Xorg crashed with SIGSEGV in XIGetDeviceProperty()

[Jonatan Høy Sørensen]

[Impact]

Causes crashes in the xserver usually on resume from suspend.

[Test Case]

- Put one or more fingers to the touchpad
- Send the computer to standby, or disable the pad using 'xinput disable' with the finger(s) still on the pad
- Remove the fingers
- Resume the computer or enable the touchpad again using 'xinput enable'
- Touch the pad again

[Regression Potential]

none, the patch resets a counter on device reset that should be zero at that point

--
Crash on resume in xserver-xorg-input-synaptics. Version 1.5.99.902-0ubuntu5 works, the workaround is to downgrade to that version.

It appears to hit many newer laptops causing data loss.

Original description

Happens quite often, but I can't find a pattern to when it happens.

Might be related to either firefox or Minecraft (openjdk-6) but I am not certain.

#10 <signal handler called>
No symbol table info available.
#11 XIGetDeviceProperty (dev=0xb9238788, property=277, value=0xbffa7cdc) at ../../Xi/xiproperty.c:852
        handler = <optimized out>
        prop = 0xb923c8d8
        rc = <optimized out>
#12 0xb7667797 in get_property (dev=<optimized out>, property=277, type=19, offset=0, length=1, bytes_after=0xbffa7d84, type_return=0xbffa7d8c, format=0xbffa7d7c, nitems=0xbffa7d80, length_return=0xbffa7d78, data=0xbffa7d88, delete=<optimized out>, client=<optimized out>) at ../../Xi/xiproperty.c:290
        n = <optimized out>
        len = <optimized out>
        ind = <optimized out>
        rc = <optimized out>
        prop = <optimized out>
        prop_value = <optimized out>

ProblemType: Crash
DistroRelease: Ubuntu 12.04
Package: xserver-xorg-core 2:1.11.4-0ubuntu6
ProcVersionSignature: Ubuntu 3.2.0-18.29-generic-pae 3.2.9
Uname: Linux 3.2.0-18-generic-pae i686
.tmp.unity.support.test.0:

ApportVersion: 1.94.1-0ubuntu2
Architecture: i386
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CompositorRunning: compiz
Date: Thu Mar 15 08:30:43 2012
DistUpgraded: Fresh install
DistroCodename: precise
DistroVariant: ubuntu
ExecutablePath: /usr/bin/Xorg
ExtraDebuggingInterest: Yes, whatever it takes to get this fixed in Ubuntu
GraphicsCard:
 Intel Corporation Core Processor Integrated Graphics Controller [8086:0046] (rev 02) (prog-if 00 [VGA controller])
   Subsystem: Lenovo Device [17aa:21c5]
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha i386 (20120304)
MachineType: LENOVO 02173BG
ProcCmdline: /usr/bin/X :0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch -background none
ProcEnviron:

ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-3.2.0-18-generic-pae root=UUID=f58bc641-2db1-4b1d-a839-3b04dc4e9ee2 ro quiet splash vt.handoff=7
SegvAnalysis:
 Segfault happened at: 0xb7667528 <XIChangeDeviceProperty+440>: mov 0x8(%esi),%eax
 PC (0xb7667528) ok
 source "0x8(%esi)" (0x00000009) not located in a known VMA region (needed readable region)!
 destination "%eax" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: xorg-server
StacktraceTop:
 XIGetDeviceProperty ()
 ?? ()
 ?? ()
 ?? ()
 ?? ()
Title: Xorg crashed with SIGSEGV in XIGetDeviceProperty()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

dmi.bios.date: 01/03/2011
dmi.bios.vendor: LENOVO
dmi.bios.version: 84ET23WW (1.07 )
dmi.board.name: 02173BG
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr84ET23WW(1.07):bd01/03/2011:svnLENOVO:pn02173BG:pvrThinkPadEdge:rvnLENOVO:rn02173BG:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 02173BG
dmi.product.version: ThinkPad Edge
dmi.sys.vendor: LENOVO
version.compiz: compiz 1:0.9.7.0+bzr3035-0ubuntu1
version.libdrm2: libdrm2 2.4.30-1ubuntu1
version.libgl1-mesa-dri: libgl1-mesa-dri 8.0.1-0ubuntu4
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 8.0.1-0ubuntu4
version.xserver-xorg-core: xserver-xorg-core 2:1.11.4-0ubuntu6
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.6.99.901+git20120126-0ubuntu2
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.14.99~git20111219.aacbd629-0ubuntu2
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.17.0-1ubuntu4
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:0.0.16+git20111201+b5534a1-1build2

[Apport retracing service (apport)]

StacktraceTop:
 XIGetDeviceProperty (dev=0xb9238788, property=277, value=0xbffa7cdc) at ../../Xi/xiproperty.c:852
 get_property (dev=<optimized out>, property=277, type=19, offset=0, length=1, bytes_after=0xbffa7d84, type_return=0xbffa7d8c, format=0xbffa7d7c, nitems=0xbffa7d80, length_return=0xbffa7d78, data=0xbffa7d88, delete=<optimized out>, client=<optimized out>) at ../../Xi/xiproperty.c:290
 get_property (data=0xbffa7d88, length_return=0xbffa7d78, nitems=0xbffa7d80, format=0xbffa7d7c, type_return=0xbffa7d8c, bytes_after=0xbffa7d84, length=1, offset=0, delete=0 '\000', type=19, property=277, dev=0xb9238788, client=<optimized out>) at ../../Xi/xiproperty.c:272
 ProcXGetDeviceProperty (client=0xb927d9b0) at ../../Xi/xiproperty.c:991
 ProcIDispatch (client=0xb927d9b0) at ../../Xi/extinit.c:415

[Thomas Novin (thomasn80)]

I get a Xorg crash a couple of times per week. Looking at the /var/crash/_usr_bin_Xorg.0.crash it says under title the same as this bug's title.

