Xorg crashed with SIGSEGV in XIGetDeviceProperty()

[Jonatan Høy Sørensen]

[Impact]

Causes crashes in the xserver usually on resume from suspend.

[Test Case]

- Put one or more fingers to the touchpad
- Send the computer to standby, or disable the pad using 'xinput disable' with the finger(s) still on the pad
- Remove the fingers
- Resume the computer or enable the touchpad again using 'xinput enable'
- Touch the pad again

[Regression Potential]

none, the patch resets a counter on device reset that should be zero at that point

--
Crash on resume in xserver-xorg-input-synaptics. Version 1.5.99.902-0ubuntu5 works, the workaround is to downgrade to that version.

It appears to hit many newer laptops causing data loss.

Original description

Happens quite often, but I can't find a pattern to when it happens.

Might be related to either firefox or Minecraft (openjdk-6) but I am not certain.

#10 <signal handler called>
No symbol table info available.
#11 XIGetDeviceProperty (dev=0xb9238788, property=277, value=0xbffa7cdc) at ../../Xi/xiproperty.c:852
        handler = <optimized out>
        prop = 0xb923c8d8
        rc = <optimized out>
#12 0xb7667797 in get_property (dev=<optimized out>, property=277, type=19, offset=0, length=1, bytes_after=0xbffa7d84, type_return=0xbffa7d8c, format=0xbffa7d7c, nitems=0xbffa7d80, length_return=0xbffa7d78, data=0xbffa7d88, delete=<optimized out>, client=<optimized out>) at ../../Xi/xiproperty.c:290
        n = <optimized out>
        len = <optimized out>
        ind = <optimized out>
        rc = <optimized out>
        prop = <optimized out>
        prop_value = <optimized out>

ProblemType: Crash
DistroRelease: Ubuntu 12.04
Package: xserver-xorg-core 2:1.11.4-0ubuntu6
ProcVersionSignature: Ubuntu 3.2.0-18.29-generic-pae 3.2.9
Uname: Linux 3.2.0-18-generic-pae i686
.tmp.unity.support.test.0:

ApportVersion: 1.94.1-0ubuntu2
Architecture: i386
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CompositorRunning: compiz
Date: Thu Mar 15 08:30:43 2012
DistUpgraded: Fresh install
DistroCodename: precise
DistroVariant: ubuntu
ExecutablePath: /usr/bin/Xorg
ExtraDebuggingInterest: Yes, whatever it takes to get this fixed in Ubuntu
GraphicsCard:
 Intel Corporation Core Processor Integrated Graphics Controller [8086:0046] (rev 02) (prog-if 00 [VGA controller])
   Subsystem: Lenovo Device [17aa:21c5]
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha i386 (20120304)
MachineType: LENOVO 02173BG
ProcCmdline: /usr/bin/X :0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch -background none
ProcEnviron:

ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-3.2.0-18-generic-pae root=UUID=f58bc641-2db1-4b1d-a839-3b04dc4e9ee2 ro quiet splash vt.handoff=7
SegvAnalysis:
 Segfault happened at: 0xb7667528 <XIChangeDeviceProperty+440>: mov 0x8(%esi),%eax
 PC (0xb7667528) ok
 source "0x8(%esi)" (0x00000009) not located in a known VMA region (needed readable region)!
 destination "%eax" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: xorg-server
StacktraceTop:
 XIGetDeviceProperty ()
 ?? ()
 ?? ()
 ?? ()
 ?? ()
Title: Xorg crashed with SIGSEGV in XIGetDeviceProperty()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

dmi.bios.date: 01/03/2011
dmi.bios.vendor: LENOVO
dmi.bios.version: 84ET23WW (1.07 )
dmi.board.name: 02173BG
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr84ET23WW(1.07):bd01/03/2011:svnLENOVO:pn02173BG:pvrThinkPadEdge:rvnLENOVO:rn02173BG:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 02173BG
dmi.product.version: ThinkPad Edge
dmi.sys.vendor: LENOVO
version.compiz: compiz 1:0.9.7.0+bzr3035-0ubuntu1
version.libdrm2: libdrm2 2.4.30-1ubuntu1
version.libgl1-mesa-dri: libgl1-mesa-dri 8.0.1-0ubuntu4
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 8.0.1-0ubuntu4
version.xserver-xorg-core: xserver-xorg-core 2:1.11.4-0ubuntu6
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.6.99.901+git20120126-0ubuntu2
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.14.99~git20111219.aacbd629-0ubuntu2
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.17.0-1ubuntu4
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:0.0.16+git20111201+b5534a1-1build2

