gnome-shell crashed with SIGSEGV in meta_gpu_kms_apply_crtc_mode() from meta_renderer_native_finish_frame()

[Ferdinand Prantl]

[ Description ]

GNome shell crashes after Xorg loggin

[ Test case ]

From GDM login in a GNOME Ubuntu session (so Xorg).
It should start with no issues

[ Regression potential ]

We were deferencing a NULL pointer while outputting an error.
This is pretty safe. Although the session might still not run properly as per a driver issue to be addressed in linux package.

---

https://gitlab.gnome.org/GNOME/mutter/issues/70
https://errors.ubuntu.com/problem/16426125ad8d92ae4dc9ce9e89450153b0a8b665

https://salsa.debian.org/gnome-team/mutter/merge_requests/6

---

The crash was reported after booting and logging in to an X.Org session.

$ lsb_release -rd
Description: Ubuntu Bionic Beaver (development branch)
Release: 18.04

$ apt-cache policy gnome-shell
gnome-shell:
  Instalovaná verze: 3.27.92-0ubuntu1
  Kandidát: 3.27.92-0ubuntu1
  Tabulka verzí:
 *** 3.27.92-0ubuntu1 500
        500 http://de.archive.ubuntu.com/ubuntu bionic/main amd64 Packages
        100 /var/lib/dpkg/status

ProblemType: CrashDistroRelease: Ubuntu 18.04
Package: gnome-shell 3.27.92-0ubuntu1
ProcVersionSignature: Ubuntu 4.15.0-10.11-generic 4.15.3
Uname: Linux 4.15.0-10-generic x86_64
NonfreeKernelModules: wl
ApportVersion: 2.20.8-0ubuntu10
Architecture: amd64
CurrentDesktop: GNOME-Greeter:GNOME
Date: Sun Mar 11 11:08:00 2018
DisplayManager: gdm3
ExecutablePath: /usr/bin/gnome-shell
GsettingsChanges:

InstallationDate: Installed on 2017-12-19 (81 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Release amd64 (20171018)
ProcCmdline: /usr/bin/gnome-shell
ProcEnviron:
 LANGUAGE=cs_CZ
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=cs_CZ.UTF-8
 SHELL=/bin/false
SegvAnalysis:
 Segfault happened at: 0x7f3fee5d2f17 <meta_gpu_kms_apply_crtc_mode+215>: mov 0x20(%rax),%rcx
 PC (0x7f3fee5d2f17) ok
 source "0x20(%rax)" (0x00000020) not located in a known VMA region (needed readable region)!
 destination "%rcx" ok
SegvReason: reading NULL VMASignal: 11SourcePackage: gnome-shell
StacktraceTop:
 meta_gpu_kms_apply_crtc_mode () at /usr/lib/x86_64-linux-gnu/libmutter-2.so.0
 meta_renderer_native_finish_frame () at /usr/lib/x86_64-linux-gnu/libmutter-2.so.0
 () at /usr/lib/x86_64-linux-gnu/mutter/libmutter-clutter-2.so
 () at /usr/lib/x86_64-linux-gnu/mutter/libmutter-clutter-2.so
 () at /usr/lib/x86_64-linux-gnu/mutter/libmutter-clutter-2.so
Title: gnome-shell crashed with SIGSEGV in meta_gpu_kms_apply_crtc_mode()
UpgradeStatus: Upgraded to bionic on 2018-03-05 (5 days ago)
UserGroups:

[Apport retracing service (apport)]

StacktraceTop:
 meta_gpu_kms_apply_crtc_mode (gpu_kms=gpu_kms@entry=0x55bbde3ca4b0, crtc=0x7f3fcc053480, x=x@entry=0, y=y@entry=0, fb_id=fb_id@entry=0) at backends/native/meta-gpu-kms.c:143
 meta_renderer_native_finish_frame (renderer_native=0x55bbde3e01f0) at backends/native/meta-renderer-native.c:2848
 clutter_stage_cogl_redraw (stage_window=0x55bbde6b1560) at cogl/clutter-stage-cogl.c:871
 clutter_stage_do_redraw (stage=0x55bbde6b0d20) at clutter-stage.c:1121
 _clutter_stage_do_update (stage=0x55bbde6b0d20) at clutter-stage.c:1236

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Daniel van Vugt (vanvugt)]

The crash occurs on this line of code:

      g_warning ("Failed to set CRTC mode %s: %m", crtc->current_mode->name);

As crtc is not NULL it must be current_mode or name that has an invalid value.