I don't use either Firefox or Minecraft.

I'm attaching my crash-file, maybe it's useful...

[Daniel Tedesco (anmeldemails+launchpad)]

I also get this message. I'm on 12.04 on a Lenovo ThinkPad T430s.
X usually crashes after suspending/waking up the notebook a couple of times .

I open the notebook, type in my password, and after a few seconds in Gnome-Shell am thrown back into LightDM.
After logging in again Apport tells me that /usr/bin/Xorg "crashed with SIGSEGV in XIGetDeviceProperty()".

This is driving me nuts. I'd be happy to provide error logs etc.

[Bryce Harrington (bryce)]

The stack trace here doesn't give us sufficient info to figure this bug out.

What we need to know is exact steps to reproduce the issue on our end. Can you (or anyone on dupes) identify steps that reliably reproduce the crash?

[Daniel Tedesco (anmeldemails+launchpad)]

The steps I do to reproduce it are:

- Boot up Ubuntu, log in to Gnome shell via LightDM.
- Close the lid of the notebook.
- Wait. (*)
- Open the lid of the notebook.
- Log in via the "locked screen" login prompt.
==> After a ~5-10 seconds I'll find myself back in LightDM, on the next login I get the error report telling me about the SIGSEGV in XIGetDeviceProperty().

(*) It seems that opening the lid directly after closing it does not trigger the problem. But when the lid was closed over a few hours, it happens pretty much every time.

What kind of information do you need from me?
I have a Lenovo Thinkpad T430s with the new i5 Ivy Bridge architecture. Ubuntu 12.04, Kernel 3.50, Gnome Shell (but the behaviour was the same in Unity). I can provide more information if you need it.

[Colan Schwartz (colan)]

See #1027457 for crash details.

[Colan Schwartz (colan)]

Sorry, I think this should probably be set back to Triaged.

[Thomas Novin (thomasn80)]

10 crashes like this today, new record. I haven't found a way to reproduce it but I have only seen it (IIRC) while scrolling/using Chromium.

On the other hand, when I'm not working, which I'm now isn't, I mainly use the laptop for web-browsing.

[Yaroslav Halchenko (yarikoptic)]

Reported originally: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681796
Happens with xserver-xorg-core 1.12.1.902-1

top backtrace from gdb:

Program received signal SIGSEGV, Segmentation fault.
XIChangeDeviceProperty (dev=dev@entry=0x7f4bac237fa0, property=<optimized out>, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0, len=len@entry=1,
    value=value@entry=0x7fff092e860f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
772 ../../Xi/xiproperty.c: No such file or directory.
#0 XIChangeDeviceProperty (dev=dev@entry=0x7f4bac237fa0, property=<optimized out>, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0,
    len=len@entry=1, value=value@entry=0x7fff092e860f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
#1 0x00007f4ba813c20f in DisableDevice (dev=0x7f4bac237fa0, sendevent=sendevent@entry=1 '\001') at ../../dix/devices.c:481
#2 0x00007f4ba817e344 in xf86VTSwitch () at ../../../../hw/xfree86/common/xf86Events.c:454
#3 xf86Wakeup (blockData=<optimized out>, err=<optimized out>, pReadmask=<optimized out>) at ../../../../hw/xfree86/common/xf86Events.c:285
#4 0x00007f4ba8146d9b in WakeupHandler (result=result@entry=-1, pReadmask=pReadmask@entry=0x7f4

here is an excerpt from xiproperty.c for that location:

   766 /* run through all handlers with checkonly TRUE, then again with
   767 * checkonly FALSE. Handlers MUST return error codes on the
   768 * checkonly run, errors on the second run are ignored */
   769 do {
   770 handler = dev->properties.handlers;
   771 while (handler) {
   772 if (handler->SetProperty) {
   773 rc = handler->SetProperty(dev, prop->propertyName,
   774 &new_value, checkonly);
   775 if (checkonly && rc != Success) {
   776 free(new_value.data);
   777 return rc;
   778 }
   779 }
   780 handler = handler->next;
   781 }
   782 checkonly = !checkonly;
   783 } while (!checkonly);

[patty (patplh)]

i am having the same exact problem as daniel tedesco.. ever since i installed ubuntu a month ago, immediately, this started happening.. i read online, that it's a problem with nvidia.. and it same to rename an xorg file, which i did, but still having the problem.
seems to happen when i login for the first time after the computer has been asleep .. i have a thinkpad t410

[Angelicfury1 (angelicfury1)]

Crashes atleast 5-10 times a day for me. Lenovo T520 + Sandy bridge i7 quad + integrated graphics. As such, it is not necessarily a problem with nvidia (like patty mentioned above).

[Fabian R. (faeber)]

My laptop regularly crashes with this error message. I think it only happens after having been on standby before.

Strange thing is, i sometimes get this error message:
Xorg crashed with SIGSEGV in XIGetDeviceProperty()

But sometimes i have:
Xorg crashed with SIGSEGV in XIChangeDeviceProperty()

And once i even had:
Xorg crashed with SIGABRT in XIChangeDeviceProperty()

Might it be the same reason with different error messages?

