i386.deb
libxft1_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxft1_4.3.0.dfsg.1-9_i386.deb
libxi-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxi-dev_4.3.0.dfsg.1-9_i386.deb
libxi6-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxi6-dbg_4.3.0.dfsg.1-9_i386.deb
libxi6_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxi6_4.3.0.dfsg.1-9_i386.deb
libxmu-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxmu-dev_4.3.0.dfsg.1-9_i386.deb
libxmu6-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxmu6-dbg_4.3.0.dfsg.1-9_i386.deb
libxmu6_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxmu6_4.3.0.dfsg.1-9_i386.deb
libxmuu-dev_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxmuu-dev_4.3.0.dfsg.1-9_i386.deb
libxmuu1-dbg_4.3.0.dfsg.1-9_i386.deb
  to pool/main/x/xfree86/libxmuu1-dbg_4.3.0.dfsg.1-9_i386.deb
libxmuu1_4....

Revision history for this message
In , Branden Robinson (branden) wrote : Re: Bug#282401: xserver-xfree86: segfault at startup (when loading module pcidata?)

severity 282401 important
retitle 282401 xserver-xfree86: SEGV at startup on Sun Blade 100 when trying to load pcidata module (-dbg package works)
close 282401
merge 280384 282401
thanks

On Sun, Nov 21, 2004 at 09:40:16PM +0100, Admar Schoonen wrote:
> Package: xserver-xfree86
> Version: 4.3.0.dfsg.1-8
> Severity: normal
>
> System is a Sun Blade 100 (ultra sparc IIe) with 2 mach64 pci cards (1 on board,
> 1 in pci slot). Linux kernels 2.6.x with x<7 and current X server work fine on
> this machine (apart from the fact dat those kernels have a bug that prevents the
> second head to work). Kernels 2.6.8 and up don't have this bug, and therefor,
> both heads work. However, with those kernels, xserver-xfree86 won't work; the
> xserver crashes even before initializing the card(s). The logfile is up at
> http://people.spacelabs.nl/~admar/troep/XFree86.0.log
>
> The strange this is though, that X does work perfectly fine if I use
> xserver-xfree86-dbg (even dual head works).
>
> I hope this is enough information to fix the problem (or that it is at least
> enoough information for other people with a non working X to have a workaround).
> If you need more information, please let me know.

I believe this bug is a duplicate of #280384, which was fixed yesterday
with the release of 4.3.0.dfsg.1-9:

xfree86 (4.3.0.dfsg.1-9) unstable; urgency=high
[...]
  * Apply patch from Richard Mortimer to fix the XFree86 X server's ELF object
    loader to set the PROT_EXEC flag on mmap()ed modules regardless of machine
    architecture. (It was already trying to do this, but there are three
    preprocessor statements involved, and we were only patching one.)
    (Closes: #280384)
[...]
 -- Fabio M. Di Nitto <email address hidden> Thu, 9 Dec 2004 17:14:45 +0100

--
G. Branden Robinson | Imagination was given man to
Debian GNU/Linux | compensate for what he is not, and
<email address hidden> | a sense of humor to console him for
http://people.debian.org/~branden/ | what he is.

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Fri, 10 Dec 2004 14:30:01 -0500
From: Branden Robinson <email address hidden>
To: <email address hidden>, <email address hidden>
Subject: Re: Bug#282401: xserver-xfree86: segfault at startup (when loading module pcidata?)

--DTbNwtYx2n+Gggn7
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

severity 282401 important
retitle 282401 xserver-xfree86: SEGV at startup on Sun Blade 100 when tryin=
g to load pcidata module (-dbg package works)
close 282401
merge 280384 282401
thanks

On Sun, Nov 21, 2004 at 09:40:16PM +0100, Admar Schoonen wrote:
> Package: xserver-xfree86
> Version: 4.3.0.dfsg.1-8
> Severity: normal
>=20
> System is a Sun Blade 100 (ultra sparc IIe) with 2 mach64 pci cards (1 on=
 board,
> 1 in pci slot). Linux kernels 2.6.x with x<7 and current X server work fi=
ne on
> this machine (apart from the fact dat those kernels have a bug that preve=
nts the
> second head to work). Kernels 2.6.8 and up don't have this bug, and there=
for,
> both heads work. However, with those kernels, xserver-xfree86 won't work;=
 the
> xserver crashes even before initializing the card(s). The logfile is up at
> http://people.spacelabs.nl/~admar/troep/XFree86.0.log
>=20
> The strange this is though, that X does work perfectly fine if I use
> xserver-xfree86-dbg (even dual head works).
>=20
> I hope this is enough information to fix the problem (or that it is at le=
ast
> enoough information for other people with a non working X to have a worka=
round).
> If you need more information, please let me know.

I believe this bug is a duplicate of #280384, which was fixed yesterday
with the release of 4.3.0.dfsg.1-9:

xfree86 (4.3.0.dfsg.1-9) unstable; urgency=3Dhigh
[...]
  * Apply patch from Richard Mortimer to fix the XFree86 X server's ELF obj=
ect
    loader to set the PROT_EXEC flag on mmap()ed modules regardless of mach=
ine
    architecture. (It was already trying to do this, but there are three
    preprocessor statements involved, and we were only patching one.)
    (Closes: #280384)
[...]
 -- Fabio M. Di Nitto <email address hidden> Thu, 9 Dec 2004 17:14:45 +0=
100

--=20
G. Branden Robinson | Imagination was given man to
Debian GNU/Linux | compensate for what he is not, and
<email address hidden> | a sense of humor to console him for
http://people.debian.org/~branden/ | what he is.

--DTbNwtYx2n+Gggn7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iEYEARECAAYFAkG5+TkACgkQ6kxmHytGonzH+ACgkUMNTePQ+Wc55ZXSrQYayyMV
ck8AoJdJJmw6aeDG9FWWGbEgeEKXNCOQ
=TEfv
-----END PGP SIGNATURE-----

--DTbNwtYx2n+Gggn7--

Revision history for this message
In , Foo-bar-baz-boo-deb (foo-bar-baz-boo-deb) wrote : Bug 280384 (XFree86 Memory NX Bug) Fixed In Unstable

It appears that the X Strike Force build including the latest SPARC ELF
loader fix from Mr. Mortimer has been inducted into the archive as of
today, 2004-12-13.

I advise everyone to discontinue use of the unofficial 'rjmx' X
packages from my web server and move back to the real versions in
unstable, once you are sure they work. Unless I receive objections from
the community, I will be removing these files in approximately two
weeks' time due to their apparent redundancy.

Until then feel free to continue to download them from
http://www.mhcomputing.net/debian/ . Thank you to the community for
supporting me and others and for giving me the chance to support you as
well by providing these fixed X packages.

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Tue, 14 Dec 2004 00:34:49 -0800 (PST)
From: <email address hidden>
To: <email address hidden>, <email address hidden>
Subject: Bug 280384 (XFree86 Memory NX Bug) Fixed In Unstable

It appears that the X Strike Force build including the latest SPARC ELF
loader fix from Mr. Mortimer has been inducted into the archive as of
today, 2004-12-13.

I advise everyone to discontinue use of the unofficial 'rjmx' X
packages from my web server and move back to the real versions in
unstable, once you are sure they work. Unless I receive objections from
the community, I will be removing these files in approximately two
weeks' time due to their apparent redundancy.

Until then feel free to continue to download them from
http://www.mhcomputing.net/debian/ . Thank you to the community for
supporting me and others and for giving me the chance to support you as
well by providing these fixed X packages.

Changed in xfree86:
status: Unknown → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.