[Daniel van Vugt (vanvugt)]

Upstream bug report:
https://gitlab.gnome.org/GNOME/mutter/issues/70

[Daniel van Vugt (vanvugt)]

Also tracking in https://errors.ubuntu.com/problem/16426125ad8d92ae4dc9ce9e89450153b0a8b665

[Daniel van Vugt (vanvugt)]

Looks similar to:
https://errors.ubuntu.com/problem/b0adc3c02c0ba6f5e7fafd72721ff0050a8a88f4

[Marco Trevisan (Treviño) (3v1n0)]

The driver involved should be also be fixed including this:

https://cgit.freedesktop.org/drm/drm-tip/commit/?id=4751cf733a1170876dd5ac46f225f5a25f59a67f

[Daniel van Vugt (vanvugt)]

Bump. This is the 3rd most common gnome-shell crash right now.

[Daniel van Vugt (vanvugt)]

Temporarily reopening the gnome-shell task, just so people can find the bug. And are less likely to create more duplicates.

[Ferdinand Prantl (prantlf)]

I haven't seen this crash, since I disabled Wayland in /etc/gdm3/custom.conf:

[daemon]
# Uncoment the line below to force the login screen to use Xorg
WaylandEnable=false

[Daniel van Vugt (vanvugt)]

That's correct. Because the "meta_renderer_native" part is Wayland-only :)

[Daniel van Vugt (vanvugt)]

And so is "meta_gpu_kms".

So this is a Wayland-only crash.

[Marco Trevisan (Treviño) (3v1n0)]

Fix is in salsa now, will be in ubuntu at next sync.

[Launchpad Janitor (janitor)]

This bug was fixed in the package mutter - 3.28.3-2

---------------
mutter (3.28.3-2) unstable; urgency=medium

  * Team upload

  [ Iain Lane ]
  * debian/gbp.conf: Set the upstream branch to upstream/3.28.x, since we've
    branched for experimental now.

  [ Marco Trevisan (Treviño) ]
  * d/p/native-gpu-Handle-drmModeSetCrtc-failing-gracefully.patch:
    - Avoid crashing when warning about wrongly set crtc mode
      (LP: #1754949)
  * d/p/gpu-kms-Don-t-crash-if-drmModeGetResources-returns-N.patch:
    - Don't crash if drmModeGetResources returns NULL (LP: #1767956)
  * d/p/window-wayland-Always-update-monitor-for-non-user-ops.patch:
    - Always update monitor in wayland, avoiding crash (LP: #1784398)
  * d/p/monitor-manager-Filter-out-low-screen-resolutions.patch:
    - Don't return screen resolutions that can't be applied (LP: #1772831)
  * d/p/window-Don-t-refuse-to-move-focus-to-the-grab-window.patch,
    d/p/window-Explicitly-exclude-unmanaging-window-from-focus-ag.patch:
    - Don't crash if a modal dialog closes while being dragged
      (LP: #1422253)
  * d/p/monitor-Use-current-monitor-mode-to-check-whether-active.patch:
    - Don't try to use an invalid monitor mode to figure out scaling
      (LP: #1723615)

  [ Simon McVittie ]
  * Sort patch series in upstream order, with patches applied upstream
    first
  * d/copyright: Remove obsolete FSF postal addresses
  * Standards-Version: 4.1.5 (no changes required)
  * Set Rules-Requires-Root to no
  * Update symbols file

 -- Simon McVittie <email address hidden> Tue, 31 Jul 2018 15:35:03 +0100

[Alberto Milone (albertomilone)]

The drm_mode_get_hv_timing() function (used in the required kernel commit) depends on a non trivial amount of other changes, and I don't think a backport would be easy, or safe. That commit will be available in Linux 4.17, though, so we are going to get the fix in Ubuntu 18.10.