I am on Lenovo Thinkpad T420s here with integrated graphics. No Nvidia running either. Looking at the posts above it might be a Thinkpad'ish problem.

[Garret Kelly (gkelly)]

Experiencing the same issue on a Lenovo T520 running on the integrated graphics chipset. I cannot reproduce it, but have experienced it both in Totem and Google Chrome.

[Manuel Bessler (manuel-bessler)]

Experiencing the same issue on a Thinkpad T520i, but not on X60s, T420, Dell Latitude D510. All are running 12.04 32bit, all on gnome-classic, not Unity.

[dronus (paul-geisler)]

Also affects Lenovo T420s. After resuming from a longer standby period by opening the lid, this crash occurs after about a minute.
I don't experienced this some weeks ago, so it may be caused by a recent update or configuration change. Maybe related to the Intel drivers.

[dronus (paul-geisler)]

As it seems to affect the intel integrated GPUs at most reported cases, I have filed this bug against the xserver-xorg-video-intel package: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1030535

[Thomas Novin (thomasn80)]

Anyone tried updating to latest intel driver? Precise ships 2.17.0 and 2.20.1 is available.

http://www.phoronix.com/scan.php?page=news_item&px=MTE0NDg

https://launchpad.net/~xorg-edgers/+archive/ppa

[Kevin-freedesktop-bugz (kevin-freedesktop-bugz)]

I believe I've been encountering the same crash, though I usually get it a few minutes after resuming from suspend. This is on an ASUS EeePC 1005HA running Debian Wheezy The Debian package is xserver-xorg-core 2:1.12.1.902-1. The log shows this:

[ 12941.730] (--) synaptics: SynPS/2 Synaptics TouchPad: touchpad found
[ 13139.273]
[ 13139.273] Backtrace:
[ 13139.347] 0: /usr/bin/Xorg (xorg_backtrace+0x49) [0xb7772099]
[ 13139.347] 1: /usr/bin/Xorg (0xb75f5000+0x180a86) [0xb7775a86]
[ 13139.347] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xb75d640c]
[ 13139.347] 3: /usr/bin/Xorg (XIChangeDeviceProperty+0x198) [0xb770d188]
[ 13139.348] 4: /usr/bin/Xorg (0xb75f5000+0x118829) [0xb770d829]
[ 13139.348] 5: /usr/bin/Xorg (0xb75f5000+0x10f7d4) [0xb77047d4]
[ 13139.348] 6: /usr/bin/Xorg (0xb75f5000+0x3c365) [0xb7631365]
[ 13139.348] 7: /usr/bin/Xorg (0xb75f5000+0x29e95) [0xb761ee95]
[ 13139.348] 8: /lib/i386-linux-gnu/i686/cmov/libc.so.6 (__libc_start_main+0xe6) [0xb7293e46]
[ 13139.348] 9: /usr/bin/Xorg (0xb75f5000+0x2a1e9) [0xb761f1e9]
[ 13139.348]
[ 13139.349] Segmentation fault at address 0x9
[ 13139.349]
Fatal server error:
[ 13139.349] Caught signal 11 (Segmentation fault). Server aborting

I got a core file as well:

Core was generated by `/usr/bin/Xorg :0 -br -verbose -novtswitch -auth /var/run/gdm3/auth-for-Debian-g'.
Program terminated with signal 11, Segmentation fault.
#0 XIChangeDeviceProperty (dev=dev@entry=0xb7bcd898, property=135, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0, len=len@entry=1,
    value=value@entry=0xbfbfb16f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
772 ../../Xi/xiproperty.c: No such file or directory.
(gdb) bt
#0 XIChangeDeviceProperty (dev=dev@entry=0xb7bcd898, property=135, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0, len=len@entry=1,
    value=value@entry=0xbfbfb16f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
#1 0xb75c2aa3 in DisableDevice (dev=dev@entry=0xb7bcd898, sendevent=sendevent@entry=1 '\001') at ../../dix/devices.c:481
#2 0xb75c2ced in RemoveDevice (dev=dev@entry=0xb7bcd898, sendevent=sendevent@entry=1 '\001') at ../../dix/devices.c:1059
#3 0xb7618fac in DeleteInputDeviceRequest (pDev=0xb7bcd898) at ../../../../hw/xfree86/common/xf86Xinput.c:1013
#4 0xb75be4d0 in CloseDeviceList (listHead=listHead@entry=0xb7784444) at ../../dix/devices.c:964
#5 0xb75befa0 in CloseDownDevices () at ../../dix/devices.c:993
#6 0xb7716595 in AbortServer () at ../../os/log.c:475
#7 0xb77166c5 in FatalError (f=f@entry=0xb773b448 "Caught signal %d (%s). Server aborting\n") at ../../os/log.c:611
#8 0xb770eae8 in OsSigHandler (sip=0xbfbfb4ac, signo=11, unused=<optimized out>) at ../../os/osinit.c:146
#9 OsSigHandler (signo=11, sip=0xbfbfb4ac, unused=0xbfbfb52c) at ../../os/osinit.c:107
#10 <signal handler called>
#11 XIChangeDeviceProperty (dev=0xb7bcd898, property=property@entry=281, type=19, format=format@entry=8, mode=<optimized out>, len=1, value=value@entry=0xb7c52ddc,
    sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
#12 0xb76a6829 in change_property (data=0xb7c52ddc, len=<optimized out>, mode=<optimi...

