Ubuntu
xserver-xorg-input-synaptics package

Xorg crashed with SIGSEGV in WriteToClient() with buf = 0x100000000 from ProcXIGetProperty()

Bug #941953 reported by Scott Sweeny on 2012-02-27

This bug affects 1 person

	Status	Importance	Assigned to
Xserver Xorg Input Synaptics	Fix Released	High	freedesktop-bugs #49439
xserver-xorg-input-synaptics (Ubuntu)	Fix Released	High	Maarten Lankhorst
Precise	Fix Released	High	Maarten Lankhorst

Bug Description

[Impact]
Crash bug and silent memory corruption due to out of bounds access that may not be noticed until much much later, in which case it's fatal.

[Test Case]
The easiest is running with valgrind, starting X and then while doing touch motions launch /etc/X11/Xsession and disable/enable touchpad with the keyboard fn keys.
1. Start X (either with or without valgrind attached)
2. Start doing motions with 2 fingers and simultaneously launch /etc/X11/Xsession through ssh. If you're running valgrind, you will see a out of bound access.
3. Disable touchpad through builtin keys.
Broken Behavior: X will die due to memory corrupted memory being freed
Fixed Behavior: X survives

[Regression Potential]
The fixed package is upstream as 1.6.1-1ubuntu2, but this is in fact 1.6.2-1 without the commit tagging it as such. As such a few weeks of testing has already been done by quantal users. The package will also fix jumpy cursor behavior after suspend on some macbooks.

[Original Report]
This crash occurred on resume from suspend (to RAM) on a precise box up-to-date as of Feb 24.

=> 0x7f5ca44a42bc <free+28>: mov -0x8(%rdi),%rax
   0x7f5ca44a42c0 <free+32>: lea -0x10(%rdi),%rsi
   0x7f5ca44a42c4 <free+36>: test $0x2,%al
   0x7f5ca44a42c6 <free+38>: jne 0x7f5ca44a42f0 <free+80>
   0x7f5ca44a42c8 <free+40>: test $0x4,%al
   0x7f5ca44a42ca <free+42>: lea 0x33344f(%rip),%rdi # 0x7f5ca47d7720
   0x7f5ca44a42d1 <free+49>: je 0x7f5ca44a42df <free+63>
   0x7f5ca44a42d3 <free+51>: mov %rsi,%rax
   0x7f5ca44a42d6 <free+54>: and $0xfffffffffc000000,%rax
   0x7f5ca44a42dc <free+60>: mov (%rax),%rdi
   0x7f5ca44a42df <free+63>: xor %edx,%edx
   0x7f5ca44a42e1 <free+65>: jmpq 0x7f5ca44a01f0
   0x7f5ca44a42e6 <free+70>: nopw %cs:0x0(%rax,%rax,1)
   0x7f5ca44a42f0 <free+80>: mov 0x332e9d(%rip),%r11d # 0x7f5ca47d7194
   0x7f5ca44a42f7 <free+87>: test %r11d,%r11d
   0x7f5ca44a42fa <free+90>: jne 0x7f5ca44a4330 <free+144>

#9 0x00007f5ca641ad93 in FatalSignal (signo=11) at ../../os/log.c:550
        beenhere = 1
#10 <signal handler called>
No symbol table info available.
#11 __memmove_ssse3_back () at ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2723
No locals.
#12 0x00007f5ca64128e2 in WriteToClient (who=0x7f5caa9a46f0, count=4, __buf=0x100000000) at /usr/include/x86_64-linux-gnu/bits/string3.h:58
        oc = 0x7f5caa904180
        oco = 0x7f5caa90a700
        padBytes = <optimized out>
        buf = 0x100000000 <Address 0x100000000 out of bounds>
#13 0x00007f5ca63afeac in ProcXIGetProperty (client=0x7f5caa9a46f0) at ../../Xi/xiproperty.c:1263
        stuff = 0x7f5caada9bb0
        dev = 0x7f5caa3f3630
        reply = {repType = 1 '\001', RepType = 59 ';', sequenceNumber = 24, length = 1, type = 19, bytes_after = 0, num_items = 1, format = 32 ' ', pad0 = 0 '\000', pad1 = 0, pad2 = 2791869824, pad3 = 32604}
        length = 4
        rc = <optimized out>
        format = 32
        nitems = 1
        bytes_after = 0
        data = 0x100000000 <Address 0x100000000 out of bounds>
        type = 19