[Apport retracing service (apport)]

StacktraceTop:
 XIGetDeviceProperty (dev=0xb9238788, property=277, value=0xbffa7cdc) at ../../Xi/xiproperty.c:852
 get_property (dev=<optimized out>, property=277, type=19, offset=0, length=1, bytes_after=0xbffa7d84, type_return=0xbffa7d8c, format=0xbffa7d7c, nitems=0xbffa7d80, length_return=0xbffa7d78, data=0xbffa7d88, delete=<optimized out>, client=<optimized out>) at ../../Xi/xiproperty.c:290
 get_property (data=0xbffa7d88, length_return=0xbffa7d78, nitems=0xbffa7d80, format=0xbffa7d7c, type_return=0xbffa7d8c, bytes_after=0xbffa7d84, length=1, offset=0, delete=0 '\000', type=19, property=277, dev=0xb9238788, client=<optimized out>) at ../../Xi/xiproperty.c:272
 ProcXGetDeviceProperty (client=0xb927d9b0) at ../../Xi/xiproperty.c:991
 ProcIDispatch (client=0xb927d9b0) at ../../Xi/extinit.c:415

[Thomas Novin (thomasn80)]

I get a Xorg crash a couple of times per week. Looking at the /var/crash/_usr_bin_Xorg.0.crash it says under title the same as this bug's title.

I don't use either Firefox or Minecraft.

I'm attaching my crash-file, maybe it's useful...

[Daniel Tedesco (anmeldemails+launchpad)]

I also get this message. I'm on 12.04 on a Lenovo ThinkPad T430s.
X usually crashes after suspending/waking up the notebook a couple of times .

I open the notebook, type in my password, and after a few seconds in Gnome-Shell am thrown back into LightDM.
After logging in again Apport tells me that /usr/bin/Xorg "crashed with SIGSEGV in XIGetDeviceProperty()".

This is driving me nuts. I'd be happy to provide error logs etc.

[Bryce Harrington (bryce)]

The stack trace here doesn't give us sufficient info to figure this bug out.

What we need to know is exact steps to reproduce the issue on our end. Can you (or anyone on dupes) identify steps that reliably reproduce the crash?

[Daniel Tedesco (anmeldemails+launchpad)]

The steps I do to reproduce it are:

- Boot up Ubuntu, log in to Gnome shell via LightDM.
- Close the lid of the notebook.
- Wait. (*)
- Open the lid of the notebook.
- Log in via the "locked screen" login prompt.
==> After a ~5-10 seconds I'll find myself back in LightDM, on the next login I get the error report telling me about the SIGSEGV in XIGetDeviceProperty().

(*) It seems that opening the lid directly after closing it does not trigger the problem. But when the lid was closed over a few hours, it happens pretty much every time.

What kind of information do you need from me?
I have a Lenovo Thinkpad T430s with the new i5 Ivy Bridge architecture. Ubuntu 12.04, Kernel 3.50, Gnome Shell (but the behaviour was the same in Unity). I can provide more information if you need it.

[Colan Schwartz (colan)]

See #1027457 for crash details.

[Colan Schwartz (colan)]

Sorry, I think this should probably be set back to Triaged.

[Thomas Novin (thomasn80)]

10 crashes like this today, new record. I haven't found a way to reproduce it but I have only seen it (IIRC) while scrolling/using Chromium.

On the other hand, when I'm not working, which I'm now isn't, I mainly use the laptop for web-browsing.