[mute (mutewonder)]

I'm on an EeePC 1005ha netbook with Intel graphics, and the crashing happens almost every time the netbook resumes from suspend. Daniel Tedesco's (comment #8) suggestion about long-term suspends might be on target. It's happened since upgrading Ubuntu from 11.10 to 12.04, and usually in Unity. Haven't tried latest Intel driver (comment #19) yet.

[Jonatan Høy Sørensen (jhs-ircaddict)]

I just used drivers linked in here by ThomasNovin, and it still happens.
Thsi timee after logging out, and then back in.

[Gaute (gaute-div)]

I've got this bug on every laptop in the household :-(
an Eee PC 1005HA, an older dell inspiron and my own dell Vostro V131.
I _think_ they all have Intel graphics

[Thomas Novin (thomasn80)]

At least for me, not related to how long you have had the computer in suspend.

Just woke it up after having suspended for ~ 2 minutes, got the crash.

I also had the same issue when I ran Cinnamon in Linux Mint 13 before.. so according to this and a previous comment it's not related to Unity, Gnome Classic or Cinnamon.

[Scott Howard (showard314)]

Look around the internet, I may have found what appears to be upstream reports:

Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681796

Xorg:
http://patchwork.freedesktop.org/patch/11531/

Debian is showing this SIGSEV:
XIChangeDeviceProperty (dev=dev@entry=0x7f4bac237fa0, property=<optimized out>, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0, len=len@entry=1,
    value=value@entry=0x7fff092e860f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772

And Xorg claims:
is reporting a memory leak:

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with XICreateDeviceProperty(property)
        at line 774 of Xi/xiproperty.c in function 'XIChangeDeviceProperty'.
          'prop' allocated at line 700 with XICreateDeviceProperty(property).
          prop leaks when handler != NULL at line 768
              and handler->SetProperty != NULL at line 769
              and checkonly != 0 at line 772
              and rc != 0 at line 772.

I'll forward this info to Debian and see what they say.

[Scott Howard (showard314)]

Follow up, here's the xorg bug that debian is referring to:
https://bugs.freedesktop.org/show_bug.cgi?id=52496

I linked both to the tracker here.

[Scott Howard (showard314)]

I am not too familiar with this bug, but I can across a recent patch
[1] to x.org to fix a memory leak in XICreateDeviceProperty(), around
the same lines where this crash is happening.

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with XICreateDeviceProperty(property)
        at line 774 of Xi/xiproperty.c in function 'XIChangeDeviceProperty'.
          'prop' allocated at line 700 with XICreateDeviceProperty(property).
          prop leaks when handler != NULL at line 768
              and handler->SetProperty != NULL at line 769
              and checkonly != 0 at line 772
              and rc != 0 at line 772.

The patch is:

diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
index ca73104..4beedcf 100644
--- a/Xi/xiproperty.c
+++ b/Xi/xiproperty.c
@@ -771,6 +771,8 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom
property, Atom type,
                                                   &new_value, checkonly);
                         if (checkonly && rc != Success) {
                             free(new_value.data);
+ if (add)
+ XIDestroyDeviceProperty(prop);
                             return rc;
                         }
                     }

[1] http://patchwork.freedesktop.org/patch/11531/

[Scott Howard (showard314)]

On Thu, Aug 2, 2012 at 5:39 PM, Scott Howard <email address hidden> wrote:
> I am not too familiar with this bug, but I can across a recent patch
> [1] to x.org to fix a memory leak in XICreateDeviceProperty(), around
> the same lines where this crash is happening.

Disregard the above, the patch doesn't fix it for me.

[Rik Shaw (rik-shaw)]

This seems to be simliar to the bug I have been following here:

https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/956071

Largely newer Thinkpads with Intel graphics. I have tested with the xorg "edgers" PPA and still had the issue. I can reproduce the crash by doing successive suspend / wake cycles. Usually crashes (kicks out to lightdm, that is) after 3, but sometimes the 4th wake from suspend. In this case (quick successive suspend / wake attempts by closing the lid), I can see when it crashes because the lenovo "half moon light" remains blinking after the lid is closed (should go solid after suspend achieved).

I should note that in this above case when I open the lid I am already back at the lightdm login screen. Other "real life crash times", the machine wakes up fine, but after approximately 30 seconds to a minute (while using the machine) it kicks me out to the lightdm screen (as others report here).

The above bug report has a few full backtrace calls after one of the reporters heled us get our machines set up to do full reporting. There may be info there that can help here.

[dronus (paul-geisler)]

I've raised the importance as this seems to be the equivalent of a large amount of bug reports on Ubuntu via launchpad. It affects PCs of several vendors, maybe restricted to newer Intel CPU/GPUs. Main launchpad report here: https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/956071

[Peter Hutterer (peter-hutterer)]

Does debian carry any patches? if so, can you reproduce this with a vanilla X server? I just vt-switched about 50 times with 1.12.99.902 but it doesn't happen here.

What desktop environment is this? something is trying to change the property after the VT switch, so I'd need a similar setup here.

Finally, if you can reproduce it easily, can you try running X through valgrind to see if you get any invalid writes?

[Peter Hutterer (peter-hutterer)]

correction, I tried reproducing with 1.12.1.902, i.e. the same version as listed in the original comment.

[Yaroslav Halchenko (yarikoptic)]

(In reply to comment #3)
> Does debian carry any patches?

yes. See
http://patch-tracker.debian.org/package/xorg-server/2:1.12.3-1
for details

> if so, can you reproduce this with a vanilla X
> server? I just vt-switched about 50 times with 1.12.99.902 but it doesn't
> happen here.

