SIGSEGV when opening email - Address out of bounds in RADEONUploadToScreenCS

[Laurent Marchal]

Binary package hint: xorg

When I open an image with a big picture as attachment, Xorg segfault and restart EVERY time I open the same email..

Backtrace:
[ 7839.236] 0: /usr/bin/X (xorg_backtrace+0x3b) [0x80a531b]
[ 7839.236] 1: /usr/bin/X (0x8048000+0x60808) [0x80a8808]
[ 7839.236] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xb77b040c]
[ 7839.236] 3: /usr/bin/X (CloseWellKnownConnections+0x34) [0x80a5e24]
[ 7839.236] 4: /usr/bin/X (0x8048000+0x6abcf) [0x80b2bcf]
[ 7839.236] 5: /usr/bin/X (0x8048000+0x6ac42) [0x80b2c42]
[ 7839.236] 6: /usr/bin/X (0x8048000+0x6ad5e) [0x80b2d5e]
[ 7839.236] 7: /usr/bin/X (0x8048000+0x12a4d6) [0x81724d6]
[ 7839.236] 8: /usr/bin/X (xf86CloseConsole+0x13f) [0x8172cef]
[ 7839.237] 9: /usr/bin/X (ddxSigGiveUp+0xa5) [0x80b6ee5]
[ 7839.237] 10: /usr/bin/X (SigAbortDDX+0xa6) [0x80b6fc6]
[ 7839.237] 11: /usr/bin/X (0x8048000+0x6abe8) [0x80b2be8]
[ 7839.237] 12: /usr/bin/X (0x8048000+0x6b681) [0x80b3681]
[ 7839.237] 13: /usr/bin/X (0x8048000+0x608a1) [0x80a88a1]
[ 7839.237] 14: (vdso) (__kernel_rt_sigreturn+0x0) [0xb77b040c]
[ 7839.237] 15: /usr/lib/xorg/modules/drivers/radeon_drv.so (0xb724a000+0xa29f1) [0xb72ec9f1]
[ 7839.237] 16: /usr/lib/xorg/modules/libexa.so (0xb71f5000+0x8f4f) [0xb71fdf4f]
[ 7839.237] 17: /usr/bin/X (0x8048000+0xe2a25) [0x812aa25]
[ 7839.237] 18: /usr/bin/X (0x8048000+0x24ae8) [0x806cae8]
[ 7839.237] 19: /usr/bin/X (0x8048000+0x282c7) [0x80702c7]
[ 7839.237] 20: /usr/bin/X (0x8048000+0x1a81c) [0x806281c]
[ 7839.238] 21: /lib/i386-linux-gnu/libc.so.6 (__libc_start_main+0xe7) [0xb74c6e37]
[ 7839.238] 22: /usr/bin/X (0x8048000+0x1a411) [0x8062411]
[ 7839.238] Segmentation fault at address 0x44
[ 7839.238]

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: xorg 1:7.6+4ubuntu3
ProcVersionSignature: Ubuntu 2.6.38-8.42-generic-pae 2.6.38.2
Uname: Linux 2.6.38-8-generic-pae i686
Architecture: i386
CompizPlugins: [core,bailer,detection,composite,opengl,decor,mousepoll,vpswitch,regex,animation,snap,expo,move,compiztoolbox,place,grid,imgpng,gnomecompat,wall,ezoom,workarounds,staticswitcher,resize,fade,unitymtgrabhandles,scale,session,unityshell]
CompositorRunning: None
DRM.card0.LVDS.1:
 status: connected
 enabled: enabled
 dpms: On
 modes: 1440x900 1280x854 1280x800 1280x720 1152x768 1024x768 800x600 848x480 720x480 640x480
 edid-base64: AP///////wAGr0cRAAAAAAEQAQOAHhN4Cof1lFdPjCcnUFQAAAABAQEBAQEBAQEBAQEBAQEBHCqgElKEDDBAIDMAL70QAAAYAAAADwAAAAAAAAAAAAAAAAAgAAAA/gBBVU8KICAgICAgICAgAAAA/gBCMTQxUFcwMSBWMSAKANE=
DRM.card0.VGA.1:
 status: disconnected
 enabled: disabled
 dpms: Off
 modes:
 edid-base64:
Date: Tue Apr 19 14:24:17 2011
DistUpgraded: Log time: 2011-04-18 08:53:20.924956
DistroCodename: natty
DistroVariant: ubuntu
DkmsStatus: virtualbox-ose, 4.0.4, 2.6.38-8-generic-pae, i686: installed
GraphicsCard:
 ATI Technologies Inc M64-S [Mobility Radeon X2300] [1002:7188] (prog-if 00 [VGA controller])
   Subsystem: Hewlett-Packard Company 6910p [103c:30c1]
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Beta i386 (20100318)
MachineType: Hewlett-Packard HP Compaq 6910p
PccardctlStatus:
 Socket 0:
   no card
 Socket 1:
   3.3V 16-bit PC Card
   Subdevice 0 (function 0) bound to driver "pata_pcmcia"
ProcEnviron:
 LANGUAGE=en_US:en
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/zsh
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.38-8-generic-pae root=UUID=ab190d60-22a0-4e2c-8662-496481d3fce8 ro vt.handoff=7
Renderer: Unknown
SourcePackage: xorg
UpgradeStatus: Upgraded to natty on 2011-04-18 (1 days ago)
dmi.bios.date: 11/04/2008
dmi.bios.vendor: Hewlett-Packard
dmi.bios.version: 68MCD Ver. F.17
dmi.board.name: 30C1
dmi.board.vendor: Hewlett-Packard
dmi.board.version: KBC Version 68.36
dmi.chassis.asset.tag: HUB7370BKP
dmi.chassis.type: 10
dmi.chassis.vendor: Hewlett-Packard
dmi.modalias: dmi:bvnHewlett-Packard:bvr68MCDVer.F.17:bd11/04/2008:svnHewlett-Packard:pnHPCompaq6910p:pvrF.17:rvnHewlett-Packard:rn30C1:rvrKBCVersion68.36:cvnHewlett-Packard:ct10:cvr:
dmi.product.name: HP Compaq 6910p
dmi.product.version: F.17
dmi.sys.vendor: Hewlett-Packard
version.compiz: compiz 1:0.9.4+bzr20110415-0ubuntu2
version.libdrm2: libdrm2 2.4.23-1ubuntu6
version.libgl1-mesa-dri: libgl1-mesa-dri 7.10.2-0ubuntu2
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 7.10.2-0ubuntu2
version.xserver-xorg: xserver-xorg 1:7.6+4ubuntu3
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.14.0-0ubuntu4
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.14.0-4ubuntu7
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:0.0.16+git20110107+b795ca6e-0ubuntu7

