plymouthd crashed with SIGSEGV in ply_event_loop_process_pending_events()

[j0sh]

Binary package hint: plymouth

just upgraded to lucid, first reboot tried to start accounts

ProblemType: Crash
DistroRelease: Ubuntu 10.04
Package: plymouth 0.8.1-4
ProcVersionSignature: Ubuntu 2.6.32-19.28-generic 2.6.32.10+drm33.1
Uname: Linux 2.6.32-19-generic i686
NonfreeKernelModules: wl
Architecture: i386
Date: Thu Apr 1 22:14:11 2010
DefaultPlymouth: /lib/plymouth/themes/kubuntu-logo/kubuntu-logo.plymouth
ExecutablePath: /sbin/plymouthd
MachineType: Dell Inc. Inspiron 1545
ProcCmdLine: root=UUID=73530dc8-e3cc-4147-b801-4725b2f88141 ro quiet splash vga=792
ProcCmdline: /sbin/plymouthd --mode=boot --attach-to-session
ProcEnviron: PATH=(custom, no user)
ProcFB: 0 inteldrmfb
SegvAnalysis:
 Segfault happened at: 0xfb5fe1 <ply_event_loop_process_pending_events+513>: test %eax,0x4(%esi)
 PC (0x00fb5fe1) ok
 source "%eax" ok
 destination "0x4(%esi)" (0x00000004) not located in a known VMA region (needed writable region)!
SegvReason: writing NULL VMA
Signal: 11
SourcePackage: plymouth
StacktraceTop:
 ply_event_loop_process_pending_events ()
 ply_event_loop_run () from /lib/libply.so.2
 ?? ()
 __libc_start_main () from /lib/tls/i686/cmov/libc.so.6
 ?? ()
TextPlymouth: /lib/plymouth/themes/ubuntu-text/ubuntu-text.plymouth
Title: plymouthd crashed with SIGSEGV in ply_event_loop_process_pending_events()
UserGroups:

dmi.bios.date: 07/17/2009
dmi.bios.vendor: Dell Inc.
dmi.bios.version: A10
dmi.board.name: 0G848F
dmi.board.vendor: Dell Inc.
dmi.chassis.type: 8
dmi.chassis.vendor: Dell Inc.
dmi.modalias: dmi:bvnDellInc.:bvrA10:bd07/17/2009:svnDellInc.:pnInspiron1545:pvr:rvnDellInc.:rn0G848F:rvr:cvnDellInc.:ct8:cvr:
dmi.product.name: Inspiron 1545
dmi.sys.vendor: Dell Inc.

[Apport retracing service (apport)]

StacktraceTop:
 ply_event_loop_process_pending_events (
 ply_event_loop_run (loop=0x90280a8) at ply-event-loop.c:1312
 main (argc=3, argv=0xbfeba124) at main.c:1916

[xteejx (xteejx-deactivatedaccount)]

This seemed to happen randomly for me, but didn't appear to affect system stability.

[swests (simon-thewests)]

I only seem to get this when I use the new nouveau driver. If I use the Nvidia (Current version) driver I don't seem to get the problem.

[NeilGreenwood (neil-greenwood)]

I don't have a Nvidia graphics card in the laptop where I saw this crash.

lspci shows:
Intel Corporation Mobile 945GM/GMS, 943/940GML Express Integrated Graphics Controller [8086:27a2]

[Martin Pitt (pitti)]

For the record, I get this crash on a Dell Mini 10, with Intel 945.

[xteejx (xteejx-deactivatedaccount)]

Compaq Presario CQ50 laptop Geforce 8200M here.

[xteejx (xteejx-deactivatedaccount)]

Using (current) nvidia driver as well, missed that out. Doesn't look like a graphics driver issue.

[Mark Cariaga (mzc)]

@Martin Pitt: I have an AOD250 and HP mini 110-1116NR, both exhibit the
bug.

