Xorg crashed with SIGSEGV in _XkbSetMapChecks() from ProcXkbSetMap(), when trying to insert letter with accent using Onboard

[Leonardo Soares Müller]

Using Onboard, when trying to type a letter with accent, as á or à, Xorg crashes. This computer has a touch screen: some of its software is intended to be used with the touch screen and, as the screen can be rotated independently from the keyboard, the physical keyboard is not always available.

As in Portuguese many words have accents, this crash would be extremely common.

Regarding Xorg, I had to add the following settings to enable the touch screen:

Section "InputClass"
        Identifier "HID Touchscreen"
        MatchUSBID "22b9:0005"
        Driver "evdev"
        Option "Emulate3Buttons" "false"
        Option "ButtonMapping" "1 0 0 0 0 0 0 0 0 0 0 0 0 0"
EndSection

Regarding Onboard, only the theme was changed.

The operating system is Xubuntu 18.04 amd64. lspci -v output is below:

lspci -v
00:00.0 Host bridge: Intel Corporation Atom Processor D2xxx/N2xxx DRAM Controller (rev 04)
 Subsystem: Elitegroup Computer Systems Atom Processor D2xxx/N2xxx DRAM Controller
 Flags: bus master, fast devsel, latency 0

00:02.0 VGA compatible controller: Intel Corporation Atom Processor D2xxx/N2xxx Integrated Graphics Controller (rev 0b) (prog-if 00 [VGA controller])
 Subsystem: Elitegroup Computer Systems Atom Processor D2xxx/N2xxx Integrated Graphics Controller
 Flags: bus master, fast devsel, latency 0, IRQ 26
 Memory at 80200000 (32-bit, non-prefetchable) [size=1M]
 I/O ports at 40d0 [size=8]
 [virtual] Expansion ROM at 000c0000 [disabled] [size=128K]
 Capabilities: <access denied>
 Kernel driver in use: gma500
 Kernel modules: gma500_gfx

00:1b.0 Audio device: Intel Corporation NM10/ICH7 Family High Definition Audio Controller (rev 02)
 Subsystem: Elitegroup Computer Systems NM10/ICH7 Family High Definition Audio Controller
 Flags: bus master, fast devsel, latency 0, IRQ 27
 Memory at 80300000 (64-bit, non-prefetchable) [size=16K]
 Capabilities: <access denied>
 Kernel driver in use: snd_hda_intel
 Kernel modules: snd_hda_intel

00:1c.0 PCI bridge: Intel Corporation NM10/ICH7 Family PCI Express Port 1 (rev 02) (prog-if 00 [Normal decode])
 Flags: bus master, fast devsel, latency 0, IRQ 16
 Bus: primary=00, secondary=01, subordinate=01, sec-latency=0
 I/O behind bridge: 00003000-00003fff
 Memory behind bridge: 80400000-807fffff
 Prefetchable memory behind bridge: 0000000080000000-00000000800fffff
 Capabilities: <access denied>
 Kernel driver in use: pcieport

00:1c.1 PCI bridge: Intel Corporation NM10/ICH7 Family PCI Express Port 2 (rev 02) (prog-if 00 [Normal decode])
 Flags: bus master, fast devsel, latency 0, IRQ 17
 Bus: primary=00, secondary=02, subordinate=02, sec-latency=0
 I/O behind bridge: 00002000-00002fff
 Memory behind bridge: 80100000-801fffff
 Prefetchable memory behind bridge: 0000000080800000-00000000809fffff
 Capabilities: <access denied>
 Kernel driver in use: pcieport

00:1c.2 PCI bridge: Intel Corporation NM10/ICH7 Family PCI Express Port 3 (rev 02) (prog-if 00 [Normal decode])
 Flags: fast devsel, IRQ 18
 Bus: primary=00, secondary=03, subordinate=03, sec-latency=0
 I/O behind bridge: 00005000-00005fff
 Memory behind bridge: 80a00000-80bfffff
 Prefetchable memory behind bridge: 0000000080c00000-0000000080dfffff
 Capabilities: <access denied>
 Kernel driver in use: pcieport