ProblemType: Crash
DistroRelease: Ubuntu 12.04
Package: xserver-xorg-core 2:1.11.4-0ubuntu4
ProcVersionSignature: Ubuntu 3.2.0-17.26-generic 3.2.6
Uname: Linux 3.2.0-17-generic x86_64
.tmp.unity.support.test.0:

ApportVersion: 1.93-0ubuntu2
Architecture: amd64
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CompositorRunning: compiz
Date: Mon Feb 27 09:09:11 2012
DistUpgraded: Log time: 2012-01-16 18:59:55.567693
DistroCodename: precise
DistroVariant: ubuntu
DkmsStatus: virtualbox, 4.1.8, 3.2.0-17-generic, x86_64: installed
ExecutablePath: /usr/bin/Xorg
ExtraDebuggingInterest: Yes, whatever it takes to get this fixed in Ubuntu
GraphicsCard:
Intel Corporation Core Processor Integrated Graphics Controller [8086:0046] (rev 18) (prog-if 00 [VGA controller])
Subsystem: CLEVO/KAPOK Computer Device [1558:3100]
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Release amd64 (20101007)
Lsusb:
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 004: ID 046d:c00e Logitech, Inc. M-BJ58/M-BJ69 Optical Wheel Mouse
MachineType: System76, Inc. Lemur UltraThin
ProcCmdline: /usr/bin/X :0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch -background none
ProcEnviron:

ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.2.0-17-generic root=UUID=552496e2-92cc-4e0f-87c0-322edc0cb632 ro quiet splash pcie_aspm=force vt.handoff=7
SegvAnalysis:
Segfault happened at: 0x7f5ca44a42bc <free+28>: mov -0x8(%rdi),%rax
PC (0x7f5ca44a42bc) ok
source "-0x8(%rdi)" (0xfffffff8) not located in a known VMA region (needed readable region)!
destination "%rax" ok
SegvReason: reading unknown VMA
Signal: 11
SourcePackage: xorg-server
StacktraceTop:
?? () from /lib/x86_64-linux-gnu/libc.so.6
WriteToClient ()
?? ()
?? ()
?? ()
Title: Xorg crashed with SIGSEGV in WriteToClient()
UpgradeStatus: Upgraded to precise on 2012-01-17 (41 days ago)
UserGroups:

dmi.bios.date: 11/11/2010
dmi.bios.vendor: Phoenix Technologies LTD
dmi.bios.version: CALPELLACRB.86C.0000.X.0000000000
dmi.board.asset.tag: Tag 12345
dmi.board.name: Lemur UltraThin
dmi.board.vendor: System76, Inc.
dmi.board.version: lemu2
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: System76, Inc.
dmi.chassis.version: lemu2
dmi.modalias: dmi:bvnPhoenixTechnologiesLTD:bvrCALPELLACRB.86C.0000.X.0000000000:bd11/11/2010:svnSystem76,Inc.:pnLemurUltraThin:pvrlemu2:rvnSystem76,Inc.:rnLemurUltraThin:rvrlemu2:cvnSystem76,Inc.:ct10:cvrlemu2:
dmi.product.name: Lemur UltraThin
dmi.product.version: lemu2
dmi.sys.vendor: System76, Inc.
version.compiz: compiz 1:0.9.7.0~bzr2995-0ubuntu5
version.ia32-libs: ia32-libs 20090808ubuntu33
version.libdrm2: libdrm2 2.4.30-1ubuntu1
version.libgl1-mesa-dri: libgl1-mesa-dri 8.0.1-0ubuntu2
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 8.0.1-0ubuntu2
version.xserver-xorg-core: xserver-xorg-core 2:1.11.4-0ubuntu4
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.6.99.901+git20120126-0ubuntu2
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.14.99~git20111219.aacbd629-0ubuntu2
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.17.0-1ubuntu4
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:0.0.16+git20111201+b5534a1-1build2