On Wed, 2010-04-07 at 20:15 +0000, Martin Pitt wrote:
> For the record, I get this crash on a Dell Mini 10, with Intel 945.
>

[Mark Cariaga (mzc)]

@Martin Pitt: I have an AOD250 and a HP mini 110-1116NR both exhibit
the same bug

On Wed, 2010-04-07 at 20:15 +0000, Martin Pitt wrote:
> For the record, I get this crash on a Dell Mini 10, with Intel 945.
>

[Martin Spacek (mspacek)]

I got this on my Thinkpad W510, quite randomly soon after bootup. It's only happened once so far. I'm running the latest 64 bit lucid, with the latest nvidia binary drivers.

[Ruben Verweij (ruben-verweij)]

Also see this with dual monitors using nouveau on a nVidia Corporation NV44A [GeForce 6200] (rev a1).

[Alessandro Losavio (alo21)]

when i want to update my system there was this bug

[Yann (lostec)]

I had this bug, running pae kernel in a VirtualBox VM: Disk check was running and freezed at this moment...

syslog output around crash:

****

Apr 8 16:15:53 yann-laptop NetworkManager: <info> Activation (eth0) Stage 5 of 5 (IP Configure Commit) scheduled...
Apr 8 16:15:53 yann-laptop NetworkManager: <info> Activation (eth0) Stage 4 of 5 (IP4 Configure Get) complete.
Apr 8 16:15:53 yann-laptop NetworkManager: <info> Activation (eth0) Stage 5 of 5 (IP Configure Commit) started...
Apr 8 16:15:53 yann-laptop avahi-daemon[547]: Joining mDNS multicast group on interface eth0.IPv4 with address 10.0.2.15.
Apr 8 16:15:53 yann-laptop avahi-daemon[547]: New relevant interface eth0.IPv4 for mDNS.
Apr 8 16:15:53 yann-laptop avahi-daemon[547]: Registering new address record for 10.0.2.15 on eth0.IPv4.
Apr 8 16:15:53 yann-laptop dhclient: bound to 10.0.2.15 -- renewal in 33102 seconds.
Apr 8 16:15:53 yann-laptop kernel: [ 44.457002] vboxguest: exports duplicate symbol RTMemExecFree (owned by vboxdrv)
Apr 8 16:15:54 yann-laptop NetworkManager: <info> (eth0): device state change: 7 -> 8 (reason 0)
Apr 8 16:15:54 yann-laptop NetworkManager: <info> Policy set 'Auto eth0' (eth0) as default for routing and DNS.
Apr 8 16:15:54 yann-laptop NetworkManager: <info> Activation (eth0) successful, device activated.
Apr 8 16:15:54 yann-laptop NetworkManager: <info> Activation (eth0) Stage 5 of 5 (IP Configure Commit) complete.
Apr 8 14:15:57 yann-laptop ntpdate[901]: step time server 91.189.94.4 offset -7198.369434 sec
Apr 8 14:16:01 yann-laptop kernel: [ 51.051506] eth0: no IPv6 routers present
Apr 8 14:17:01 yann-laptop CRON[952]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
Apr 8 17:44:21 yann-laptop kernel: imklog 4.2.0, log source = /proc/kmsg started.
Apr 8 17:44:21 yann-laptop rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="514" x-info="http://www.rsyslog.com"] (re)start
Apr 8 17:44:21 yann-laptop rsyslogd: rsyslogd's groupid changed to 103
Apr 8 17:44:21 yann-laptop rsyslogd: rsyslogd's userid changed to 101
Apr 8 17:44:21 yann-laptop rsyslogd-2039: Could no open output file '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
Apr 8 17:44:21 yann-laptop kernel: [ 0.000000] Initializing cgroup subsys cpuset
Apr 8 17:44:21 yann-laptop kernel: [ 0.000000] Initializing cgroup subsys cpu
Apr 8 17:44:21 yann-laptop kernel: [ 0.000000] Linux version 2.6.32-19-generic-pae (buildd@palmer) (gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5) ) #28-Ubu
ntu SMP Wed Mar 31 18:57:46 UTC 2010 (Ubuntu 2.6.32-19.28-generic-pae 2.6.32.10+drm33.1)
(...)
Apr 8 17:44:23 yann-laptop cron[710]: (CRON) STARTUP (fork ok)
Apr 8 17:44:23 yann-laptop anacron[706]: Will run job `cron.daily' in 5 min.
Apr 8 17:44:23 yann-laptop anacron[706]: Jobs will be executed sequentially
Apr 8 17:44:24 yann-laptop acpid: 39 rules loaded
Apr 8 17:44:24 yann-laptop acpid: waiting for events: event logging is off
Apr 8 17:44:24 yann-laptop cron[710]: (CRON) INFO (Running @reboot jobs)
Apr 8 17:44:25 yann-laptop kernel: [ 30.573175] vboxdrv: Trying to deactivate the NMI watchdog permanently...
Apr 8 17:44:25 yann-laptop kernel: [ 30....