00:1c.3 PCI bridge: Intel Corporation NM10/ICH7 Family PCI Express Port 4 (rev 02) (prog-if 00 [Normal decode])
 Flags: fast devsel, IRQ 19
 Bus: primary=00, secondary=04, subordinate=04, sec-latency=0
 I/O behind bridge: 00006000-00006fff
 Memory behind bridge: 80e00000-80ffffff
 Prefetchable memory behind bridge: 0000000081000000-00000000811fffff
 Capabilities: <access denied>
 Kernel driver in use: pcieport

00:1d.0 USB controller: Intel Corporation NM10/ICH7 Family USB UHCI Controller #1 (rev 02) (prog-if 00 [UHCI])
 Subsystem: Elitegroup Computer Systems NM10/ICH7 Family USB UHCI Controller
 Flags: bus master, medium devsel, latency 0, IRQ 23
 I/O ports at 40a0 [size=32]
 Kernel driver in use: uhci_hcd

00:1d.1 USB controller: Intel Corporation NM10/ICH7 Family USB UHCI Controller #2 (rev 02) (prog-if 00 [UHCI])
 Subsystem: Elitegroup Computer Systems NM10/ICH7 Family USB UHCI Controller
 Flags: bus master, medium devsel, latency 0, IRQ 19
 I/O ports at 4080 [size=32]
 Kernel driver in use: uhci_hcd

00:1d.2 USB controller: Intel Corporation NM10/ICH7 Family USB UHCI Controller #3 (rev 02) (prog-if 00 [UHCI])
 Subsystem: Elitegroup Computer Systems NM10/ICH7 Family USB UHCI Controller
 Flags: bus master, medium devsel, latency 0, IRQ 18
 I/O ports at 4060 [size=32]
 Kernel driver in use: uhci_hcd

00:1d.3 USB controller: Intel Corporation NM10/ICH7 Family USB UHCI Controller #4 (rev 02) (prog-if 00 [UHCI])
 Subsystem: Elitegroup Computer Systems NM10/ICH7 Family USB UHCI Controller
 Flags: bus master, medium devsel, latency 0, IRQ 16
 I/O ports at 4040 [size=32]
 Kernel driver in use: uhci_hcd

00:1d.7 USB controller: Intel Corporation NM10/ICH7 Family USB2 EHCI Controller (rev 02) (prog-if 20 [EHCI])
 Subsystem: Elitegroup Computer Systems NM10/ICH7 Family USB2 EHCI Controller
 Flags: bus master, medium devsel, latency 0, IRQ 23
 Memory at 80304400 (32-bit, non-prefetchable) [size=1K]
 Capabilities: <access denied>
 Kernel driver in use: ehci-pci

00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev e2) (prog-if 01 [Subtractive decode])
 Flags: bus master, fast devsel, latency 0
 Bus: primary=00, secondary=05, subordinate=05, sec-latency=32
 Capabilities: <access denied>

00:1f.0 ISA bridge: Intel Corporation NM10 Family LPC Controller (rev 02)
 Subsystem: Elitegroup Computer Systems NM10 Family LPC Controller
 Flags: bus master, medium devsel, latency 0
 Capabilities: <access denied>
 Kernel driver in use: lpc_ich
 Kernel modules: lpc_ich

00:1f.2 SATA controller: Intel Corporation NM10/ICH7 Family SATA Controller [AHCI mode] (rev 02) (prog-if 01 [AHCI 1.0])
 Subsystem: Elitegroup Computer Systems NM10/ICH7 Family SATA Controller [AHCI mode]
 Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 25
 I/O ports at 40c8 [size=8]
 I/O ports at 40dc [size=4]
 I/O ports at 40c0 [size=8]
 I/O ports at 40d8 [size=4]
 I/O ports at 4020 [size=16]
 Memory at 80304000 (32-bit, non-prefetchable) [size=1K]
 Capabilities: <access denied>
 Kernel driver in use: ahci
 Kernel modules: ahci

00:1f.3 SMBus: Intel Corporation NM10/ICH7 Family SMBus Controller (rev 02)
 Subsystem: Elitegroup Computer Systems NM10/ICH7 Family SMBus Controller
 Flags: medium devsel, IRQ 10
 I/O ports at efa0 [size=32]
 Kernel modules: i2c_i801

01:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL810xE PCI Express Fast Ethernet controller (rev 05)
 Subsystem: Elitegroup Computer Systems RTL810xE PCI Express Fast Ethernet controller
 Flags: bus master, fast devsel, latency 0, IRQ 16
 I/O ports at 3000 [size=256]
 Memory at 80004000 (64-bit, prefetchable) [size=4K]
 Memory at 80000000 (64-bit, prefetchable) [size=16K]
 Capabilities: <access denied>
 Kernel driver in use: r8169
 Kernel modules: r8169

02:00.0 Network controller: Realtek Semiconductor Co., Ltd. RTL8188EE Wireless Network Adapter (rev 01)
 Subsystem: AzureWave RTL8188EE Wireless Network Adapter
 Flags: bus master, fast devsel, latency 0, IRQ 28
 I/O ports at 2000 [size=256]
 Memory at 80100000 (64-bit, non-prefetchable) [size=16K]
 Capabilities: <access denied>
 Kernel driver in use: rtl8188ee
 Kernel modules: rtl8188ee

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: xorg 1:7.7+19ubuntu7.1
ProcVersionSignature: Ubuntu 5.0.0-25.26~18.04.1-generic 5.0.18
Uname: Linux 5.0.0-25-generic x86_64
NonfreeKernelModules: zfs zunicode zavl icp zcommon znvpair
ApportVersion: 2.20.9-0ubuntu7.7
Architecture: amd64
BootLog: Error: [Errno 13] Permissão negada: '/var/log/boot.log'
CompositorRunning: None
CurrentDesktop: XFCE
Date: Fri Aug 23 10:59:00 2019
DistUpgraded: Fresh install
DistroCodename: bionic
DistroVariant: ubuntu
ExtraDebuggingInterest: Yes
GraphicsCard:
 Intel Corporation Atom Processor D2xxx/N2xxx Integrated Graphics Controller [8086:0be1] (rev 0b) (prog-if 00 [VGA controller])
   Subsystem: Elitegroup Computer Systems Atom Processor D2xxx/N2xxx Integrated Graphics Controller [1019:9988]
InstallationDate: Installed on 2019-08-09 (14 days ago)
InstallationMedia: Xubuntu 18.04.3 LTS "Bionic Beaver" - Release amd64 (20190805)
MachineType: Positivo Informatica SA EC10IS2
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-5.0.0-25-generic root=UUID=661a421c-70ea-4138-bd0f-466de66f8d14 ro
SourcePackage: xorg
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 04/09/2013
dmi.bios.vendor: Phoenix Technologies Ltd.
dmi.bios.version: TPCDV10L.86A.0045.2013.0409.1356
dmi.board.asset.tag: Base Board Asset Tag
dmi.board.name: Intel powered classmate PC
dmi.board.vendor: Intel Corporation
dmi.board.version: POSITIVO
dmi.chassis.asset.tag: Asset Tag
dmi.chassis.type: 9
dmi.chassis.vendor: Positivo Informatica SA
dmi.chassis.version: POSITIVO
dmi.modalias: dmi:bvnPhoenixTechnologiesLtd.:bvrTPCDV10L.86A.0045.2013.0409.1356:bd04/09/2013:svnPositivoInformaticaSA:pnEC10IS2:pvr1.02_POS:rvnIntelCorporation:rnIntelpoweredclassmatePC:rvrPOSITIVO:cvnPositivoInformaticaSA:ct9:cvrPOSITIVO:
dmi.product.family: CedarTrail System
dmi.product.name: EC10IS2
dmi.product.sku: System SKUNumber
dmi.product.version: 1.02_POS
dmi.sys.vendor: Positivo Informatica SA
version.compiz: compiz N/A
version.libdrm2: libdrm2 2.4.97-1ubuntu1~18.04.1
version.libgl1-mesa-dri: libgl1-mesa-dri 19.0.8-0ubuntu0~18.04.1
version.libgl1-mesa-glx: libgl1-mesa-glx 19.0.8-0ubuntu0~18.04.1
version.xserver-xorg-core: xserver-xorg-core N/A
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev N/A
version.xserver-xorg-video-ati: xserver-xorg-video-ati N/A
version.xserver-xorg-video-intel: xserver-xorg-video-intel N/A
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau N/A

[Daniel van Vugt (vanvugt)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. It sounds like some part of the system has crashed. To help us find the cause of the crash please follow these steps:

1. Look in /var/crash for crash files and if found run:
    ubuntu-bug YOURFILE.crash
Then tell us the ID of the newly-created bug.