See original description

Tags:

Related branches

lp:ubuntu/quantal/xserver-xorg-input-synaptics

lp:ubuntu/precise-proposed/xserver-xorg-input-synaptics

Revision history for this message

Scott Sweeny (ssweeny) wrote on 2012-02-27:

BootDmesg.txt Edit (63.6 KiB, text/plain; charset="utf-8")
BootLog.gz Edit (732 bytes, application/x-gzip)
CurrentDmesg.txt Edit (57.4 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (2.3 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (896 bytes, text/plain; charset="utf-8")
DpkgLog.txt Edit (2.2 MiB, text/plain; charset="utf-8")
GconfCompiz.txt Edit (36.5 KiB, text/plain; charset="utf-8")
LightdmDisplayLog.txt Edit (1.1 KiB, text/plain; charset="utf-8")
LightdmGreeterLog.txt Edit (7.7 KiB, text/plain; charset="utf-8")
LightdmLog.txt Edit (11.4 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (29.4 KiB, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (3.3 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (2.0 KiB, text/plain; charset="utf-8")
ProcMaps.txt Edit (110.2 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (4.5 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (762 bytes, text/plain; charset="utf-8")
Registers.txt Edit (784 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (1.3 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (1.4 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (109.1 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (246.7 KiB, text/plain; charset="utf-8")
UnitySupportTest.txt Edit (597 bytes, text/plain; charset="utf-8")
XorgLog.txt Edit (31.3 KiB, text/plain; charset="utf-8")
XorgLogOld.txt Edit (39.2 KiB, text/plain; charset="utf-8")
Xrandr.txt Edit (3.4 KiB, text/plain; charset="utf-8")
dmidecode.txt.txt Edit (11.6 KiB, text/plain; charset="utf-8")
locale.txt Edit (327 bytes, text/plain; charset="utf-8")
peripherals.txt Edit (601 bytes, text/plain; charset="utf-8")
setxkbmap.txt Edit (233 bytes, text/plain; charset="utf-8")
xdpyinfo.txt Edit (9.7 KiB, text/plain; charset="utf-8")
xinput.txt Edit (836 bytes, text/plain; charset="utf-8")
xkbcomp.txt Edit (55.9 KiB, text/plain; charset="utf-8")

Revision history for this message

Apport retracing service (apport) wrote on 2012-02-27:

StacktraceTop:
WriteToClient (who=0x7f5caa9a46f0, count=4, __buf=0x100000000) at /usr/include/x86_64-linux-gnu/bits/string3.h:58
ProcXIGetProperty (client=0x7f5caa9a46f0) at ../../Xi/xiproperty.c:1263
Dispatch () at ../../dix/dispatch.c:439
main (argc=10, argv=<optimized out>, envp=<optimized out>) at ../../dix/main.c:287

Revision history for this message

Apport retracing service (apport) wrote on 2012-02-27: Stacktrace.txt

Stacktrace.txt Edit (3.1 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2012-02-27: ThreadStacktrace.txt

ThreadStacktrace.txt Edit (3.1 KiB, text/plain)

Changed in xorg-server (Ubuntu):
importance:	Undecided → Medium
tags:	removed: need-amd64-retrace

Bryce Harrington (bryce) on 2012-03-07

description:	updated
Changed in xorg-server (Ubuntu):
status:	New → Triaged
importance:	Medium → High
status:	Triaged → Confirmed

Bryce Harrington (bryce) on 2012-03-07

visibility:

private → public

Bryce Harrington (bryce) on 2012-03-07

description:

updated

Revision history for this message

Bryce Harrington (bryce) wrote on 2012-03-17: Re: Xorg crashed with SIGSEGV in WriteToClient() from ProcXIGetProperty()