Never happened for me while switching VT. although I do not do that regularly... ok -- switched to VT 1 and back (Ctrl-Alt-1 and then randomly Alt-left/right till reaching X) quite a few times (around 10) -- no problem. With suspend I think I would have experienced it by then. Also, may be of relevance:

if X crashes during suspend and I end up again at the kdm login prompt -- I would still have my 'half-moon' light blinking until I switch to e.g. VT 1 -- then it would finally suspend.

> What desktop environment is this?

happened originally with KDE4 + awesome... now it is XFCE + awesome -- the same story

> something is trying to change the property
> after the VT switch, so I'd need a similar setup here.

my ~/.xsession has

    awesome &
    sleep 3
    xfce4-session

> Finally, if you can reproduce it easily, can you try running X through valgrind
> to see if you get any invalid writes?

It is reproducible on around 5-10th occasion on random -- never yet tried to cause it on purpose -- I thought to give it excessive troubleshooting one day... if I get a moment I will run it through valgrind... although if it is some kind of a race condition between threads, it might not get triggered

[Tim Chen (timchen119)]

Create /etc/modprobe.d/bare-psmouse.conf:

options psmouse proto=bare

then I reboot and tried close/open the lid 50 times,
I no longer have Xorg crash issue.

Can anyone still reproduce this issue after this workaround?

[Keng-Yu Lin (lexical)]

More testings here:
  From the fd.o bug it looks like the crash is in xserver-xorg-input-synaptics. I tried to boot with the parameter "psmouse.proto=bare" so that the touchpad is recognized as a generic PS/2 mouse. And I performed 30 cycles of suspends/resumes. There is no crash observed.

  Independently, I downgraded the xserver-xorg-input-synaptics package to 1.5.99.902-0ubuntu5 (just happens in the ddebs archives, its -debsym package is of that version). I performed 30 cycles of suspends/resumes. There is no crash either.

[Rik Shaw (rik-shaw)]

Fix from #31 above seems to be working for me. Great day and thanks for the help!!!

Am posting a reference to the other 2 bugs that seem closely related (sorry, but above in #30 I linked back to this bug, not the other one!):

Here are the other 2 possibly related bugs I will refer back here for them to try the possible fix:

https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/1026777

https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1030535

[Thomas Novin (thomasn80)]

Fix from #31 works to get rid of the crashes but makes the touchpad very impaired (very slow and drag up/down left/right to scroll doesn't work).

So I guess #32 will be a better fix so I suggest to all that use that workaround instead if you use your touchpad!

[Rik Shaw (rik-shaw)]

Thomas in #34 makes a good point. The fix from #31 impairs the functionality of the touchpad. I have changed using the advice from #32, namely installing the previous version of xserver-xorg-input-synaptics in synaptic package manager and then locking the version there. It does seem that this indeed solves the crashes.

[Fabian R. (faeber)]

Checking my update history and my crash logs indicates that the crashes started happening to me after i updated xserver-xorg-input-synaptics from 1.6.0-0ubuntu1~precise1 to 1.6.2-1ubuntu1~precise1.

[Peter Hutterer (peter-hutterer)]

commit a245d42f53096b1ae81e6702729f97ca508e5b5b
Author: Peter Hutterer <email address hidden>
Date: Thu Aug 30 16:38:38 2012 +1000

    Reset num_active_touches on DeviceOff (#52496)

[James M. Leddy (jm-leddy)]

Marking verification-done based on comment #84

In response to comment #85, it's probably not useful for you to test proposed unless you can reliabley reproduce with the -updates package _or_ you know that this bug triggers frequently enough that when you install the new package you know it's fixed because it doesn't crash.

[Ghislain Vaillant (ghisvail)]

In my case, I get a similar crash (same title in Apport than in this bug) but it happens on both supsend/resume and cold boot. Not sure if I should test the fix in -proposed or open a different bug report. My machine is a Vostro V131 running 12.04. Please let me know what you think I should do.

[dafreez (dafreez-gmail)]

Since updating to the fixed package, no more crashes whatsoever. Very happy;)

[Nathaniel Beaver (nathanielmbeaver)]

I tried 1.6.2-1ubuntu1~precise2. No crashes, but the touchpad doesn't work either. It worked briefly, then stopped working even after reboot.

[Thomas Novin (thomasn80)]

System is doing fine on 1.6.2-1ubuntu1~precise2 regarding crashes.

However, touchpad does not work OK! That little red pointer-thing (on my Lenovo) works though. Also scrolling on the touchpad works.

Ubuntu developers: Are you going to reset bug status to confirmed or whatever or do we need to open a new bug for this regression?

[Scott Kitterman (kitterman)]

Thomas: Is the touchpad problem fixed if you downgrade back to the previous package?

[Donald Siuchninski (dsiuchninski)]

Still broken.

Using a Lenovo t410 - Intel ® Integrated Graphics and NVIDIA® NVS3100M Discrete Graphics

Bubmblebee is installed.

I can confirm that this does not happen without bumblebee.

For me, logoff occurs immediately after returning from suspend. I then get this message:

"An problem has been detected." Followed by an apport popup that doesn't seem to work.

[dronus (paul-geisler)]

I can confirm that 1.6.2-1ubuntu1~precise2 doesn't completely fix the bug on Lenovo T420s.

While I have not seen any random crashes for some time, the touchpad can still be killed by the test described in #81. After some cycles of disabling it by hotkey with fingers on and reenabling with fingers off the pad is not working anymore. However, this procedure doesn't crash X so far, as it reliably does with ..~precise1 before.