[Guy Taylor (thebiggerguy)]

Running under VMware Workstation 6.5.3 build-185404c with VMware tools installed I get the same error.
Here is my log

Apr 8 22:50:50 Guy-dev tpvmlpd[2038]: device type not supported
Apr 8 22:50:50 Guy-dev init: plymouth-stop pre-start process (2115) terminated with status 1
Apr 8 22:50:53 Guy-dev kernel: [ 15.648161] eth0: no IPv6 routers present

/proc/version: Linux version 2.6.32-19-generic-pae (buildd@palmer) (gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5) ) #28-Ubuntu SMP Wed Mar 31 18:57:46 UTC 2010

[Mark Cariaga (mzc)]

The bug is still present on Beta2!

[Simon (simon-west-family)]

Acer 5810T was running disk check an d froze at 75%, no disk activity. Reboot brought it back to life.

[timuckun (timuckun)]

Asus k42Jr. ATI mobility Radeon 5470

[Riccardo Padovani (rpadovani)]

Dell inspirion 6000 , Ati Mobility Radeon X300

[justy55555 (justy55555)]

Acer Aspire One AOD250, Intel GMA 950

[Kai Vogel (kai-vogel)]

GeForce 7300 GS with NVidia's "Current" Driver

No more crashes afte I've reseted all profiles in "ccsm" and activated the basic profile in "simple-ccsm".

Notice: I've also reinstalled virtualbox-ose, but I'm not sure if this causes the crashes...

Hope this helps...

[HugoHirsch (ubuntubugs-aiki-it)]

+1
Lenovo S10e
00:02.1 Display controller: Intel Corporation Mobile 945GM/GMS/GME, 943/940GML Express Integrated Graphics Controller (rev 03)

[Sonsum (scottonsum)]

Samsung N120. Pretty sure its an Intel GMA 950

[cyberb764 (rmills764)]

Doesn't anyone know why ub untuone cannot be manually configured to work? It works fine on my other computer, even after upgrading it.

[cyberb764 (rmills764)]

still not able to change a configuration that does'nt exist in the folder it is suppose to be.

[cyberb764 (rmills764)]

I am alm ost going to give up on it.

[Adrian Wilkins (adrian-wilkins)]

This occurred for me during a disk check (at 73% if that has any relevance...).

[michael barany (michael-barany)]

Asus EEE 1000, Intel video card; I've had Plymouth hang on disk checks at 70% and 73% (never visibly complete one successfully), and the disk check screen has been the only time I've seen the start-up splash screen for more than a moment (though usually doesn't appear at all). Once everything's booted, though, seems fine. Might also be relevant that the SSD memory in the computer is split into two drives, which I've set respectively to root and /home.

[Son (son.caokim)]

acer asprire one - AOA110

[xteejx (xteejx-deactivatedaccount)]

cyberb764, this bug report has absolutely nothing to do with Ubuntu One. If you are having problems with it, ask in #ubuntu on irc.freenode.net for support questions, or if it is a bug, file one with ubuntu-bug.

[Laurie (welcome)]

Problem occurred when sending an e-mail using claws-mail. It did not stop the e-mail being sent or have any obvious harmful effects.

[Noel Arzola (noel.arzola)]

dell dimension 2350 lucid beta 2 this was at random

[Noel Arzola (noel.arzola)]

Occured right on boot just now, after a reboot. Not seeing anything other than it reporting the crash. Desktop and everything appears to load without issue. Crash icon shows up.

[Polemaker1 (polemaker1)]

Same problem with an Acer Aspire One AOA150

[Martin Karpinski (mkarpinski)]

I had this happen in Lucid beta 2 amd64 (virtualised) when I opened up the language support menu.