[Yaroslav Halchenko (yarikoptic)]

Reported originally: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681796
Happens with xserver-xorg-core 1.12.1.902-1

top backtrace from gdb:

Program received signal SIGSEGV, Segmentation fault.
XIChangeDeviceProperty (dev=dev@entry=0x7f4bac237fa0, property=<optimized out>, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0, len=len@entry=1,
    value=value@entry=0x7fff092e860f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
772 ../../Xi/xiproperty.c: No such file or directory.
#0 XIChangeDeviceProperty (dev=dev@entry=0x7f4bac237fa0, property=<optimized out>, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0,
    len=len@entry=1, value=value@entry=0x7fff092e860f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
#1 0x00007f4ba813c20f in DisableDevice (dev=0x7f4bac237fa0, sendevent=sendevent@entry=1 '\001') at ../../dix/devices.c:481
#2 0x00007f4ba817e344 in xf86VTSwitch () at ../../../../hw/xfree86/common/xf86Events.c:454
#3 xf86Wakeup (blockData=<optimized out>, err=<optimized out>, pReadmask=<optimized out>) at ../../../../hw/xfree86/common/xf86Events.c:285
#4 0x00007f4ba8146d9b in WakeupHandler (result=result@entry=-1, pReadmask=pReadmask@entry=0x7f4

here is an excerpt from xiproperty.c for that location:

   766 /* run through all handlers with checkonly TRUE, then again with
   767 * checkonly FALSE. Handlers MUST return error codes on the
   768 * checkonly run, errors on the second run are ignored */
   769 do {
   770 handler = dev->properties.handlers;
   771 while (handler) {
   772 if (handler->SetProperty) {
   773 rc = handler->SetProperty(dev, prop->propertyName,
   774 &new_value, checkonly);
   775 if (checkonly && rc != Success) {
   776 free(new_value.data);
   777 return rc;
   778 }
   779 }
   780 handler = handler->next;
   781 }
   782 checkonly = !checkonly;
   783 } while (!checkonly);

[patty (patplh)]

i am having the same exact problem as daniel tedesco.. ever since i installed ubuntu a month ago, immediately, this started happening.. i read online, that it's a problem with nvidia.. and it same to rename an xorg file, which i did, but still having the problem.
seems to happen when i login for the first time after the computer has been asleep .. i have a thinkpad t410

[Angelicfury1 (angelicfury1)]

Crashes atleast 5-10 times a day for me. Lenovo T520 + Sandy bridge i7 quad + integrated graphics. As such, it is not necessarily a problem with nvidia (like patty mentioned above).

[Fabian R. (faeber)]

My laptop regularly crashes with this error message. I think it only happens after having been on standby before.

Strange thing is, i sometimes get this error message:
Xorg crashed with SIGSEGV in XIGetDeviceProperty()

But sometimes i have:
Xorg crashed with SIGSEGV in XIChangeDeviceProperty()

And once i even had:
Xorg crashed with SIGABRT in XIChangeDeviceProperty()

Might it be the same reason with different error messages?

I am on Lenovo Thinkpad T420s here with integrated graphics. No Nvidia running either. Looking at the posts above it might be a Thinkpad'ish problem.

[Garret Kelly (gkelly)]

Experiencing the same issue on a Lenovo T520 running on the integrated graphics chipset. I cannot reproduce it, but have experienced it both in Totem and Google Chrome.

[Manuel Bessler (manuel-bessler)]

Experiencing the same issue on a Thinkpad T520i, but not on X60s, T420, Dell Latitude D510. All are running 12.04 32bit, all on gnome-classic, not Unity.

[dronus (paul-geisler)]

Also affects Lenovo T420s. After resuming from a longer standby period by opening the lid, this crash occurs after about a minute.
I don't experienced this some weeks ago, so it may be caused by a recent update or configuration change. Maybe related to the Intel drivers.