[Thomas Novin (thomasn80)]

@Scott: I never noticed this problem when I was on 1.6.2-1ubuntu1~precise1. I now run 1.6.2-1ubuntu1~precise1 since it was released to proposed and I have only noticed the touchpad problem twice since. Right now it's working fine even though I have done several suspend / resumes. So I cannot reproduce "breaking" it.

[Adam Conrad (adconrad)]

Adding a regression-proposed tag for now to prevent migration until we can get some more feedback as to how this is better (no crashing sounds good) or worse (it seems some touchpads don't work when they previously did?) than the previous version.

[Romano Giannetti (romano-giannetti)]

Well, I could not trigger the bug, but had crashes every few hours. Since when updating to the proposed package, I had no more crashes - can't be 100% sure it's fixed, given the random nature of the thing, but it seems ok, and it's for sure much better than before.

[Timo Aaltonen (tjaalton)]

My findings so far (with my T420s):

- disabling the touchpad with 'xinput disable/enable' works as many times as I like
- disabling the touchpad with the hotkey fails to enable it, even though the logfile gets a new "touchpad found" entry, and the same with the old driver version... Logging out (=xserver restart) makes it work again

so I'm not sure if it really has regressed with the new version. Would still like to know if downgrading the driver (to ~precise1) makes it work again for Nathaniel or others.

[Nathaniel Beaver (nathanielmbeaver)]

Touchpad works now. I tried downgrading and upgrading with logout or reboot, but I cannot reproduce thus far. ~precise2 hasn't crashed yet.

[patty (patplh)]

i installed the update a few days ago and have only had one crash since (and it was the same day as the update).. i use to have them almost consistently everytime i went out of suspend (at least 4 times a day).

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xserver-xorg-input-synaptics - 1.6.2-1ubuntu1~precise2

---------------
xserver-xorg-input-synaptics (1.6.2-1ubuntu1~precise2) precise-proposed; urgency=low

  * Added 130_reset-num_active_touches-on-deviceoff.patch (LP: #956071)
 -- Timo Aaltonen <email address hidden> Thu, 30 Aug 2012 20:32:12 +0300

[Timo Aaltonen (tjaalton)]

The hotkey bug is a separate issue and needs to be tracked elsewhere. It's likely reported already, so if someone knows the master bug for it, please add a link here. Otherwise I'll file it and do the same.

[Timo Aaltonen (tjaalton)]

the hotkey bug for thinkpads at least is bug 804109

[Romano Giannetti (romano-giannetti)]

Great. Is there any instruction on how to undo the - proposal activation ? I used the method described in the wiki to add only this package (the trick with priorities), is deselecting the proposed repository sufficient? Thanks!

[Timo Aaltonen (tjaalton)]

Romano: disable it from the software center (edit - app sources - updates)

[Jesse Glick (jesse-glick)]

1.6.2-1ubuntu1~precise2 still occasionally crashing for me with what seems to be the same SIGSEGV, under similar conditions as before (as in comment #6—unlocking screen after longish period of inactivity).

[Rephorm-b (rephorm-b)]

Although this patch makes the situation much better, it looks like a similar bug is present elsewhere. Using git commit On git rev 3cb14dcccf5574366d90e24f351e3ad04b35e35f, I see an occasional crash after several days of using a laptop with ~10 suspensions per day.

The following diagnostic messages and backtrace appears three times in the Xorg log before Xorg quits:

[121305.099] BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
[121305.099] BUG: synaptics.c:2615 in UpdateTouchState()
[121305.099]
[121305.099] Backtrace:
[121305.384] 0: /usr/bin/X (xorg_backtrace+0x36) [0x560366]
[121305.384] 1: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7ff504292000+0x2c47) [0x7ff504294c47]
[121305.384] 2: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7ff504292000+0x4cdb) [0x7ff504296cdb]
[121305.384] 3: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7ff504292000+0x6744) [0x7ff504298744]
[121305.384] 4: /usr/bin/X (0x400000+0x6efd7) [0x46efd7]
[121305.384] 5: /usr/bin/X (0x400000+0x93370) [0x493370]
[121305.384] 6: /usr/lib/libpthread.so.0 (0x7ff508a94000+0xf170) [0x7ff508aa3170]
[121305.384] 7: /usr/bin/X (0x400000+0x164540) [0x564540]
[121305.384] 8: /usr/lib/libpthread.so.0 (0x7ff508a94000+0xf170) [0x7ff508aa3170]
[121305.384] 9: /usr/lib/libc.so.6 (0x7ff50791f000+0x7ba57) [0x7ff50799aa57]
[121305.384] 10: /usr/lib/libc.so.6 (__libc_malloc+0x70) [0x7ff50799be50]
[121305.389] 11: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x3fa6d) [0x7ff505aaaa6d]
[121305.389] 12: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x4b7b8) [0x7ff505ab67b8]
[121305.389] 13: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x4d09b) [0x7ff505ab809b]
[121305.389] 14: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x80d9b) [0x7ff505aebd9b]
[121305.389] 15: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x813b3) [0x7ff505aec3b3]
[121305.389] 16: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x88466) [0x7ff505af3466]
[121305.390] 17: /usr/bin/X (0x400000+0xebc5b) [0x4ebc5b]
[121305.390] 18: /usr/bin/X (0x400000+0x34531) [0x434531]
[121305.390] 19: /usr/bin/X (0x400000+0x23615) [0x423615]
[121305.390] 20: /usr/lib/libc.so.6 (__libc_start_main+0xf5) [0x7ff507940725]
[121305.390] 21: /usr/bin/X (0x400000+0x238ed) [0x4238ed]

[Peter Hutterer (peter-hutterer)]

Hard to read the backtrace without symbols, but please try to find a reproducible test-case. The number of fingers on the touchpad at suspend time vs at resume time is almost certainly the trigger for this, but I haven't found a reliable trigger yet.