[hatzigia (hatzigia)]

Same problem trying to install support for greek language after I opened up the language support menu

[André Lucas (andre.lucas)]

Got this on my HP Mini 210. I have a blank screen as the system boots, with a flashing text-mode cursor, and I get the crash report on logging in.

[Odin Hørthe Omdal (velmont)]

There is just so much crashing with Lucid Lynx :-(((((((

I get a crash every 1-2 hours. The intel 845-issue.

The boot took LONG time today, so I thought it'd hang and shut it of. Turns out (I think) that it was doing ureadahead-logging or something. After that the display didn't work, so I had to SSH in and run dpkg --configure -a to fix it. (also did dpkg-reconfigure linux-image-generic plymouth ureadahead, and deleted all the ureadahead-files).

[dino99 (9d9)]

apport information

[dino99 (9d9)]

apport information

[dino99 (9d9)]

apport information

[dino99 (9d9)]

apport information

[dino99 (9d9)]

apport information

[dino99 (9d9)]

seems to be fixed now on Oneiric i386 b1, does not get that crash since a few days now

[Brian Murray (brian-murray)]

Recent versions of this crash are still appearing in bug 849414 and its duplicates.

[Steve Langasek (vorlon)]

These crash reports are caused by a bug in plymouth, the boot-time splash screen. Sometimes the errors are not reported for quite a while after the crash actually happens.

If someone here is able to reproduce this bug reliably, please do the following:
 - edit /etc/default/grub so that GRUB_CMDLINE_LINUX_DEFAULT is set to "quiet splash plymouth:debug"
 - run sudo update-grub
 - reboot, and when you receive the prompt asking whether to report a crash about plymouthd, say "yes"
 - attach /var/log/plymouth-debug.log to the new bug report

[Bruce Pieterse (octoquad)]

Steve,

I did not get the error message again, however after enabling debugging for plymouth I noticed a few files missing like x11.so on line 100, double slashes in path names and plymouthd.conf not existing.

See attached file.

[Steve Langasek (vorlon)]

Hi Bruce,

On Wed, Sep 21, 2011 at 08:53:11PM -0000, Bruce Pieterse wrote:
> I did not get the error message again, however after enabling debugging
> for plymouth I noticed a few files missing like x11.so on line 100,
> double slashes in path names and plymouthd.conf not existing.

These are all expected behavior and not related to this bug. I need a
plymouth debug log that corresponds to an actual crash in order to make
progress here.

--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
<email address hidden> <email address hidden>

[Bruce Pieterse (octoquad)]

Ok,

Well, I'll leave plymouth debugging on just in case the error does crop up again. I'm currently using 11.10 Beta 1.

[Jared (jared-vanvolkenburg)]

I just received this crash after a reboot. I am using 11.10 beta 2 about 30 seconds after logging into unity.

[Jared (jared-vanvolkenburg)]

Sorry for the mis-edit of my comment should read:

I just received this crash after a reboot about 30 seconds after logging into unity.
I am using 11.10 beta 2 .

I have not had coffee yet this morning.

[Adam-cowan (adam-cowan)]

This bug is also affecting me on 11.10 beta 2 with all the current updates.

[Steve Langasek (vorlon)]

This bug (and other similar crasher bugs like it) is known to affect a large number of users, but inconveniently the developers are not able to reproduce the bug - which means we can't fix it.

If this crash happens consistently for you, please add the option 'plymouth:debug=file:/var/log/plymouth-debug.log' to your boot settings, and the next time you see this crash, please report it as a new bug with apport and attach the /var/log/plymouth-debug.log file to the report.

[James Hunt (jamesodhunt)]

If anyone is getting this issue, please help us by obtaining the plymouth debug log.

Note that most updates on this issue are now being added to bug 849414.

[Jānis Kangarooo (kangarooo)]

Heres with splash plymouth:debug
and without crash. cant get crash anymore with this line added but got this file.

[iGadget (igadget)]

Just got this after booting a freshly installed and updated 12.04 alpha 2. Amazing it seems to be present for so many releases but still remains unfixed. If it happens again I'll dive deeper into all the comments above.