#12 0x00007f5ca64128e2 in WriteToClient (who=0x7f5caa9a46f0, count=4, __buf=0x100000000) at /usr/include/x86_64-linux-gnu/bits/string3.h:58
        oc = 0x7f5caa904180
        oco = 0x7f5caa90a700
        padBytes = <optimized out>
        buf = 0x100000000 <Address 0x100000000 out of bounds>

buf looks wrong here.

summary:

- Xorg crashed with SIGSEGV in WriteToClient()
+ Xorg crashed with SIGSEGV in WriteToClient() from ProcXIGetProperty()

Bryce Harrington (bryce) on 2012-03-17

summary:

- Xorg crashed with SIGSEGV in WriteToClient() from ProcXIGetProperty()
+ Xorg crashed with SIGSEGV in WriteToClient() with buf = 0x100000000 from
+ ProcXIGetProperty()

Revision history for this message

In freedesktop.org Bugzilla #49439, Maarten Lankhorst (mlankhorst) wrote on 2012-05-03:

Download full text (4.2 KiB)

Created attachment 60979
Diff needed to trigger the problem in ubuntu.

priv->num_slots can grow out of bounds if multitouch is enabled, resulting in memory corruption.

A simple patch is attached that crashes when the the problem is triggered.

On my laptop I seem to be able to reproduce it by simply running /usr/bin/Xorg in 1 window, making circles with 2 fingers on touchpad and then starting DISPLAY=:0 /etc/X11/Xsession in another.

Backtrace:

#0 0x00007ffff61cf445 in __GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff61d2bab in __GI_abort () at abort.c:91
#2 0x00007ffff61c810e in __assert_fail_base (fmt=<optimized out>, assertion=0x7fffefdd4186 "priv->num_active_touches >= 0",
    file=0x7fffefdd4170 "../../src/synaptics.c", line=<optimized out>, function=<optimized out>) at assert.c:94
#3 0x00007ffff61c81b2 in __GI___assert_fail (assertion=0x7fffefdd4186 "priv->num_active_touches >= 0", file=0x7fffefdd4170 "../../src/synaptics.c",
    line=3021, function=0x7fffefdd4100 "UpdateTouchState") at assert.c:103
#4 0x00007fffefdc9e30 in UpdateTouchState (hw=<optimized out>, pInfo=<optimized out>) at ../../src/synaptics.c:3021
#5 0x00007fffefdcb033 in HandleTouches (hw=0x555555d5d3f0, pInfo=0x555555d35940) at ../../src/synaptics.c:3113
#6 HandleState (pInfo=<optimized out>, hw=<optimized out>, now=<optimized out>, from_timer=<optimized out>) at ../../src/synaptics.c:3306
#7 0x00007fffefdcd0b0 in ReadInput (pInfo=0x555555d35940) at ../../src/synaptics.c:1678
#8 0x00005555555df787 in xf86SigioReadInput (fd=<optimized out>, closure=0x555555d35940) at ../../../../hw/xfree86/common/xf86Events.c:298
#9 0x0000555555605757 in xf86SIGIO (sig=<optimized out>) at ../../../../../hw/xfree86/os-support/linux/../shared/sigio.c:111
#10 <signal handler called>
#11 SmartScheduleTimer (sig=14) at ../../os/utils.c:1158
#12 <signal handler called>
#13 __GI__dl_debug_state () at dl-debug.c:77
#14 0x00007ffff7ded908 in dl_open_worker (a=0x7fffffffdf70) at dl-open.c:294
#15 0x00007ffff7de9176 in _dl_catch_error (objname=0x7fffffffdfb8, errstring=0x7fffffffdfc0, mallocedp=0x7fffffffdfcf,
    operate=0x7ffff7ded700 <dl_open_worker>, args=0x7fffffffdf70) at dl-error.c:178
#16 0x00007ffff7ded31a in _dl_open (file=0x7fffffffe1c0 "libnss_compat.so.2", mode=-2147483647, caller_dlopen=0x7ffff629d21e, nsid=-2, argc=1,
    argv=<optimized out>, env=0x555555969370) at dl-open.c:639
#17 0x00007ffff62c7e02 in do_dlopen (ptr=0x7fffffffe170) at dl-libc.c:89
#18 0x00007ffff7de9176 in _dl_catch_error (objname=0x7fffffffe1a0, errstring=0x7fffffffe190, mallocedp=0x7fffffffe1af,
    operate=0x7ffff62c7dc0 <do_dlopen>, args=0x7fffffffe170) at dl-error.c:178
#19 0x00007ffff62c7ec4 in dlerror_run (args=0x7fffffffe170, operate=0x7ffff62c7dc0 <do_dlopen>) at dl-libc.c:48
#20 __GI___libc_dlopen_mode (name=<optimized out>, mode=<optimized out>) at dl-libc.c:165
#21 0x00007ffff629d21e in nss_load_library (ni=<optimized out>) at nsswitch.c:372
#22 0x00007ffff629dc7d in __GI___nss_lookup_function (ni=0x555555d79330, fct_name=0x7ffff63127aa "getpwnam_r") at nsswitch.c:474
#23 0x00007ffff629de8c in __GI___nss_lookup (ni=0x7fffffffe2d0, fct_name...