[Jesse Glick (jesse-glick)]

1.6.2-1ubuntu1~precise2 which I think has this patch, and also 1.5.99, continue to crash for me with this SEGV on occasion, shortly but not immediately after unlocking the screen (not necessarily after resume from suspend). No clear way to reproduce. Anything that can be done to help? (Any all-in-one instructions available for rebuilding X + drivers with symbols and running through Valgrind?)

[Moondrake (moondrake)]

A couple of weeks ago I experienced a similar bug once or twice (at least a similar backtrace as in comment 16), but I also did not have symbols installed.

However, it may be noteworthy that I did not trigger it by a resume, but by putting very heavy load on the machine. I have not done so since, but I will try to get some better debug info when I have time to try and reproduce this.

[Moondrake (moondrake)]

I am not sure if it is still the same issue, but the last comments in this bug are very similar to what is reported in bug 55821.

A reproducible test case I could not find. It just happens during normal use, though a heavy load (suspend/resume) may trigger it quicker. It is hard to be really sure of this however.

This is on a Lenovo T410 with fedora 18 (note: I think 17 did not have this problem).

EE) BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
(EE) BUG: synaptics.c:3122 in UpdateTouchState()
(EE)
(EE) Backtrace:
(EE) 0: /usr/bin/X (xorg_backtrace+0x36) [0x46c496]
(EE) 1: /usr/lib64/xorg/modules/input/synaptics_drv.so (0x7fda46838000+0x2e97) [0x7fda4683ae97]
(EE) 2: /usr/lib64/xorg/modules/input/synaptics_drv.so (0x7fda46838000+0x4593) [0x7fda4683c593]
(EE) 3: /usr/lib64/xorg/modules/input/synaptics_drv.so (0x7fda46838000+0x6fd2) [0x7fda4683efd2]
(EE) 4: /usr/bin/X (0x400000+0x89747) [0x489747]
(EE) 5: /usr/bin/X (0x400000+0xb2e88) [0x4b2e88]
(EE) 6: /lib64/libpthread.so.0 (0x35ea800000+0xf000) [0x35ea80f000]
(EE) 7: /lib64/libc.so.6 (__select+0x13) [0x35ea0eb773]
(EE) 8: /usr/bin/X (WaitForSomething+0x190) [0x469a10]
(EE) 9: /usr/bin/X (0x400000+0x39301) [0x439301]
(EE) 10: /usr/bin/X (0x400000+0x280ba) [0x4280ba]
(EE) 11: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x35ea021a05]
(EE) 12: /usr/bin/X (0x400000+0x283fd) [0x4283fd]
(EE)

(gdb) info symbol 0x2e97
UpdateTouchState.isra.12 + 167 in section .text of /usr/lib64/xorg/modules/input/synaptics_drv.so
(gdb) info symbol 0x4593
HandleState + 499 in section .text of /usr/lib64/xorg/modules/input/synaptics_drv.so
(gdb) info symbol 0x6fd2
ReadInput + 130 in section .text of /usr/lib64/xorg/modules/input/synaptics_drv.so

(gdb) info symbol 0x489747
xf86SigioReadInput + 39 in section .text of /usr/bin/X
(gdb) info symbol 0x4b2e88
xf86SIGIO + 440 in section .text of /usr/bin/X

Touchpad is locked into "scrolling". A possible solution is probably to not increase num_active_touches if priv->num_active_touches > priv->num_slots.
But this would obviously not fix the underlying cause (just fix the annoying loss of trackpad).

[Jesse Glick (jesse-glick)]

FWIW this bug only happens to me when unlocking the screen saver, usually though not always after a resume from suspend. I think it happens when I start typing a password quickly and right away. (The crash does not happen immediately—a few seconds later.)

If I take care to wait a moment until the caret in the password text field is blinking steadily I seem to be able to avoid it. This hypothesis would explain why the crash seems to happen most often when the computer is under load (either from a resume, or because there is a substantial background process like a big compile)—in such cases the screen saver GUI is a little slower to react.

Alternatively it is possible the crash is related to my fingers accidentally brushing the touchpad while typing the password.

[Jan Schmidt (thaytan)]

*** Bug 55821 has been marked as a duplicate of this bug. ***

[Peter Hutterer (peter-hutterer)]

There are suggestions that http://lists.x.org/archives/xorg-devel/2012-October/034149.html helps with this issue, but unconfirmed so far.

[Moondrake (moondrake)]

My eeepc running mint has suddenly (after an update) also started to exhibit this bug. It is starting to get annoying! I will try the patch mentioned in the coming days (but confirmation can take some time, I only hit this once a week or less).

[Moondrake (moondrake)]

Hmm, Peter, can you confirm that patch is already in Fedora 18. It seems to have been merged as part of:
* Tue Oct 30 2012 Peter Hutterer <email address hidden> 1.13.0-6
- Add touchscreen fixes (including pointer emulation) #871064

So unless it was reverted by a later patch (at 1.13.2-1 now), this is not it (unless these fixes are causing it instead of preventing it, but that is not what you meant is it?)

