Firefox crashes Xorg completely with a segmentation fault

[hexeb]

Binary package hint: xorg

Hello,

I am using a fresh Lucid on a Toshiba Sat. 2410-404. Xorg crashes completely when the noscript (a Firefox addon) icon is clicked in Firefox.

I have no problem with Firefox crashing itself, bugs happen. However Firefox causes Xorg to crash and that touches kernel space in to many ways and a segmentation fault is always a security risk.

Steps to reproduce:
1. Open Firefox with the noscript add-on active
2. Open the Website www.preisbock.de or the launchpad.net register site itself ;)
3. Click the noscript icon to active execution of javascript
4. Voila: Xorg crashes, briefly shows a console for less than 1sec and Xorg restarts, then shows a gdm login on a VT incremented by one (VT7 is usually where Xorg sits, so after the first crash it's on VT8)

The crash does not happen when noscript is not active in Firefox. But that's just the way I found to crash Xorg. Surely other programs can crash Xorg with the same bug.

Backtrace:
0: /usr/bin/X (xorg_backtrace+0x3b) [0x80e937b]
1: /usr/bin/X (0x8048000+0x61c7d) [0x80a9c7d]
2: (vdso) (__kernel_rt_sigreturn+0x0) [0x591410]
3: /usr/lib/xorg/modules/libexa.so (0x5a5000+0x9490) [0x5ae490]
4: /usr/lib/xorg/modules/libexa.so (0x5a5000+0x9558) [0x5ae558]
5: /usr/bin/X (miCopyRegion+0x21b) [0x819cadb]
6: /usr/bin/X (miDoCopy+0x44d) [0x819cffd]
7: /usr/lib/xorg/modules/libexa.so (0x5a5000+0x7a4a) [0x5aca4a]
8: /usr/bin/X (0x8048000+0xda9c3) [0x81229c3]
9: /usr/bin/X (0x8048000+0x28df5) [0x8070df5]
10: /usr/bin/X (0x8048000+0x2a477) [0x8072477]
11: /usr/bin/X (0x8048000+0x1ed7a) [0x8066d7a]
12: /lib/tls/i686/cmov/libc.so.6 (__libc_start_main+0xe6) [0x1bfbd6]
13: /usr/bin/X (0x8048000+0x1e961) [0x8066961]
Segmentation fault at address (nil)

Caught signal 11 (Segmentation fault). Server aborting

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: xorg 1:7.5+5ubuntu1
ProcVersionSignature: Ubuntu 2.6.32-22.33-generic 2.6.32.11+drm33.2
Uname: Linux 2.6.32-22-generic i686
Architecture: i386
Date: Mon May 10 16:18:37 2010
DkmsStatus: Error: [Errno 2] No such file or directory
InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release i386 (20100427.1)
Lsusb:
 Bus 002 Device 002: ID 046d:c050 Logitech, Inc. RX 250 Optical Mouse
 Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
 Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
MachineType: TOSHIBA Satellite 2410
PccardctlIdent:
 Socket 0:
   no product info available
 Socket 1:
   no product info available
PccardctlStatus:
 Socket 0:
   no card
 Socket 1:
   no card
ProcCmdLine: BOOT_IMAGE=/vmlinuz-2.6.32-22-generic root=UUID=234b98bd-8f1f-43db-b88f-ad0b13cb7713 ro quiet splash
ProcEnviron:
 PATH=(custom, user)
 LANG=de_DE.utf8
 SHELL=/bin/bash
SourcePackage: xorg
dmi.bios.date: 10/07/2002
dmi.bios.vendor: TOSHIBA
dmi.bios.version: Version 1.20
dmi.board.name: Portable PC
dmi.board.vendor: TOSHIBA
dmi.board.version: Version A0
dmi.chassis.asset.tag: 0000000000
dmi.chassis.type: 10
dmi.chassis.vendor: TOSHIBA
dmi.chassis.version: Version 1.0
dmi.modalias: dmi:bvnTOSHIBA:bvrVersion1.20:bd10/07/2002:svnTOSHIBA:pnSatellite2410:pvrPS241E-60PEK-GR:rvnTOSHIBA:rnPortablePC:rvrVersionA0:cvnTOSHIBA:ct10:cvrVersion1.0:
dmi.product.name: Satellite 2410
dmi.product.version: PS241E-60PEK-GR
dmi.sys.vendor: TOSHIBA
system:
 distro: Ubuntu
 codename: lucid
 architecture: i686
 kernel: 2.6.32-22-generic

[hexeb (britta-dietz)]

Yes, and typing something in the firefox google search bar (which is *not* an add-on at all) also sometimes crashes Xorg completely.

[Felix Krohn (felix-kro)]

hint: see #539772 for more infos.