Created attachment 60979
Diff needed to trigger the problem in ubuntu.

priv->num_slots can grow out of bounds if multitouch is enabled, resulting in memory corruption.

A simple patch is attached that crashes when the the problem is triggered.

On my laptop I seem to be able to reproduce it by simply running /usr/bin/Xorg in 1 window, making circles with 2 fingers on touchpad and then starting DISPLAY=:0 /etc/X11/Xsession in another.

Backtrace:

#0  0x00007ffff61cf445 in __GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff61d2bab in __GI_abort () at abort.c:91
#2  0x00007ffff61c810e in __assert_fail_base (fmt=<optimized out>, assertion=0x7fffefdd4186 "priv->num_active_touches >= 0", 
    file=0x7fffefdd4170 "../../src/synaptics.c", line=<optimized out>, function=<optimized out>) at assert.c:94
#3  0x00007ffff61c81b2 in __GI___assert_fail (assertion=0x7fffefdd4186 "priv->num_active_touches >= 0", file=0x7fffefdd4170 "../../src/synaptics.c", 
    line=3021, function=0x7fffefdd4100 "UpdateTouchState") at assert.c:103
#4  0x00007fffefdc9e30 in UpdateTouchState (hw=<optimized out>, pInfo=<optimized out>) at ../../src/synaptics.c:3021
#5  0x00007fffefdcb033 in HandleTouches (hw=0x555555d5d3f0, pInfo=0x555555d35940) at ../../src/synaptics.c:3113
#6  HandleState (pInfo=<optimized out>, hw=<optimized out>, now=<optimized out>, from_timer=<optimized out>) at ../../src/synaptics.c:3306
#7  0x00007fffefdcd0b0 in ReadInput (pInfo=0x555555d35940) at ../../src/synaptics.c:1678
#8  0x00005555555df787 in xf86SigioReadInput (fd=<optimized out>, closure=0x555555d35940) at ../../../../hw/xfree86/common/xf86Events.c:298
#9  0x0000555555605757 in xf86SIGIO (sig=<optimized out>) at ../../../../../hw/xfree86/os-support/linux/../shared/sigio.c:111
#10 <signal handler called>
#11 SmartScheduleTimer (sig=14) at ../../os/utils.c:1158
#12 <signal handler called>
#13 __GI__dl_debug_state () at dl-debug.c:77
#14 0x00007ffff7ded908 in dl_open_worker (a=0x7fffffffdf70) at dl-open.c:294
#15 0x00007ffff7de9176 in _dl_catch_error (objname=0x7fffffffdfb8, errstring=0x7fffffffdfc0, mallocedp=0x7fffffffdfcf, 
    operate=0x7ffff7ded700 <dl_open_worker>, args=0x7fffffffdf70) at dl-error.c:178
#16 0x00007ffff7ded31a in _dl_open (file=0x7fffffffe1c0 "libnss_compat.so.2", mode=-2147483647, caller_dlopen=0x7ffff629d21e, nsid=-2, argc=1, 
    argv=<optimized out>, env=0x555555969370) at dl-open.c:639
#17 0x00007ffff62c7e02 in do_dlopen (ptr=0x7fffffffe170) at dl-libc.c:89
#18 0x00007ffff7de9176 in _dl_catch_error (objname=0x7fffffffe1a0, errstring=0x7fffffffe190, mallocedp=0x7fffffffe1af, 
    operate=0x7ffff62c7dc0 <do_dlopen>, args=0x7fffffffe170) at dl-error.c:178