[Laurent Marchal (biguphpc)]

Log of the error

[Bryce Harrington (bryce)]

Looks like a legitimate X crash however the backtrace is incomplete.

Laurent, please follow the directions at http://wiki.ubuntu.com/X/Backtracing to collect a full backtrace with all symbols defined.

[Laurent Marchal (biguphpc)]

Ok i applied all the latest updates from ubuntu, got the dbg packages and used gdb with Xorg. I struggled a bit to get a backtrace because I needed the libc6-dbg too.. Anyway here you go !

Note that this only happens when I log on the session with effects enabled.

[Bryce Harrington (bryce)]

Thanks.

Not clear yet what is wrong but the backtrace looks valid now.

[Bryce Harrington (bryce)]

[Tagging as oneiric because while it hasn't yet been re-confirmed against oneiric, there is no reason to think it fixed in oneiric and the bug is actionable at this point and deserves further attention during development.]

[Bryce Harrington (bryce)]

Laurent Marchal - I've forwarded this bug upstream to http://bugs.freedesktop.org/show_bug.cgi?id=36855 - please subscribe yourself to this bug, in case they need further information or wish you to test something. Thanks ahead of time!

[Bryce Harrington (bryce)]

Upstream indicates they'd like to see output from running X server in valgrind to look for out-of-bounds memory issues. Are you (or anyone able to repro this bug) familiar with using valgrind and willing to give it a shot?

[Laurent Marchal (biguphpc)]

Ok I'll try to give it a shot in few days and post the results.

[Laurent Marchal (biguphpc)]

I tried with valgrind but i'm not familiar at all with the tool and I would need help to be able to trace Xorg with it.

I tried to do :
sudo valgrind --trace-children=yes --log-file=/tmp/valgind.log gdm

but it's so slowww (on my core 2 duo) and nothing happens after more than 5 minutes...

Do you know how I can trace Xorg with it ?
Thanks.

[Laurent Marchal (biguphpc)]

Nevermind I managed to make valgrind work ! here's the log, also added in the upstream bug

[Bryce Harrington (bryce)]

Btw, dunno if you saw it, but upstream posted a follow up request on the upstream bug - "It might be useful if you could get another valgrind log with libpixman-1-0-dbg installed."

[Laurent Marchal (biguphpc)]

I did'nt saw it, I send them a new trace. Thanks

[Bryce Harrington (bryce)]

Hi Laurent,

Upstream's comment about the record extension reminded me of a recent bug we had that was traced to that extension and fixed last month. I see in this bug report you were running the bugged version (-evdev u12). The fix was backported to natty-updates as version u12.1 - can you update to latest version of natty with this version of evdev? I think it will solve this bug.

[Laurent Marchal (biguphpc)]

Hello Bryce,

 I didn't know exactly what you were talking about the bugged version (-evdev u12) and now it's version u12.1..
So I naively checked the xserver-xorg-input-evdev version that doesn't match at all (Version: 1:2.6.0-1ubuntu12)

Anyway I updated all packages to the latest version and I still have the same issue.
Thanks for your help!

[Bryce Harrington (bryce)]

@Laurent, can you post another copy of your /var/log/Xorg.0.log so we have the evidence that the record module is not being loaded?

[dino99 (9d9)]

This version has expired