2. If step 1 failed then look at https://errors.ubuntu.com/user/ID where ID is the content of file /var/lib/whoopsie/whoopsie-id on the machine. Do you find any links to recent problems on that page? If so then please send the links to us.

3. If step 2 also failed then apply the workaround from bug 994921, reboot, reproduce the crash, and retry step 1.

Please take care to avoid attaching .crash files to bugs as we are unable to process them as file attachments. It would also be a security risk for yourself.

[Leonardo Soares Müller (leosmuller)]

I had to use the step 3 to be able to report the bug. The .crash file was uploaded to bug 1841428.

I noticed there is a backtrace in /var/log/Xorg.0.log.old which seems it was not uploaded. I'm not sure it is relevant, but here is the backtrace:

[ 161.631] (EE)
[ 161.632] (EE) Backtrace:
[ 161.690] (EE) 0: /usr/lib/xorg/Xorg (OsLookupColor+0x139) [0x55e3d383e829]
[ 161.692] (EE) 1: /lib/x86_64-linux-gnu/libpthread.so.0 (funlockfile+0x50) [0x7f45de62a8df]
[ 161.693] (EE) 2: /usr/lib/xorg/Xorg (XkbCompileKeymapFromString+0x229d) [0x55e3d37dd00d]
[ 161.694] (EE) 3: /usr/lib/xorg/Xorg (XkbCompileKeymapFromString+0x982f) [0x55e3d37eba1f]
[ 161.695] (EE) 4: /usr/lib/xorg/Xorg (SendErrorToClient+0x368) [0x55e3d36e1548]
[ 161.695] (EE) 5: /usr/lib/xorg/Xorg (InitFonts+0x3c8) [0x55e3d36e5528]
[ 161.698] (EE) 6: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xe7) [0x7f45de248b97]
[ 161.698] (EE) 7: /usr/lib/xorg/Xorg (_start+0x2a) [0x55e3d36cf18a]
[ 161.699] (EE)
[ 161.699] (EE) Segmentation fault at address 0x68
[ 161.699] (EE)
Fatal server error:
[ 161.699] (EE) Caught signal 11 (Segmentation fault). Server aborting

[Daniel van Vugt (vanvugt)]

It appears bug 1841428 is not usable. Please follow the steps in comment #2 again.

[Leonardo Soares Müller (leosmuller)]

I sent a new report: it's bug 1841507, hopefully the data is good now.

[Daniel van Vugt (vanvugt)]

That didn't work either, sorry.

It looks like the stack trace in comment #3 (and in XorgLogOld.txt) is all we get:

[ 2883.559] (EE) Backtrace:
[ 2883.560] (EE) 0: /usr/lib/xorg/Xorg (OsLookupColor+0x139) [0x5606becf7829]
[ 2883.563] (EE) 1: /lib/x86_64-linux-gnu/libpthread.so.0 (funlockfile+0x50) [0x7fbfdfde98df]
[ 2883.564] (EE) 2: /usr/lib/xorg/Xorg (XkbCompileKeymapFromString+0x229d) [0x5606bec9600d]
[ 2883.565] (EE) 3: /usr/lib/xorg/Xorg (XkbCompileKeymapFromString+0x982f) [0x5606beca4a1f]
[ 2883.565] (EE) 4: /usr/lib/xorg/Xorg (SendErrorToClient+0x368) [0x5606beb9a548]
[ 2883.566] (EE) 5: /usr/lib/xorg/Xorg (InitFonts+0x3c8) [0x5606beb9e528]
[ 2883.568] (EE) 6: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xe7) [0x7fbfdfa07b97]
[ 2883.569] (EE) 7: /usr/lib/xorg/Xorg (_start+0x2a) [0x5606beb8818a]
[ 2883.569] (EE)
[ 2883.570] (EE) Segmentation fault at address 0x68
[