[dronus (paul-geisler)]

As it seems to affect the intel integrated GPUs at most reported cases, I have filed this bug against the xserver-xorg-video-intel package: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1030535

[Thomas Novin (thomasn80)]

Anyone tried updating to latest intel driver? Precise ships 2.17.0 and 2.20.1 is available.

http://www.phoronix.com/scan.php?page=news_item&px=MTE0NDg

https://launchpad.net/~xorg-edgers/+archive/ppa

[Kevin-freedesktop-bugz (kevin-freedesktop-bugz)]

I believe I've been encountering the same crash, though I usually get it a few minutes after resuming from suspend. This is on an ASUS EeePC 1005HA running Debian Wheezy The Debian package is xserver-xorg-core 2:1.12.1.902-1. The log shows this:

[ 12941.730] (--) synaptics: SynPS/2 Synaptics TouchPad: touchpad found
[ 13139.273]
[ 13139.273] Backtrace:
[ 13139.347] 0: /usr/bin/Xorg (xorg_backtrace+0x49) [0xb7772099]
[ 13139.347] 1: /usr/bin/Xorg (0xb75f5000+0x180a86) [0xb7775a86]
[ 13139.347] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xb75d640c]
[ 13139.347] 3: /usr/bin/Xorg (XIChangeDeviceProperty+0x198) [0xb770d188]
[ 13139.348] 4: /usr/bin/Xorg (0xb75f5000+0x118829) [0xb770d829]
[ 13139.348] 5: /usr/bin/Xorg (0xb75f5000+0x10f7d4) [0xb77047d4]
[ 13139.348] 6: /usr/bin/Xorg (0xb75f5000+0x3c365) [0xb7631365]
[ 13139.348] 7: /usr/bin/Xorg (0xb75f5000+0x29e95) [0xb761ee95]
[ 13139.348] 8: /lib/i386-linux-gnu/i686/cmov/libc.so.6 (__libc_start_main+0xe6) [0xb7293e46]
[ 13139.348] 9: /usr/bin/Xorg (0xb75f5000+0x2a1e9) [0xb761f1e9]
[ 13139.348]
[ 13139.349] Segmentation fault at address 0x9
[ 13139.349]
Fatal server error:
[ 13139.349] Caught signal 11 (Segmentation fault). Server aborting

I got a core file as well:

Core was generated by `/usr/bin/Xorg :0 -br -verbose -novtswitch -auth /var/run/gdm3/auth-for-Debian-g'.
Program terminated with signal 11, Segmentation fault.
#0 XIChangeDeviceProperty (dev=dev@entry=0xb7bcd898, property=135, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0, len=len@entry=1,
    value=value@entry=0xbfbfb16f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
772 ../../Xi/xiproperty.c: No such file or directory.
(gdb) bt
#0 XIChangeDeviceProperty (dev=dev@entry=0xb7bcd898, property=135, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0, len=len@entry=1,
    value=value@entry=0xbfbfb16f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
#1 0xb75c2aa3 in DisableDevice (dev=dev@entry=0xb7bcd898, sendevent=sendevent@entry=1 '\001') at ../../dix/devices.c:481
#2 0xb75c2ced in RemoveDevice (dev=dev@entry=0xb7bcd898, sendevent=sendevent@entry=1 '\001') at ../../dix/devices.c:1059
#3 0xb7618fac in DeleteInputDeviceRequest (pDev=0xb7bcd898) at ../../../../hw/xfree86/common/xf86Xinput.c:1013
#4 0xb75be4d0 in CloseDeviceList (listHead=listHead@entry=0xb7784444) at ../../dix/devices.c:964
#5 0xb75befa0 in CloseDownDevices () at ../../dix/devices.c:993
#6 0xb7716595 in AbortServer () at ../../os/log.c:475
#7 0xb77166c5 in FatalError (f=f@entry=0xb773b448 "Caught signal %d (%s). Server aborting\n") at ../../os/log.c:611
#8 0xb770eae8 in OsSigHandler (sip=0xbfbfb4ac, signo=11, unused=<optimized out>) at ../../os/osinit.c:146
#9 OsSigHandler (signo=11, sip=0xbfbfb4ac, unused=0xbfbfb52c) at ../../os/osinit.c:107
#10 <signal handler called>
#11 XIChangeDeviceProperty (dev=0xb7bcd898, property=property@entry=281, type=19, format=format@entry=8, mode=<optimized out>, len=1, value=value@entry=0xb7c52ddc,
    sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772
#12 0xb76a6829 in change_property (data=0xb7c52ddc, len=<optimized out>, mode=<optimi...