[Jānis Kangarooo (kangarooo)]

Where actually is the problem?
Its that this problem comes up. Nothing crashes actually but it just comes up.
Make this bug disable to show up:
1.) Add this bug ignorance
2.) Remove plymouth

[Ewano (i-launchpad-ewano-net)]

FWIW:

HP ze2000 laptop: Fresh install of 12.04 beta using the mini.iso - non PAE. Installed fine, then installed LXDE. Upon login to LXDE I get this error.

I can gather logs and sys info if required.

[jerrylamos (jerrylamos)]

Booted up, idle, and this crash occurred.

Jerry

[Ernesto Celis (celisdelafuente)]

Same problem as others, after fresh boot and loging into my user account, the crash dialog pops up. HP Pavillion dv4 64bit Ubuntu 12.04 amd64 beta up to date March 25 2012. I can give you any other information that can help to solve this, its not a big issue but anoying.

[Martin Wildam (mwildam)]

Through different versions of Ubuntu I see SIGSEGV related errors
coming and going. And I have the impression, they always start if I
begin to install different desktop environments on the same machine to
make every user choose his prefered one. Mostly I see them on my
testing machines where I install basically all available Desktop
environments. Not sure if that idea helps.

--
Martin Wildam

http://martin.wildam.org/

[James Hunt (jamesodhunt)]

At long last, I can now recreate this problem at will.

Although I haven't debugged the actual cause yet (and hence don't yet have a fix), it is triggered when the following occur "very close together":

    plymouth show-splash
    plymouth quit

Note that the problem can occur on boot (where plymouthd is run with '--mode=boot') and shutdown (where plymouthd is run with '--mode=shutdown').

For those interested, to recreate the problem:

# in 1 window...
$ sudo apt-get install plymouth-x11
$ ./test_plymouth.sh -s /sbin/plymouthd

# in another window
$ ./force_crash.sh

After a few seconds, a crash will occur.

test_plymouth.sh and force_crash.sh are available here:

  http://people.canonical.com/~jhunt/plymouth/

What I can see currently is that objects are being corrupted and a repeating pattern appears to be timeout/pending calls.

Further investigation is required, but atleast once we have a fix available, we now have a way to test it.

[James Hunt (jamesodhunt)]

One other point to note - this problem only seems to occur if using the "script" splash plugin (which Ubuntu uses).

[devtry (devtry)]

I'm using an up to date Ubuntu 12.04.

Ubuntu automatically raised a bug report with the same title ("plymouthd crashed with SIGSEGV in ply_event_loop_process_pending_events()") while I was going to print a pdf file to pdf.

Hope this helps!

[Francesco Muriana (f-muriana)]

This happened to me today on startup, ubuntu 12.04 x86

[Launchpad Janitor (janitor)]

This bug was fixed in the package plymouth - 0.8.2-2ubuntu30

---------------
plymouth (0.8.2-2ubuntu30) precise; urgency=low

  [ Philip Muškovac ]
  * debian/patches/kubuntu-text.patch:
    Change kubuntu-text theme to new grey (LP: #979824)

  [ James Hunt ]
  * Temporary work-around that minimizes chance of referencing invalid
    sources (LP: #553745).
 -- James Hunt <email address hidden> Fri, 13 Apr 2012 15:11:36 +0100

[Adolfo Jayme Barrientos (fitojb)]

Maverick has reached end of life, so invalidating

[James Hunt (jamesodhunt)]

I think I've worked out what is going on here (and which caused me to
raise the erroneous bug 42285):

In ply_event_loop_process_pending_events(),
ply_event_loop_handle_timeouts() is being called *after* epoll_wait(),
but ply_event_loop_handle_timeouts() may free event sources.

I can reliabily force plymouthd to SIGSEGV (in various parts of the
code) by running the following:

  plymouth show-splash
  plymouth quit

I'm seeing epoll_wait() return with a single valid fd event.
ply_event_loop_handle_timeouts() then runs, and calls
main.c:on_boot_splash_idle(). This causes the event source object
referred to in the epoll_wait() event set to be freed and its reference
count set to zero. After ply_event_loop_handle_timeouts() finishes, the
now invalid source object pointed to by the epoll event data is
referenced (it now has a reference_count of 1), and the invalid event is
now processed with varying SIGSEGV scenarios ensuing.