[Daniel van Vugt (vanvugt)]

And the only slightly related bug I can find is from 6.5 years ago: bug 1134185

[Leonardo Soares Müller (leosmuller)]

It seems I got a valid backtrace. I installed xserver-xorg-core-hwe-18.04-dbgsym and it was possible to get a backtrace with more data. Here is it:

(gdb) bt f
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
        set = {__val = {171516928, 0, 0, 0, 0, 94568085079104, 94568054863600, 67108868, 140083657316496, 0, 94568084835824, 94568085157664, 94568085157664, 94568085534016, 0, 0}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1 0x00007f67c465e801 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x5602591f7720, sa_sigaction = 0x5602591f7720}, sa_mask = {__val = {94568085534016, 0 <repeats 11 times>, 67108868, 140083657316496, 5467293301926151424, 0}}, sa_flags = 1465188592, sa_restorer = 0x7ffc2f5ddeb0}
        sigs = {__val = {32, 0 <repeats 15 times>}}
        __cnt = <optimized out>
        __set = <optimized out>
        __cnt = <optimized out>
        __set = <optimized out>
#2 0x00005602575166da in OsAbort () at ../../../../os/utils.c:1351
No locals.
#3 0x000056025751c273 in AbortServer () at ../../../../os/log.c:879
No locals.
#4 0x000056025751d095 in FatalError (f=f@entry=0x5602575500f0 "Caught signal %d (%s). Server aborting\n") at ../../../../os/log.c:1017
        args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffc2f5ddfa0, reg_save_area = 0x7ffc2f5dded0}}
        args2 = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7ffc2f5ddfa0, reg_save_area = 0x7ffc2f5dded0}}
        beenhere = 1
#5 0x0000560257513773 in OsSigHandler (signo=11, sip=<optimized out>, unused=<optimized out>) at ../../../../os/osinit.c:156
        unused = <optimized out>
        sip = <optimized out>
        signo = 11
#6 <signal handler called>
No locals.
#7 _XkbSetMapChecks (client=client@entry=0x560259cd7c40, req=req@entry=0x56025a1b4dd0, values=values@entry=0x56025a1b4df4 "", dev=<optimized out>) at ../../../../xkb/xkb.c:2387
        xkbi = <error reading variable xkbi (Não é possível acessar a memória no endereço 0x68)>
        xkb = <optimized out>
        error = <optimized out>
        nTypes = 0
        nActions = <optimized out>
        mapWidths = '\000' <repete 255 vezes>
        symsPerKey = {0 <repeats 256 times>}
        map = <optimized out>
        i = <optimized out>
#8 0x00005602574b734f in ProcXkbSetMap (client=0x560259cd7c40) at ../../../../xkb/xkb.c:2655
        other = 0x560258ea7d40
        dev = 0x560258ea84d0
        tmp = 0x56025a1b4df4 ""
        rc = 0
        stuff = <optimized out>
        master = 0x560258ea84d0
#9 0x00005602573b64e8 in Dispatch () at ../../../../dix/dispatch.c:478
        result = <optimized out>
        client = <optimized out>
        start_tick = 1390
#10 0x00005602573ba4e8 in dix_main (argc=11, argv=0x7ffc2f5de988, envp=<optimized out>) at ../../../../dix/main.c:276
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#11 0x00007f67c463fb97 in __libc_start_main (main=0x5602573a4150 <main>, argc=11, argv=0x7ffc2f5de988, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffc2f5de978) at ../csu/libc-start.c:31...

[Daniel van Vugt (vanvugt)]

Great! I was going to ask you to try that today :)

[Daniel van Vugt (vanvugt)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. This particular bug has already been reported and is a duplicate of bug 1809737, so it is being marked as such. Please look at the other bug report to see if there is any missing information that you can provide, or to see if there is a workaround for the bug. Additionally, any further discussion regarding the bug should occur in the other report. Feel free to continue to report any other bugs you may find.