[Peter Hutterer (peter-hutterer)]

right, that was the one and it hasn't been reverted, it just got integrated into upstream 1.13.1 so we don't need the patch anymore. back to the drawing board.

[Jesse Glick (jesse-glick)]

I have not encountered this bug after upgrading to Raring.

[Jesse Glick (jesse-glick)]

Have not yet seen this bug in xserver-xorg-input-synaptics 1.6.2-1ubuntu6 (Raring).

[N-charles (n-charles)]

I'm seeing this on an Lenovo T420. I frequently see it when coming out of hibernation (because my system is still swapping in).

I can "recover" by suspending to memory and then unresponding. At that point the touchpad works again just fine without restarting X.

Debian Wheezy:
xserver-xorg-input-synaptics 1.6.2-2 amd64

[N-charles (n-charles)]

I can still produce this bug on Debian stable. It requires me to run a process that does a lot of random io in a a large file, such that some swap is consumed.

I also had an instance of X crashing as a result:

[ 84441.029] BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
[ 84441.029] BUG: ../../src/synaptics.c:3122 in UpdateTouchState()
[ 84441.029]
[ 84441.029] Backtrace:
[ 84441.029] 0: /usr/bin/X (xorg_backtrace+0x36) [0x7f9db58fbd16]
[ 84441.029] 1: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x3067) [0x7f9dafb4b067]
[ 84441.029] 2: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x4733) [0x7f9dafb4c733]
[ 84441.029] 3: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x7164) [0x7f9dafb4f164]
[ 84441.029] 4: /usr/bin/X (0x7f9db577d000+0x8d947) [0x7f9db580a947]
[ 84441.029] 5: /usr/bin/X (0x7f9db577d000+0xb1c18) [0x7f9db582ec18]
[ 84441.029] 6: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7f9db4aa5000+0xf0a0) [0x7f9db4ab40a0]
[ 84441.029] 7: /lib/x86_64-linux-gnu/libc.so.6 (__select+0x13) [0x7f9db3881293]
[ 84441.029] 8: /usr/bin/X (WaitForSomething+0x190) [0x7f9db58f9150]
[ 84441.029] 9: /usr/bin/X (0x7f9db577d000+0x52bb1) [0x7f9db57cfbb1]
[ 84441.029] 10: /usr/bin/X (0x7f9db577d000+0x41ec5) [0x7f9db57beec5]
[ 84441.029] 11: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xfd) [0x7f9db37c9ead]
[ 84441.029] 12: /usr/bin/X (0x7f9db577d000+0x4219d) [0x7f9db57bf19d]
[ 84441.029]
[ 84441.115] BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
[ 84441.115] BUG: ../../src/synaptics.c:3122 in UpdateTouchState()
[ 84441.115]
[ 84441.115] Backtrace:
[ 84441.115] 0: /usr/bin/X (xorg_backtrace+0x36) [0x7f9db58fbd16]
[ 84441.115] 1: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x3067) [0x7f9dafb4b067]
[ 84441.115] 2: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x4733) [0x7f9dafb4c733]
[ 84441.115] 3: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x7164) [0x7f9dafb4f164]
[ 84441.115] 4: /usr/bin/X (0x7f9db577d000+0x8d947) [0x7f9db580a947]
[ 84441.115] 5: /usr/bin/X (0x7f9db577d000+0xb1c18) [0x7f9db582ec18]
[ 84441.115] 6: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7f9db4aa5000+0xf0a0) [0x7f9db4ab40a0]
[ 84441.115] 7: /lib/x86_64-linux-gnu/libc.so.6 (__select+0x13) [0x7f9db3881293]
[ 84441.115] 8: /usr/bin/X (WaitForSomething+0x190) [0x7f9db58f9150]
[ 84441.115] 9: /usr/bin/X (0x7f9db577d000+0x52bb1) [0x7f9db57cfbb1]
[ 84441.115] 10: /usr/bin/X (0x7f9db577d000+0x41ec5) [0x7f9db57beec5]
[ 84441.115] 11: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xfd) [0x7f9db37c9ead]
[ 84441.115] 12: /usr/bin/X (0x7f9db577d000+0x4219d) [0x7f9db57bf19d]
[ 84441.115]
[ 84442.200] BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
[ 84442.200] BUG: ../../src/synaptics.c:3122 in UpdateTouchState()
[ 84442.200]
[ 84442.200] Backtrace:
[ 84442.200] 0: /usr/bin/X (xorg_backtrace+0x36) [0x7f9db58fbd16]
[ 84442.200] 1: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x3067) [0x7f9dafb4b067]
[ 84442.200] 2: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x4733) [0x7f9dafb4c733]
[ 84442.200] 3: /usr/lib/xorg/module...

[N-charles (n-charles)]

Is this bug tracker actually used?

[Peter Hutterer (peter-hutterer)]

Fixes for that are in synaptics 1.8 and 1.7.6. It was caused by missing SYN_DROPPED handling.

You'll need libevdev 1.2 or later, iirc to get rid of the bug in synaptics 1.8.

Otherwise, the commit on the 1.7 branch was:
http://cgit.freedesktop.org/xorg/driver/xf86-input-synaptics/commit/?h=synaptics-1.7-branch&id=bbaf4d646ebf4393a1ee0eb9bcc569054ed878f9

[Ajax-a (ajax-a)]

*** Bug 54283 has been marked as a duplicate of this bug. ***