KDE crashes at login with desktop effects enabled

[Bhaskar Kandiyal]

I have a HP DV6 6121tx laptop, with Intel Core i7 sandybridge and a discrete GPU (Ati 6770m) and an Intel GPU.

Whenever I login to Kubutu with desktop effects enabled, X crashes at the KDE splash screen and drops back to the login screen (kdm). Any subsequent logins work since KDE automatically disabled desktop effects after a crash.

However, if I login with effects disabled and enable then _after_ logging in then everything works fine until I logout.
I've also tested compiz, and it works without any problems.

All packages are of latest version.

Here's some more info:

$ lspci -vnn | grep VGA
00:02.0 VGA compatible controller [0300]: Intel Corporation 2nd Generation Core Processor Family Integrated Graphics Controller [8086:0116] (rev 09)(prog-if 00 [VGA controller])
01:00.0 VGA compatible controller [0300]: ATI Technologies Inc Whistler XT [AMD Radeon HD 6700M Series] [1002:6740] (prog-if 00 [VGA controller])

$ uname -r
3.0.0-12-generic

$ lsb_release -rd
Description: Ubuntu 11.10
Release: 11.10

$ apt-cache policy xserver-xorg-video-intel
xserver-xorg-video-intel:
  Installed: 2:2.15.901-1ubuntu2
  Candidate: 2:2.15.901-1ubuntu2
  Version table:
 *** 2:2.15.901-1ubuntu2 0
        500 http://in.archive.ubuntu.com/ubuntu/ oneiric/main amd64 Packages
        100 /var/lib/dpkg/status

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: xserver-xorg-video-intel 2:2.15.901-1ubuntu2
ProcVersionSignature: Ubuntu 3.0.0-12.20-generic 3.0.4
Uname: Linux 3.0.0-12-generic x86_64
ApportVersion: 1.23-0ubuntu3
Architecture: amd64
Date: Tue Oct 18 00:25:22 2011
InstallationMedia: Kubuntu 11.10 "Oneiric Ocelot" - Beta amd64 (20111007)
ProcEnviron:
 LANGUAGE=en_IN:en
 PATH=(custom, user)
 LANG=en_IN
 SHELL=/bin/zsh
SourcePackage: xserver-xorg-video-intel
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Thilo-Alexander Ginkel (thilo.ginkel)]

Reverting to commit f1697546699ded4af63dca35b51d3ca408b002d3 (= xserver-xorg-video-intel-2_2.14.0-1) at git://git.debian.org/git/pkg-xorg/driver/xserver-xorg-video-intel fixes the issue whereas it is still present in HEAD (currently e97d7c18b3ccddcc32929f1e857ecaa281f49710).

I'm currently a little short on spare time, but using a git bisect it should be possible to identify the culprit.

[Sergio Callegari (callegar)]

As a workaround, try to edit the kdm configuration file and make it restart the server at logout.

In my system this seems to fix the issue.

[Thilo-Alexander Ginkel (thilo.ginkel)]

The following issue occurs on my Kubuntu 11.10 system (Lenovo T420s w/ Intel HD Graphics 3000).

With KWin desktop effects enabled, Xorg crashes on each second login.

$ uname -a
Linux orion 3.1.0-0301rc10-generic #201110181253 SMP Tue Oct 18 12:57:33 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux

$ lspci -vv
00:02.0 VGA compatible controller: Intel Corporation 2nd Generation Core Processor Family Integrated Graphics Controller (rev 09) (prog-if 00 [VGA controller])
        Subsystem: Lenovo Device 21d2
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 0
        Interrupt: pin A routed to IRQ 49
        Region 0: Memory at f0000000 (64-bit, non-prefetchable) [size=4M]
        Region 2: Memory at e0000000 (64-bit, prefetchable) [size=256M]
        Region 4: I/O ports at 4000 [size=64]
        Expansion ROM at <unassigned> [disabled]
        Capabilities: <access denied>
        Kernel driver in use: i915
        Kernel modules: i915