Currently ply_event_loop_process_pending_events() can be summarized as:

1. get events.
2. handle timeouts.
3. reference event sources.
4. process events.
5. unreference event sources.

The attached patch changes this slightly to be effectively:

1. get events.
2. reference event sources.
3. handle timeouts.
4. process events.
5. unreference event sources.

[James Hunt (jamesodhunt)]

Created attachment 60179
reference event sources before calling timeout handler to ensure events stay valid for loop iteration.

If ply_event_loop_handle_timeouts() is called before the events returned
by epoll_wait() are referenced, a timeout handler can free an event
source leading to undefined behaviour (and frequently SIGSEGV crashes)
once ply_event_loop_handle_timeouts() has finished since
ply_event_loop_process_pending_events() continues to try and process the
now invalid event sources. Thanks to cjwatson for a simpler solution to
my original fix.

Save errno values to ensure logic is robust in case handler makes
system call.

[James Hunt (jamesodhunt)]

We now belive we understand the whole problem. A patch has been submitted upstream - see https://bugs.freedesktop.org/show_bug.cgi?id=28548

[Rstrode (rstrode)]

Hi,

(In reply to comment #2)
> I think I've worked out what is going on here (and which caused me to
> raise the erroneous bug 42285):
great!

> In ply_event_loop_process_pending_events(),
> ply_event_loop_handle_timeouts() is being called *after* epoll_wait(),
> but ply_event_loop_handle_timeouts() may free event sources.
ah ha. So to be a little more specific, a timeout callback may call ply_event_loop_stop_watching_fd and if that fd became ready at the same time as the callback then crash would result.

> I can reliabily force plymouthd to SIGSEGV (in various parts of the
> code) by running the following:
>
> plymouth show-splash
> plymouth quit
In this case plymouth quit queues a callback to get called after the animation gets to an idle state, on_boot_splash_idle calls functions that ultimately stops watching the terminal fd. if that callback happens in the same iteration of the loop that the terminal fd becomes ready, then boom. Makes sense. Thanks for figuring this out.

[Rstrode (rstrode)]

Comment on attachment 60179
reference event sources before calling timeout handler to ensure events stay valid for loop iteration.

Review of attachment 60179:
-----------------------------------------------------------------

::: src/libply/ply-event-loop.c
@@ +1296,5 @@
> + {
> + ply_event_source_t *source;
> + source = (ply_event_source_t *) (events[i].data.ptr);
> +
> + ply_event_source_take_reference (source);

we can't just take the reference inside the loop, since the loop may get called repeatedly because of EINTR. We could explicitly check for EINTR and not take the reference in that case, I guess. We do need to ensure events don't get dispatched after they are no longer being watched, but I think we should still be okay. The source is going to stick around, now, but the destination will still get free'd at stop_watching_fd time, so the source will in effect be orphaned and harmless.

[Rstrode (rstrode)]

Alright, pushed with minor changes:

http://cgit.freedesktop.org/plymouth/commit/?id=16c7b306b34839d95a05f246f2184a7aab03b180

Thanks for tracking this down!

[James Hunt (jamesodhunt)]

The full fix has now been accepted and committed upstream.

[Matthew (justapawn)]

I'm experiencing this bug using 12.10 Quantal Quetzal.

When I try to do "also affects project" it will let me add "quantal-backports" but not "Quantal", and that doesn't seem right. (Is it?)
So I don't know what to do.
Thanks for your help.

[Glenn J. Schworak (glenn-schworak)]

I am experiencing this problem using 13.04.

[Mo Z (zmau1962)]

Funny Story :

I had this bug infinite number of times. I was not able to work at all. The system would get to log-in window and crash after a few seconds. Once I was able to work a whole minuet before restart.....

In the following link I saw a comment which told me that this is a consequence of a race between two drivers https://bugs.freedesktop.org/show_bug.cgi?id=48894

So, I pulled out the Ethernet cable, and the problem disappeared. After the system is UP, I can re-connect the Ethernet, and there is no problem.....

More information : I am working with Ubuntu 12.04 on an Ivy Bridge machine....