[mute (mutewonder)]

I'm on an EeePC 1005ha netbook with Intel graphics, and the crashing happens almost every time the netbook resumes from suspend. Daniel Tedesco's (comment #8) suggestion about long-term suspends might be on target. It's happened since upgrading Ubuntu from 11.10 to 12.04, and usually in Unity. Haven't tried latest Intel driver (comment #19) yet.

[Jonatan Høy Sørensen (jhs-ircaddict)]

I just used drivers linked in here by ThomasNovin, and it still happens.
Thsi timee after logging out, and then back in.

[Gaute (gaute-div)]

I've got this bug on every laptop in the household :-(
an Eee PC 1005HA, an older dell inspiron and my own dell Vostro V131.
I _think_ they all have Intel graphics

[Thomas Novin (thomasn80)]

At least for me, not related to how long you have had the computer in suspend.

Just woke it up after having suspended for ~ 2 minutes, got the crash.

I also had the same issue when I ran Cinnamon in Linux Mint 13 before.. so according to this and a previous comment it's not related to Unity, Gnome Classic or Cinnamon.

[Scott Howard (showard314)]

Look around the internet, I may have found what appears to be upstream reports:

Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681796

Xorg:
http://patchwork.freedesktop.org/patch/11531/

Debian is showing this SIGSEV:
XIChangeDeviceProperty (dev=dev@entry=0x7f4bac237fa0, property=<optimized out>, type=type@entry=19, format=format@entry=8, mode=<optimized out>, mode@entry=0, len=len@entry=1,
    value=value@entry=0x7fff092e860f, sendevent=sendevent@entry=1) at ../../Xi/xiproperty.c:772

And Xorg claims:
is reporting a memory leak:

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with XICreateDeviceProperty(property)
        at line 774 of Xi/xiproperty.c in function 'XIChangeDeviceProperty'.
          'prop' allocated at line 700 with XICreateDeviceProperty(property).
          prop leaks when handler != NULL at line 768
              and handler->SetProperty != NULL at line 769
              and checkonly != 0 at line 772
              and rc != 0 at line 772.

I'll forward this info to Debian and see what they say.

[Scott Howard (showard314)]

Follow up, here's the xorg bug that debian is referring to:
https://bugs.freedesktop.org/show_bug.cgi?id=52496

I linked both to the tracker here.

[Scott Howard (showard314)]

I am not too familiar with this bug, but I can across a recent patch
[1] to x.org to fix a memory leak in XICreateDeviceProperty(), around
the same lines where this crash is happening.

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with XICreateDeviceProperty(property)
        at line 774 of Xi/xiproperty.c in function 'XIChangeDeviceProperty'.
          'prop' allocated at line 700 with XICreateDeviceProperty(property).
          prop leaks when handler != NULL at line 768
              and handler->SetProperty != NULL at line 769
              and checkonly != 0 at line 772
              and rc != 0 at line 772.

The patch is:

diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
index ca73104..4beedcf 100644
--- a/Xi/xiproperty.c
+++ b/Xi/xiproperty.c
@@ -771,6 +771,8 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom
property, Atom type,
                                                   &new_value, checkonly);
                         if (checkonly && rc != Success) {
                             free(new_value.data);
+ if (add)
+ XIDestroyDeviceProperty(prop);
                             return rc;
                         }
                     }

[1] http://patchwork.freedesktop.org/patch/11531/

[Scott Howard (showard314)]

On Thu, Aug 2, 2012 at 5:39 PM, Scott Howard <email address hidden> wrote:
> I am not too familiar with this bug, but I can across a recent patch
> [1] to x.org to fix a memory leak in XICreateDeviceProperty(), around
> the same lines where this crash is happening.

Disregard the above, the patch doesn't fix it for me.

