Ubuntu
xorg-server package

[RV250] Xorg assert failure: /usr/bin/X: realloc(): invalid pointer: 0x096a6dd0 after calling xf86Wakeup ()

Bug #542814 reported by Mindy Garside on 2010-03-20

This bug affects 5 people

Affects		Status	Importance	Assigned to	Milestone
	X.Org X server	Invalid	High	freedesktop-bugs #27503
	xorg-server (Ubuntu)	Fix Released	High	Unassigned

Bug Description

Computed crashed after trying to log switch to another user through GDM

Thread 1 (process 7802):
#0 0x00cc6422 in __kernel_vsyscall ()
No symbol table info available.
#1 0x003b1601 in *__GI_raise (sig=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
resultvar = <value optimized out>
pid = 5074932
selftid = 7802
#2 0x003b4a62 in *__GI_abort () at abort.c:92
act = {__sigaction_handler = {
    sa_handler = 0xb8f4e4 <_rtld_local+1220>,
    sa_sigaction = 0xb8f4e4 <_rtld_local+1220>}, sa_mask = {__val = {917504,
      136066896, 134582228, 3213672264, 39520, 3213672232, 134544804,
      134532708, 1031, 12122360, 4508129, 1031, 136066896, 3213672160,
      5074932, 15, 3213673620, 3213672280, 4627156, 2, 3213672160, 4, 0,
      3213672256, 3213672268, 2, 4933319, 4933315, 4928865, 4928891, 230,
      3213672160}}, sa_flags = -1081295064, sa_restorer = 0x4b5a63}
sigs = {__val = {32, 0 <repeats 31 times>}}
#3 0x003e856d in __libc_message (do_abort=2,
    fmt=0x4b78b8 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
ap = <value optimized out>
fd = -1081294704
on_2 = <value optimized out>
list = <value optimized out>
nlist = <value optimized out>
cp = <value optimized out>
written = false
#4 0x003f2611 in malloc_printerr (action=<value optimized out>,
    str=0x6 <Address 0x6 out of bounds>, ptr=0x96a6dd0) at malloc.c:6264
buf = "096a6dd0"
cp = <value optimized out>
#5 0x003f81e8 in *__GI___libc_realloc (oldmem=0x0, bytes=512)
    at malloc.c:3778
ar_ptr = <value optimized out>
nb = 157999728
newp = <value optimized out>
oldp = (const mchunkptr) 0x96a6dc8
oldsize = 0
__func__ = "__libc_realloc"
#6 0x080aa523 in Xrealloc ()

ProblemType: Crash
Architecture: i386
AssertionMessage: *** glibc detected *** /usr/bin/X: realloc(): invalid pointer: 0x096a6dd0 ***
CurrentDmesg:
[ 24.780015] eth1: no IPv6 routers present
[ 35.908042] end_request: I/O error, dev fd0, sector 0
[ 35.992049] end_request: I/O error, dev fd0, sector 0
Date: Sat Mar 20 17:34:46 2010
DistroRelease: Ubuntu 10.04
DkmsStatus: Error: [Errno 2] Bestand of map bestaat niet
ExecutablePath: /usr/bin/Xorg
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Beta i386 (20100318)
MachineType: HP Pavilion 06 DF168A-ABH T170.
Package: xserver-xorg-core 2:1.7.5-1ubuntu3
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.32-16-generic root=UUID=1ed36f90-6dd8-4916-8da8-acd31abccb32 ro quiet splash
ProcCmdline: /usr/bin/X :1 -br -verbose -auth /var/run/gdm/auth-for-gdm-GncyXg/database -nolisten tcp
ProcEnviron:
LANG=nl_NL.UTF-8
PATH=(custom, no user)
ProcVersionSignature: Ubuntu 2.6.32-16.25-generic
Signal: 6
SourcePackage: xorg-server
StacktraceTop:
__kernel_vsyscall ()
raise () from /lib/tls/i686/cmov/libc.so.6
abort () from /lib/tls/i686/cmov/libc.so.6
?? () from /lib/tls/i686/cmov/libc.so.6
?? () from /lib/tls/i686/cmov/libc.so.6
Title: Xorg assert failure: *** glibc detected *** /usr/bin/X: realloc(): invalid pointer: 0x096a6dd0 ***
Uname: Linux 2.6.32-16-generic i686
UserGroups:

dmi.bios.date: 07/16/2003
dmi.bios.vendor: Phoenix Technologies, LTD
dmi.bios.version: 3.23
dmi.board.name: MS-6577
dmi.board.vendor: MICRO-STAR INTERNATIONAL CO., LTD
dmi.board.version: 030
dmi.chassis.type: 3
dmi.modalias: dmi:bvnPhoenixTechnologies,LTD:bvr3.23:bd07/16/2003:svnHPPavilion06:pnDF168A-ABHT170.:pvr03Y0211RE101XENO4:rvnMICRO-STARINTERNATIONALCO.,LTD:rnMS-6577:rvr030:cvn:ct3:cvr:
dmi.product.name: DF168A-ABH T170.
dmi.product.version: 03Y0211RE101XENO4
dmi.sys.vendor: HP Pavilion 06
glxinfo: Error: [Errno 2] Bestand of map bestaat niet
system:
distro: Ubuntu
codename: lucid
architecture: i686
kernel: 2.6.32-16-generic

See original description

Tags:

Revision history for this message

Mindy Garside (mindygarside) wrote on 2010-03-20:

BootDmesg.txt Edit (37.4 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (3.7 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (433 bytes, text/plain; charset="utf-8")
GdmLog.txt Edit (35.9 KiB, text/plain; charset="utf-8")
GdmLog1.txt Edit (36.2 KiB, text/plain; charset="utf-8")
GdmLog2.txt Edit (31.5 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (11.1 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (484 bytes, text/plain; charset="utf-8")
PciDisplay.txt Edit (1.1 KiB, text/plain; charset="utf-8")
ProcAttrCurrent.gz Edit (49 bytes, application/x-gzip)
ProcCpuinfo.txt Edit (551 bytes, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (1.2 KiB, text/plain; charset="utf-8")
ProcMaps.txt Edit (20.3 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (2.1 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (725 bytes, text/plain; charset="utf-8")
Registers.txt Edit (459 bytes, text/plain; charset="utf-8")
RelatedPackageVersions.txt Edit (232 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (1.2 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (1.2 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (100.0 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (212.6 KiB, text/plain; charset="utf-8")
XorgLog.txt Edit (39.4 KiB, text/plain; charset="utf-8")
XorgLogOld.txt Edit (40.6 KiB, text/plain; charset="utf-8")
Xrandr.txt Edit (3.2 KiB, text/plain; charset="utf-8")
setxkbmap.txt Edit (239 bytes, text/plain; charset="utf-8")
xdpyinfo.txt Edit (17.2 KiB, text/plain; charset="utf-8")
xkbcomp.txt Edit (46.7 KiB, text/plain; charset="utf-8")

visibility:

private → public

Revision history for this message

Apport retracing service (apport) wrote on 2010-03-20:

StacktraceTop:
__kernel_vsyscall ()
*__GI_raise (sig=6)
*__GI_abort () at abort.c:92
__libc_message (do_abort=2,
malloc_printerr (action=<value optimized out>,

Revision history for this message

Apport retracing service (apport) wrote on 2010-03-20: Stacktrace.txt

Stacktrace.txt Edit (2.2 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2010-03-20: ThreadStacktrace.txt

ThreadStacktrace.txt Edit (2.3 KiB, text/plain)

Changed in xorg-server (Ubuntu):
importance:	Undecided → Medium
tags:	removed: need-i386-retrace

Bryce Harrington (bryce) on 2010-03-21

tags:	added: crash
Changed in xorg-server (Ubuntu):
status:	New → Confirmed

Bryce Harrington (bryce) on 2010-04-03

summary:	- Xorg assert failure: * glibc detected * /usr/bin/X: realloc(): - invalid pointer: 0x096a6dd0 *** + Xorg assert failure: /usr/bin/X: realloc(): invalid pointer: 0x096a6dd0
description:	updated
summary:	- Xorg assert failure: /usr/bin/X: realloc(): invalid pointer: 0x096a6dd0 + [RV250] Xorg assert failure: /usr/bin/X: realloc(): invalid pointer: + 0x096a6dd0

Bryce Harrington (bryce) on 2010-04-03

Changed in xorg-server (Ubuntu):
status:	Confirmed → Triaged
importance:	Medium → High
summary:	[RV250] Xorg assert failure: /usr/bin/X: realloc(): invalid pointer: - 0x096a6dd0 + 0x096a6dd0 after calling xf86Wakeup ()

Revision history for this message

In freedesktop.org Bugzilla #27503, Bryce Harrington (bryce) wrote on 2010-04-06:

Download full text (3.6 KiB)

Computed crashed after trying to log switch to another user through GDM

dmi.bios.date: 07/16/2003
dmi.bios.vendor: Phoenix Technologies, LTD
dmi.bios.version: 3.23
dmi.board.name: MS-6577
dmi.board.vendor: MICRO-STAR INTERNAT...