Full backtrace (based on commit 2608a367acba7247e50754c3daeed09ba2e97d05):
-- 8< --
#0 0x00007fcbf4fa63a5 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
        resultvar = 0
        pid = <optimized out>
        selftid = <optimized out>
#1 0x00007fcbf4fa9b0b in __GI_abort () at abort.c:92
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x4, sa_sigaction = 0x4}, sa_mask = {__val = {5,
              140735046524302, 10, 140513966347903, 3, 140735046516714, 6, 140513966347907, 2,
              140735046516734, 2, 140513966338901, 1, 140513966347903, 3, 140735046516708}}, sa_flags = 12,
          sa_restorer = 0x7fcbf50cd683}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007fcbf4fde113 in __libc_message (do_abort=2,
    fmt=0x7fcbf50cf0d8 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
        ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff6e748960,
            reg_save_area = 0x7fff6e748870}}
        ap_copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff6e748960,
            reg_save_area = 0x7fff6e748870}}
        fd = 2
        on_2 = <optimized out>
        list = <optimized out>
        nlist = <optimized out>
        cp = <optimized out>
        written = <optimized out>
#3 0x00007fcbf4fe8a96 in malloc_printerr (action=3, str=0x7fcbf50cf278 "double free or corruption (!prev)",
    ptr=<optimized out>) at malloc.c:6283
        buf = "0000000002bf2230"
        cp = <optimized out>
#4 0x00007fcbf4fecd7c in __GI___libc_free (mem=<optimized out>) at malloc.c:3738
        ar_ptr = 0x7fcbf530a1c0
        p = <optimized out>
        hook = <optimized out>
#5 0x00007fcbf31ae5de in i830_dri2_frame_event_drawable_gone (data=0x2bf2230, id=29360131)
    at ../../src/intel_dri.c:678
        resource = 0x2bf2230
#6 0x000000000044ea5c in FreeClientResources (client=0x2d01c10) at ../../dix/resource.c:854
        rtype = <optimized out>
        resources = <optimized out>
        this = 0x2f4b0c0
 ...

[Thilo-Alexander Ginkel (thilo.ginkel)]

I bi-sected xserver-xorg-video-intel (as available at git://git.debian.org/git/pkg-xorg/driver/xserver-xorg-video-intel, which is what the Ubuntu packages are based on). The first bad commit is:

commit 2608a367acba7247e50754c3daeed09ba2e97d05
Author: Chris Wilson <email address hidden>
Date: Mon Jul 11 16:28:15 2011 +0100

    dri: Prevent abuse of the Resource database

    The Resource database is only designed to store a single value for a
    particular type associated with an XID. Due to the asynchronous nature
    of the vblank/flip requests, we would often associate multiple frame
    events with a particular drawable/client. Upon freeing the resource, we
    would not necessarily decouple the right value, leaving a stale pointer
    behind. Later when the client disappeared, we would write through that
    stale pointer upsetting valgrind and causing memory corruption. MDK.

    Instead, we need to implement an extra layer for tracking multiple
    frames within a single Resource.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=37700
    Signed-off-by: Chris Wilson <email address hidden>

[Thilo-Alexander Ginkel (thilo.ginkel)]

The corresponding Ubuntu bug is abvailable at: https://bugs.launchpad.net/xserver-xorg-video-intel/+bug/876762

[Thilo-Alexander Ginkel (thilo.ginkel)]

In response to comment #4:

@Sergio: Which KDM option needs to be set to effect this behavior?

[Boban Aleksov (aleksovboban)]

This: TerminateServer=true
in file /etc/kde4/kdm/kdmrc under section [X-:*-Core]
I cant tell you more, because i changed my login theme and now this file isn't as default anymore.

[Chris Wilson (ickle)]

http://cgit.freedesktop.org/~ickle/xserver/commit/?id=65a272e7ae9392a5716a620d669ef5261241bc4b

dri2: Register the DRI2DrawableType after server regeneration
The Resource database is reset upon regeneration and so the dri2 module
needs to re-register its RESTYPE for the drawable or else it will
clobber the next unsuspecting user of the database. Fortunately, DRI2 is
loaded late in the initialisation sequence and was last up until
xf86-video-intel started using the Resource database to track
outstanding swaps...