[Rik Shaw (rik-shaw)]

This seems to be simliar to the bug I have been following here:

https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/956071

Largely newer Thinkpads with Intel graphics. I have tested with the xorg "edgers" PPA and still had the issue. I can reproduce the crash by doing successive suspend / wake cycles. Usually crashes (kicks out to lightdm, that is) after 3, but sometimes the 4th wake from suspend. In this case (quick successive suspend / wake attempts by closing the lid), I can see when it crashes because the lenovo "half moon light" remains blinking after the lid is closed (should go solid after suspend achieved).

I should note that in this above case when I open the lid I am already back at the lightdm login screen. Other "real life crash times", the machine wakes up fine, but after approximately 30 seconds to a minute (while using the machine) it kicks me out to the lightdm screen (as others report here).

The above bug report has a few full backtrace calls after one of the reporters heled us get our machines set up to do full reporting. There may be info there that can help here.

[dronus (paul-geisler)]

I've raised the importance as this seems to be the equivalent of a large amount of bug reports on Ubuntu via launchpad. It affects PCs of several vendors, maybe restricted to newer Intel CPU/GPUs. Main launchpad report here: https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/956071

[Peter Hutterer (peter-hutterer)]

Does debian carry any patches? if so, can you reproduce this with a vanilla X server? I just vt-switched about 50 times with 1.12.99.902 but it doesn't happen here.

What desktop environment is this? something is trying to change the property after the VT switch, so I'd need a similar setup here.

Finally, if you can reproduce it easily, can you try running X through valgrind to see if you get any invalid writes?

[Peter Hutterer (peter-hutterer)]

correction, I tried reproducing with 1.12.1.902, i.e. the same version as listed in the original comment.

[Yaroslav Halchenko (yarikoptic)]

(In reply to comment #3)
> Does debian carry any patches?

yes. See
http://patch-tracker.debian.org/package/xorg-server/2:1.12.3-1
for details

> if so, can you reproduce this with a vanilla X
> server? I just vt-switched about 50 times with 1.12.99.902 but it doesn't
> happen here.

Never happened for me while switching VT. although I do not do that regularly... ok -- switched to VT 1 and back (Ctrl-Alt-1 and then randomly Alt-left/right till reaching X) quite a few times (around 10) -- no problem. With suspend I think I would have experienced it by then. Also, may be of relevance:

if X crashes during suspend and I end up again at the kdm login prompt -- I would still have my 'half-moon' light blinking until I switch to e.g. VT 1 -- then it would finally suspend.

> What desktop environment is this?

happened originally with KDE4 + awesome... now it is XFCE + awesome -- the same story

> something is trying to change the property
> after the VT switch, so I'd need a similar setup here.

my ~/.xsession has

    awesome &
    sleep 3
    xfce4-session

> Finally, if you can reproduce it easily, can you try running X through valgrind
> to see if you get any invalid writes?

It is reproducible on around 5-10th occasion on random -- never yet tried to cause it on purpose -- I thought to give it excessive troubleshooting one day... if I get a moment I will run it through valgrind... although if it is some kind of a race condition between threads, it might not get triggered

[Tim Chen (timchen119)]

Create /etc/modprobe.d/bare-psmouse.conf:

options psmouse proto=bare

then I reboot and tried close/open the lid 50 times,
I no longer have Xorg crash issue.

Can anyone still reproduce this issue after this workaround?

[Keng-Yu Lin (lexical)]

More testings here:
  From the fd.o bug it looks like the crash is in xserver-xorg-input-synaptics. I tried to boot with the parameter "psmouse.proto=bare" so that the touchpad is recognized as a generic PS/2 mouse. And I performed 30 cycles of suspends/resumes. There is no crash observed.

  Independently, I downgraded the xserver-xorg-input-synaptics package to 1.5.99.902-0ubuntu5 (just happens in the ddebs archives, its -debsym package is of that version). I performed 30 cycles of suspends/resumes. There is no crash either.

[Rik Shaw (rik-shaw)]

Fix from #31 above seems to be working for me. Great day and thanks for the help!!!