#19 0x00007ffff62c7ec4 in dlerror_run (args=0x7fffffffe170, operate=0x7ffff62c7dc0 <do_dlopen>) at dl-libc.c:48
#20 __GI___libc_dlopen_mode (name=<optimized out>, mode=<optimized out>) at dl-libc.c:165
#21 0x00007ffff629d21e in nss_load_library (ni=<optimized out>) at nsswitch.c:372
#22 0x00007ffff629dc7d in __GI___nss_lookup_function (ni=0x555555d79330, fct_name=0x7ffff63127aa "getpwnam_r") at nsswitch.c:474
#23 0x00007ffff629de8c in __GI___nss_lookup (ni=0x7fffffffe2d0, fct_name=0x7ffff63127aa "getpwnam_r", fct2_name=0x0, fctp=0x7fffffffe2e0)
    at nsswitch.c:202
#24 0x00007ffff62562c8 in __getpwnam_r (name=0x555555ce4990 "i", resbuf=0x7ffff6552320, buffer=0x555555b35870 "X\374T\366\377\177", buflen=1024, 
    result=0x7fffffffe330) at ../nss/getXXbyYY_r.c:203
#25 0x00007ffff6255b74 in getpwnam (name=0x555555ce4990 "i") at ../nss/getXXbyYY.c:117
#26 0x00005555556db375 in siLocalCredGetId (addr=0x555555c7a272 "i", len=1, lcPriv=0x555555952790, id=0x7fffffffe3cc) at ../../os/access.c:1980
#27 0x00005555556db3d1 in siLocalCredCheckAddr (addrString=<optimized out>, length=<optimized out>, typePriv=<optimized out>)
    at ../../os/access.c:2055
#28 0x00005555556db11c in siCheckAddr (addrString=<optimized out>, length=11) at ../../os/access.c:1686
#29 0x00005555556dc4af in AddHost (client=0x555555ce4c60, family=5, length=11, pAddr=0x555555c7a268) at ../../os/access.c:1249
#30 0x00005555555a2881 in Dispatch () at ../../dix/dispatch.c:439
#31 0x00005555555917aa in main (argc=1, argv=<optimized out>, envp=<optimized out>) at ../../dix/main.c:287

Revision history for this message

In freedesktop.org Bugzilla #49439, Maarten Lankhorst (mlankhorst) wrote on 2012-05-03:

Backtrace was with synaptics 1.6.0

Chase Douglas (chasedouglas) on 2012-05-03

affects:	xorg-server (Ubuntu) → xserver-xorg-input-synaptics (Ubuntu)
Changed in xserver-xorg-input-synaptics (Ubuntu):
status:	Confirmed → Triaged
assignee:	nobody → Chase Douglas (chasedouglas)
Changed in xserver-xorg-input-synaptics (Ubuntu Precise):
status:	New → Triaged
importance:	Undecided → High
assignee:	nobody → Chase Douglas (chasedouglas)

Revision history for this message

Chase Douglas (chasedouglas) wrote on 2012-05-03:

There appears to be a bug where the number of touches goes negative. This leads to buffer overrun issues.

Bug Watch Updater (bug-watch-updater) on 2012-05-05

Changed in xserver-xorg-input-synaptics:
importance:	Unknown → High
status:	Unknown → In Progress

Revision history for this message

Chase Douglas (chasedouglas) wrote on 2012-05-05:

I can't reproduce using a magic trackpad. Maybe the issue is a bad kernel driver for a different device?