Signed-off-by: Chris Wilson <email address hidden>

[Bhaskar Kandiyal (bkandiyal)]

Thanks Thilo-Alexander Ginkel for finding out the problem and forwarding it upstream :)
I can confirm that the workaround mentioned in #4 and #7 works.

[Sergio Callegari (callegar)]

To #6 (though I guess that Boban's answer was probably enough)

edit /etc/kde4/kdm/kdmrc

look for

# Restart instead of resetting the local X-server after session exit.
# Use it if the server leaks memory etc.
# Default is false
#TerminateServer=true

should be in the Core config for local displays
[X-:*-Core] section.

Uncomment the TerminateServer=true option. If you do not have the prefilled option commented, just add it in the section above.

Hope this helps

[Jeremy Sequoia (jeremyhu)]

Ping. Chris, why isn't this merged? Please send it to xorg-devel for review.

[Chris Wilson (ickle)]

v1 or v2 is waiting for tlc, id:<email address hidden>

[Paulo Zanoni (pzanoni)]

Easier way to reproduce the bug on xf86-video-intel and xserver git master (using SandyBridge):

# X -retro :0
# DISPLAY=:0 glxinfo
# DISPLAY=:0 glxinfo

After the second glxinfo, X will crash. Notice that you can't have
other X clients, so you can trigger new server generations.

My Tested-by was sent to Chris' patch on the list.

(what does tlc mean? google didn't help me)

[Chris Wilson (ickle)]

tlc - tender, love and care. ;-)

[David Rodrigues (dadyrodrigues)]

Same problem. The workaround works for me as well.

[Jeremy Sequoia (jeremyhu)]

commit 7972e2dade58158bb98f5b7dc5f873b9fb3446de
Author: Chris Wilson <email address hidden>
Date: Thu Aug 25 16:04:04 2011 +0100

    dri2: Register the DRI2DrawableType after server regeneration

    The Resource database is reset upon regeneration and so the dri2 module
    needs to re-register its RESTYPE for the drawable or else it will
    clobber the next unsuspecting user of the database. Fortunately, DRI2 is
    loaded late in the initialisation sequence and was last up until
    xf86-video-intel started using the Resource database to track
    outstanding swaps...

    Signed-off-by: Chris Wilson <email address hidden>
    Reviewed-by: Jeremy Huddleston <email address hidden>
    Tested-by: Paulo Zanoni <email address hidden>
    (cherry picked from commit 34b0e4eee911f8b09a3682a7f1b4c8598ef48b8d)

[Thilo-Alexander Ginkel (thilo.ginkel)]

A fix is now available upstream: https://bugs.freedesktop.org/show_bug.cgi?id=42008#c7

Any chance we will see this in an updated xserver-xorg-video-intel package for Oneiric?

[jhoechtl (johann-hoechtl)]

The work-around described in #7 & #4 of course only works if

- you do not switch between DRI modes (eg. ALT-SHIFT-F12)
- you do not have power save enabled to alter desktop effects

otherwise you will lose any unsaved work when you detach you power cord.

[jhoechtl (johann-hoechtl)]

Sorry for #20, this is actually wrong, kdm doesn't crash after switching desktop effects. But if you want to safely re-login after a logout, you can choose restart X-Server on the login prompt. The next login will not crash kdm and desktop effects remain enabled.

[jhoechtl (johann-hoechtl)]

Any chance we will see this in an updated xserver-xorg-video-intel package for Oneiric?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Bryce Harrington (bryce)]

Here's the patch if anyone wants to do an SRU for it.
The patch might need some massaging to make it work with xserver 1.10.

[Bryce Harrington (bryce)]

The fix is in precise already.

[Sergio Callegari (callegar)]

A SRU would be most welcome. Precise is still a few months away.

[Rolf Leggewie (r0lf)]

oneiric has seen the end of its life and is no longer receiving any updates. Marking the oneiric task for this ticket as "Won't Fix".