Am posting a reference to the other 2 bugs that seem closely related (sorry, but above in #30 I linked back to this bug, not the other one!):

Here are the other 2 possibly related bugs I will refer back here for them to try the possible fix:

https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/1026777

https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1030535

[Thomas Novin (thomasn80)]

Fix from #31 works to get rid of the crashes but makes the touchpad very impaired (very slow and drag up/down left/right to scroll doesn't work).

So I guess #32 will be a better fix so I suggest to all that use that workaround instead if you use your touchpad!

[Rik Shaw (rik-shaw)]

Thomas in #34 makes a good point. The fix from #31 impairs the functionality of the touchpad. I have changed using the advice from #32, namely installing the previous version of xserver-xorg-input-synaptics in synaptic package manager and then locking the version there. It does seem that this indeed solves the crashes.

[Fabian R. (faeber)]

Checking my update history and my crash logs indicates that the crashes started happening to me after i updated xserver-xorg-input-synaptics from 1.6.0-0ubuntu1~precise1 to 1.6.2-1ubuntu1~precise1.

[Timo Aaltonen (tjaalton)]

yaroslav: could you try reverting the synaptics driver to, say, 1.5.99.902 or .903 and test if you can reproduce the crash? A similar crash has been filed on ubuntu, and there it was discovered that reverting to that version stopped the crashes.

[Timo Aaltonen (tjaalton)]

Hmm, this original bug was filed a month before 1.5.99.902 was released to precise, so it's kind of confusing to see it _fix_ the issue.. Or it was something else back then.

That said, there's probably something weird going on with the driver anyway, so would be great to know what upstream commit(s) broke it. I can't reproduce it myself.

[Yaroslav Halchenko (yarikoptic)]

(In reply to comment #6)
> yaroslav: could you try reverting the synaptics driver to, say, 1.5.99.902 or
> .903 and test if you can reproduce the crash? A similar crash has been filed on
> ubuntu, and there it was discovered that reverting to that version stopped the
> crashes.

yes -- I saw those and also thought to revert BUT IIRC those ubuntu reports were primarily about (similar) crash upon resume, while mine is consistently occurring upon suspend; so I was not sure if that would be it. Today, while connected via usb-serial port thought to replicate to get better interactive gdb session so I could possibly figure out more but tried around 10 times to suspend/resume -- didn't happen :-/

heh-- but I guess it might be worth anyways -- if it crashes, I would get to the same point if I would be ready to debug ;) if not -- then you might not hear from me for a week or so since as I said it would be difficult to say for sure that it helped without waiting for so long ;)

[Rik Shaw (rik-shaw)]

I agree that it does appear that this bug report was possibly "hijacked" as the OP issues arose before. A majority of the comments are after July 18, with nothing between March and July.

But as the OP hasn't been involved since March, it is hard to know what the status of the "original bug" is.

If necessary maybe this bug can be left open and the work on finding the problem with the newer version of the xserver-xorg-input-synaptics could be tied to one of the more recent "duplicates" (https://bugs.launchpad.net/bugs/1026777) and the two could be separated as not being duplicates.

Without input from the OP it seems to be uncertain.

[Jonatan Høy Sørensen (jhs-ircaddict)]

I have still been followin this bug report, but I have been busy lately, so I haven't been able to participate.

The problem is still occuring, but I am not sure if it's the same bug as other posters.
 Also, as the outcome of both bugs seems to be the same, makes me uncertain if the original bug has been fixed, but this new one appeared, or what.

There was a period where the bug didn't happen as often(of it even happened at all) so that might have been the case.

[Timo Aaltonen (tjaalton)]

I lied, just got this with my T420s. It was my wife's session that crashed, my own was fine. Not directly related to suspend I think, there's a VT change involved when changing user sessions (mine was the active one). Synaptics seems to reprobe itself after the VT change -> (occasional) boom.

It's possible that Jonatan's issue got fixed, and then when we updated -synaptics the crashes started again.

[Rik Shaw (rik-shaw)]

Timo or Jonatan,

Can either of you comment on "how" the crash happens? My issue (and I think several others) was that I was kicked out to lightdm. If you are getting actual freezes then this does seem separate.