Revision history for this message

In freedesktop.org Bugzilla #49439, Peter Hutterer (peter-hutterer) wrote on 2012-05-14:

#10

http://patchwork.freedesktop.org/patch/10230/

Revision history for this message

In freedesktop.org Bugzilla #49439, Maarten Lankhorst (mlankhorst) wrote on 2012-05-15:

#13

I had that patch as a workaround locally, but since I didn't understand the problem well enough, I didn't want to accept it as real solution.

Revision history for this message

Maarten Lankhorst (mlankhorst) wrote on 2012-05-16:

#11

Ok looks like it should be fixed upstream now.

Since this bug was attached to freedesktop.org I tried rebuilding synaptics locally with the fixes and it seems to fix the corruption I personally was seeing upstream.

Does
http://people.canonical.com/~mlankhorst/synaptics-rebuild/xserver-xorg-input-synaptics_1.5.99.902-0ubuntu5.1+fixes_amd64.deb
or
http://people.canonical.com/~mlankhorst/synaptics-rebuild/xserver-xorg-input-synaptics_1.5.99.902-0ubuntu5.1+fixes_i386.deb

depending on arch fix this specific corruption?

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-05-31:

#12

This bug was fixed in the package xserver-xorg-input-synaptics - 1.6.1-1ubuntu1

---------------
xserver-xorg-input-synaptics (1.6.1-1ubuntu1) quantal; urgency=low

  * Merged from Debian unstable
  * Refreshed patches for indentation changes
    - 101_resolution_detect_option.patch
    - 118_quell_error_msg.patch
    - 124_syndaemon_events.patch
    - 125_option_rec_revert.patch
  * Add temporary patches, for upstream git commits on synaptics-1.6-branch
  * Fix memory corruption by driver (LP: #941953) FDo #49439
   - 201-Avoid-out-of-bounds-access-by-running-num_active_tou.patch
   - 202-Ignore-pre-existing-touches.patch
  * Fix FDo #49966
   - 203-Fix-coasting-for-negative-ScrollDelta.patch
  * Fix jumpy cursor after suspend/resume
   - 204-Reset-open-slots-array-on-device-disable.patch
  * Fix another resume bug
   - 205-Reset-hw-x-y-to-INT_MIN-and-skip-HandleState-until-w.patch
  * Fix division by 0 or infinite loop with zero scroll distance FDo #49965
   - 206-Don-t-allow-for-scroll-distances-of-0-49965.patch
-- Maarten Lankhorst <email address hidden> Mon, 21 May 2012 14:14:49 +0200

Changed in xserver-xorg-input-synaptics (Ubuntu):
status:	Triaged → Fix Released

Revision history for this message

In freedesktop.org Bugzilla #49439, Peter Hutterer (peter-hutterer) wrote on 2012-06-12:

#14

commit 55fc42e7c9b4948cadd4f98ef7b6a3b12e268e3e
Author: Chase Douglas <email address hidden>
Date: Mon May 14 10:20:01 2012 -0700

Ignore pre-existing touches

Bug Watch Updater (bug-watch-updater) on 2012-06-16

Changed in xserver-xorg-input-synaptics:
status:	In Progress → Fix Released

Maarten Lankhorst (mlankhorst) on 2012-06-20

Changed in xserver-xorg-input-synaptics (Ubuntu):
assignee:	Chase Douglas (chasedouglas) → Maarten Lankhorst (mlankhorst)
Changed in xserver-xorg-input-synaptics (Ubuntu Precise):
assignee:	Chase Douglas (chasedouglas) → Maarten Lankhorst (mlankhorst)

Maarten Lankhorst (mlankhorst) on 2012-06-20

description:

updated

Maarten Lankhorst (mlankhorst) on 2012-06-21

Changed in xserver-xorg-input-synaptics (Ubuntu Precise):
status:	Triaged → Fix Released