[Łukasz Zemczak (sil2100)]

Hello Ferdinand, or anyone else affected,

Accepted mutter into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/mutter/3.28.3-2~ubuntu18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Launchpad Janitor (janitor)]

This bug was fixed in the package mutter - 3.28.3-2~ubuntu18.04.1

---------------
mutter (3.28.3-2~ubuntu18.04.1) bionic; urgency=medium

  * No-change backport from unstable to bionic

mutter (3.28.3-2) unstable; urgency=medium

  * Team upload

  [ Iain Lane ]
  * debian/gbp.conf: Set the upstream branch to upstream/3.28.x, since we've
    branched for experimental now.

  [ Marco Trevisan (Treviño) ]
  * d/p/native-gpu-Handle-drmModeSetCrtc-failing-gracefully.patch:
    - Avoid crashing when warning about wrongly set crtc mode
      (LP: #1754949)
  * d/p/gpu-kms-Don-t-crash-if-drmModeGetResources-returns-N.patch:
    - Don't crash if drmModeGetResources returns NULL (LP: #1767956)
  * d/p/window-wayland-Always-update-monitor-for-non-user-ops.patch:
    - Always update monitor in wayland, avoiding crash (LP: #1784398)
  * d/p/monitor-manager-Filter-out-low-screen-resolutions.patch:
    - Don't return screen resolutions that can't be applied (LP: #1772831)
  * d/p/window-Don-t-refuse-to-move-focus-to-the-grab-window.patch,
    d/p/window-Explicitly-exclude-unmanaging-window-from-focus-ag.patch:
    - Don't crash if a modal dialog closes while being dragged
      (LP: #1422253)
  * d/p/monitor-Use-current-monitor-mode-to-check-whether-active.patch:
    - Don't try to use an invalid monitor mode to figure out scaling
      (LP: #1723615)

  [ Simon McVittie ]
  * Sort patch series in upstream order, with patches applied upstream
    first
  * d/copyright: Remove obsolete FSF postal addresses
  * Standards-Version: 4.1.5 (no changes required)
  * Set Rules-Requires-Root to no
  * Update symbols file

mutter (3.28.3-1~ubuntu18.04.1) bionic; urgency=medium

  * No-change backport to bionic (LP: #1783311)

mutter (3.28.3-1) unstable; urgency=medium

  * New upstream release
  * d/p/backends-Add-logical-monitor-monitor-output-crtc-ref-chai.patch,
    d/p/backends-Move-MetaOutput-crtc-field-into-private-struct.patch,
    d/p/clutter-device-evdev-Get-devices-from-main-seat-if-no-rea.patch,
    d/p/clutter-evdev-Don-t-ignore-CAPS-lock-as-modifier.patch,
    d/p/clutter-evdev-ignore-injected-events-from-IM.patch,
    d/p/clutter-seat-evdev-Add-function-to-get-device-by-id.patch,
    d/p/device-manager-evdev-Add-main-seat-to-seats-by-default.patch,
    d/p/device-manager-evdev-Free-the-main-seat-on-finalize.patch,
    d/p/device-manager-evdev-Set-and-unset-the-stage-for-the-main.patch,
    d/p/frames-Allow-for-unknown-mouse-buttons.patch,
    d/p/frames-Handle-touch-events.patch,
    d/p/frames-Make-1st-button-motion-handlers-take-generic-event.patch,
    d/p/renderer-native-Don-t-crash-if-the-FB-surface-can-t-be-lo.patch,
    d/p/wayland-Compare-geometries-after-chaining-up.patch,
    d/p/wayland-Don-t-reset-input-focus-on-text-commit.patch,
    d/p/wayland-Use-cursor-position-in-logical-monitor.patch,
    d/p/wayland-update-enter-leave-output-after-effects.patch,
    d/p/window-actor-add-new-signal-effects-completed.patch:
    Remove patches already applied on 3.28 branch

 -- Marco Trevisan (Treviño) <email address hidden> Fri, 03 Aug 2018 05:20:10 +0100