Computed crashed after trying to log switch to another user through GDM

Thread 1 (process 7802):
#0 0x00cc6422 in __kernel_vsyscall ()
No symbol table info available.
#1 0x003b1601 in *__GI_raise (sig=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
 resultvar = <value optimized out>
 pid = 5074932
 selftid = 7802
#2 0x003b4a62 in *__GI_abort () at abort.c:92
 act = {__sigaction_handler = {
    sa_handler = 0xb8f4e4 <_rtld_local+1220>,
    sa_sigaction = 0xb8f4e4 <_rtld_local+1220>}, sa_mask = {__val = {917504,
      136066896, 134582228, 3213672264, 39520, 3213672232, 134544804,
      134532708, 1031, 12122360, 4508129, 1031, 136066896, 3213672160,
      5074932, 15, 3213673620, 3213672280, 4627156, 2, 3213672160, 4, 0,
      3213672256, 3213672268, 2, 4933319, 4933315, 4928865, 4928891, 230,
      3213672160}}, sa_flags = -1081295064, sa_restorer = 0x4b5a63}
 sigs = {__val = {32, 0 <repeats 31 times>}}
#3 0x003e856d in __libc_message (do_abort=2,
    fmt=0x4b78b8 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
 ap = <value optimized out>
 fd = -1081294704
 on_2 = <value optimized out>
 list = <value optimized out>
 nlist = <value optimized out>
 cp = <value optimized out>
 written = false
#4 0x003f2611 in malloc_printerr (action=<value optimized out>,
    str=0x6 <Address 0x6 out of bounds>, ptr=0x96a6dd0) at malloc.c:6264
 buf = "096a6dd0"
 cp = <value optimized out>
#5 0x003f81e8 in *__GI___libc_realloc (oldmem=0x0, bytes=512)
    at malloc.c:3778
 ar_ptr = <value optimized out>
 nb = 157999728
 newp = <value optimized out>
 oldp = (const mchunkptr) 0x96a6dc8
 oldsize = 0
 __func__ = "__libc_realloc"
#6 0x080aa523 in Xrealloc ()

ProblemType: Crash
Architecture: i386
AssertionMessage: *** glibc detected *** /usr/bin/X: realloc(): invalid pointer: 0x096a6dd0 ***
CurrentDmesg:
 [ 24.780015] eth1: no IPv6 routers present
 [ 35.908042] end_request: I/O error, dev fd0, sector 0
 [ 35.992049] end_request: I/O error, dev fd0, sector 0
Date: Sat Mar 20 17:34:46 2010
DistroRelease: Ubuntu 10.04
DkmsStatus: Error: [Errno 2] Bestand of map bestaat niet
ExecutablePath: /usr/bin/Xorg
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Beta i386 (20100318)
MachineType: HP Pavilion 06 DF168A-ABH T170.
Package: xserver-xorg-core 2:1.7.5-1ubuntu3
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.32-16-generic root=UUID=1ed36f90-6dd8-4916-8da8-acd31abccb32 ro quiet splash
ProcCmdline: /usr/bin/X :1 -br -verbose -auth /var/run/gdm/auth-for-gdm-GncyXg/database -nolisten tcp
ProcEnviron:
 LANG=nl_NL.UTF-8
 PATH=(custom, no user)
ProcVersionSignature: Ubuntu 2.6.32-16.25-generic
Signal: 6
SourcePackage: xorg-server
StacktraceTop:
 __kernel_vsyscall ()
 raise () from /lib/tls/i686/cmov/libc.so.6
 abort () from /lib/tls/i686/cmov/libc.so.6
 ?? () from /lib/tls/i686/cmov/libc.so.6
 ?? () from /lib/tls/i686/cmov/libc.so.6
Title: Xorg assert failure: *** glibc detected *** /usr/bin/X: realloc(): invalid pointer: 0x096a6dd0 ***
Uname: Linux 2.6.32-16-generic i686
UserGroups:

dmi.bios.date: 07/16/2003
dmi.bios.vendor: Phoenix Technologies, LTD
dmi.bios.version: 3.23
dmi.board.name: MS-6577
dmi.board.vendor: MICRO-STAR INTERNATIONAL CO., LTD
dmi.board.version: 030
dmi.chassis.type: 3
dmi.modalias: dmi:bvnPhoenixTechnologies,LTD:bvr3.23:bd07/16/2003:svnHPPavilion06:pnDF168A-ABHT170.:pvr03Y0211RE101XENO4:rvnMICRO-STARINTERNATIONALCO.,LTD:rnMS-6577:rvr030:cvn:ct3:cvr:
dmi.product.name: DF168A-ABH T170.
dmi.product.version: 03Y0211RE101XENO4
dmi.sys.vendor: HP Pavilion 06
glxinfo: Error: [Errno 2] Bestand of map bestaat niet
system:
 distro: Ubuntu
 codename: lucid
 architecture: i686
 kernel: 2.6.32-16-generic

Revision history for this message

In freedesktop.org Bugzilla #27503, Bryce Harrington (bryce) wrote on 2010-04-06:

Created an attachment (id=34743)
XorgLog.txt

Revision history for this message

In freedesktop.org Bugzilla #27503, Bryce Harrington (bryce) wrote on 2010-04-06:

Created an attachment (id=34744)
ThreadStacktrace.txt

Revision history for this message

In freedesktop.org Bugzilla #27503, Bryce Harrington (bryce) wrote on 2010-04-06:

This bug was reported to Ubuntu by Mindy Garside, in this bug report which I'm forwarding here:
https://bugs.edge.launchpad.net/xorg-server/+bug/542814

Revision history for this message

Bryce Harrington (bryce) wrote on 2010-04-07:

Mindy Garside - I've forwarded this bug upstream to http://bugs.freedesktop.org/show_bug.cgi?id=27503 - please subscribe yourself to this bug, in case they need further information or wish you to test something. Thanks ahead of time!

Revision history for this message

In freedesktop.org Bugzilla #27503, Michel Dänzer (michel-daenzer) wrote on 2010-04-07:

#10

At that point it's probably just detecting a memory error (double-free, use after free, ...) which happened earlier. Something like valgrind could be useful for finding the cause. You may also want to make sure you have commit 2ad8aae749fe08f139e3046e923da8233b9a7cd5 ('hw/xfree86: move reference counting out of the UseHWCursor[ARGB] functions') which fixes a use-after-free.

Revision history for this message

Bryce Harrington (bryce) wrote on 2010-04-28:

#11

Mindy, upstream suggested a patch for this issue, which I've packaged for you to test at this PPA:

https://edge.launchpad.net/~bryceharrington/+archive/orange

If you find this solves the problem, we may be able to consider doing an SRU of this fix for Lucid.

Changed in xorg-server (Ubuntu):
status:	Triaged → In Progress

Revision history for this message

Chris Halse Rogers (raof) wrote on 2010-08-23:

#12

If this crash is caused by the cursor refcounting bug fixed in the above PPA this will be already fixed in Maverick.

Could you please test the PPA above?

Changed in xorg-server (Ubuntu):
status:	In Progress → Incomplete

Bryce Harrington (bryce) on 2010-08-23

Changed in xorg-server (Ubuntu):
status:	Incomplete → New
status:	New → Incomplete

Bug Watch Updater (bug-watch-updater) on 2010-09-14

Changed in xorg-server:
importance:	Unknown → High
status:	Unknown → Confirmed

Bryce Harrington (bryce) on 2010-09-15

Changed in xorg-server (Ubuntu):
status:	Incomplete → New
status:	New → Incomplete

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-12:

#13

Given no response to our calls for testing over the past year, I'm going to go ahead and close this out. Perhaps we can optimistically assume the lack of response indicates the issue indeed went away?

Changed in xorg-server (Ubuntu):
status:	Incomplete → Fix Released

Bug Watch Updater (bug-watch-updater) on 2011-01-25

Changed in xorg-server:
importance:	High → Unknown

Bug Watch Updater (bug-watch-updater) on 2011-02-03

Changed in xorg-server:
importance:	Unknown → High

Bug Watch Updater (bug-watch-updater) on 2011-10-11

Changed in xorg-server:
status:	Confirmed → Invalid

Report a bug

This report contains Public information

Everyone can see this information.

Duplicates of this bug

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

freedesktop-bugs #27503
[RESOLVED WORKSFORME] Edit

Bug watches keep track of this bug in other bug trackers.

Ubuntuxorg-server package

[RV250] Xorg assert failure: /usr/bin/X: realloc(): invalid pointer: 0x096a6dd0 after calling xf86Wakeup ()

Bug Description

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
xorg-server package