Brian Murray (brian-murray) on 2012-06-28

Changed in xserver-xorg-input-synaptics (Ubuntu Precise):
status:	Fix Released → In Progress

Revision history for this message

Chris Halse Rogers (raof) wrote on 2012-07-03: Please test proposed package

#15

Hello Scott, or anyone else affected,

Accepted xserver-xorg-input-synaptics into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/xserver-xorg-input-synaptics/1.6.2-1ubuntu1~precise1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in xserver-xorg-input-synaptics (Ubuntu Precise):
status:	In Progress → Fix Committed
tags:	added: verification-needed

Revision history for this message

Maarten Lankhorst (mlankhorst) wrote on 2012-07-03:

#16

Fixes the memory corruption I was seeing in valgrind.

tags:

added: verification-done
removed: verification-needed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-07-09:

#17

Download full text (3.1 KiB)

This bug was fixed in the package xserver-xorg-input-synaptics - 1.6.2-1ubuntu1~precise1

---------------
xserver-xorg-input-synaptics (1.6.2-1ubuntu1~precise1) precise-proposed; urgency=low

  * Fixes memory corruption by driver (LP: #941953) FDo #49439
  * Fixes 'Coasting Direction is incorrect for negative VertScrollDelta/HorizScrollDelta'
  * Fixes jumpy cursor after suspend/resume
  * Fixes another resume bug
  * Fixes division by 0 or infinite loop with zero scroll distance FDo #49965
  * Merged from Debian unstable
  * Removed patches that were cherry picked commits and now in 1.6.2:
    - 201-Avoid-out-of-bounds-access-by-running-num_active_tou.patch
    - 202-Ignore-pre-existing-touches.patch
    - 203-Fix-coasting-for-negative-ScrollDelta.patch
    - 204-Reset-open-slots-array-on-device-disable.patch
    - 205-Reset-hw-x-y-to-INT_MIN-and-skip-HandleState-until-w.patch
    - 206-Don-t-allow-for-scroll-distances-of-0-49965.patch
  * Remaining patches:
    - 101_resolution_detect_option.patch
    - 103_enable_cornertapping.patch
    - 104_always_enable_tapping.patch
    - 106_always_enable_vert_edge_scroll.patch
    - 115_evdev_only.patch
    - 118_quell_error_msg.patch
    - 124_syndaemon_events.patch
    - 125_option_rec_revert.patch
    - 126_ubuntu_xi22.patch
    - 128_disable_three_click_action.patch
    - 129_disable_three_touch_tap.patch
  * Reinstate patch for (LP: #972727) due to feature freeze in precise

xserver-xorg-input-synaptics (1.6.2-1) unstable; urgency=low

* New upstream release, from the 1.6 branch.

xserver-xorg-input-synaptics (1.6.1-1ubuntu2) quantal-proposed; urgency=low

  * Enable right button clickpad area by default (LP: #972727)
    - Upstream has this enabled. We had it disabled for Precise due to the
      feature landing well after feature freeze. This change puts us back in
      sync with upstream.

xserver-xorg-input-synaptics (1.6.1-1ubuntu1) quantal; urgency=low

xserver-xorg-input-synaptics (1.6.1-1) unstable; urgency=low

  [ Julien Cristau ]
  * The mtdev build-dep is linux-only (closes: #672572). Thanks, Pino
    Toscano!

[ Cyril Brulebois ]
* New upstream release, from the 1.6 branch.

xserver-xorg-input-synaptics (1.6.0-1) unstable; urgency=low

* New upstream release.
-- Maarten Lankhorst <email address hidden> Thu, 1...

Duplicates of this bug

Bug #963130

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

freedesktop-bugs #49439
[RESOLVED FIXED] Edit

Bug watches keep track of this bug in other bug trackers.

Changed in xserver-xorg-input-synaptics (Ubuntu Precise):
status:	Fix Committed → Fix Released

Ubuntuxserver-xorg-input-synaptics package

Xorg crashed with SIGSEGV in WriteToClient() with buf = 0x100000000 from ProcXIGetProperty()

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
xserver-xorg-input-synaptics package