If that is the case, maybe it is best to "separate the bug reports" and mark the other one as being "worked around" with the synaptics reversion, while this one does not yet have a work around?

[Daniel Tedesco (anmeldemails+launchpad)]

Downgrading xserver-xorg-input-synaptics to version 1.5.99.902 did not fix the issue for me.
I just opened the lid after a suspend of approximately 40 minutes and got kicked out to lightdm
about 30 seconds later.

[Thomas Novin (thomasn80)]

@Daniel: Did you reboot?

[Daniel Tedesco (anmeldemails+launchpad)]

Disregard comment #46. The package had been upgraded again during the following update.
I have now locked the version to 1.5.99.902 and will see how that behaves.

[joeaguy (joeaguy)]

I did a downgrade of xserver-xorg-input-synaptics to 1.5.99.902 and have not had a crash since. I have a Lenovo t420s.

[Daniel Tedesco (anmeldemails+launchpad)]

The downgrade also is working for me. No crash since I downgraded and locked xserver-xorg-input-synaptics to 1.5.99.902.

[Yaroslav Halchenko (yarikoptic)]

ok -- downgrade to xserver-xorg-input-synaptics 1.5.99.902-1 (debian package) built with -O0 -- no crashes within a week -- so I guess it is indeed synaptics to blame. If I find a chance I will "upgrade" to 1.6.0 and see if crash comes back... I would hate to do such silly bisection but I guess it would be better than doing nothing and simply waiting ;-)

[Eloy Paris (peloy-chapus)]

I have been running xserver-xorg-input-synaptics version 1.6.0-0ubuntu1~precise1 for about a week and have not experienced the X server crash reported here.

[Peter Hutterer (peter-hutterer)]

sorry, still can't reproduce this and I can't see any change between 902 and 1.6.2 that could have introduced this bug. Are you still on server 1.12.1.902 or have you updated the server as well?

[Gaute (gaute-div)]

Just to chime in about 1.5.99.902-0ubuntu5.
No crashes for 3 days.

[Pirouette Cacahuète (lissyx)]

I have similar issue, ThinkPad T420s. System randomly but constantly crashes when suspending after closing the lid for a couple of weeks now. My xserver-xorg-input-synaptics is 1.6.2-1ubuntu1~precise1.

I did not went down the road of downgrading this one, but I tried suspending by hand before closing the lid, and I don't experience the issue once I do it. As soon as I get back just closing the lid and hoping it suspends correctly, I end up disappointed by a crash. So this seems a trivial but nice workaround for now.

[dafreez (dafreez-gmail)]

I have this problem onan Asus EEE-PC with Atom N280

Ocasionally, but not always, after the crah when I use shutdown/restart it just logsout again.

[Yaroslav Halchenko (yarikoptic)]

I have upgraded xorg server quite a while ago and it had not resolved the issue at that time. Just for the completness:

/var/log/dpkg.log.1:2012-07-03 09:53:04 status installed xserver-xorg:amd64 1:7.6+13
/var/log/dpkg.log.1:2012-07-03 09:53:04 status installed xorg:amd64 1:7.6+13
/var/log/dpkg.log.1:2012-07-11 14:56:36 status installed xserver-xorg-core:amd64 2:1.12.1.902-1
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg-video-vesa:amd64 1:2.3.1-1+b1
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg-video-intel:amd64 2:2.19.0-4
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg-video-fbdev:amd64 1:0.4.2-4+b3
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg-video-dummy:amd64 1:0.3.5-2+b1
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg-video-apm:amd64 1:1.2.3-3
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg-input-void:amd64 1:1.4.0-1+b1
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg-input-synaptics:amd64 1.6.2-1
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg-input-evdev:amd64 1:2.7.0-1+b1
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg:amd64 1:7.7+1
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xorg:amd64 1:7.7+1
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xserver-xorg-dev:amd64 2:1.12.1.902-1
/var/log/dpkg.log.1:2012-07-11 16:22:02 status installed xorg-dev:all 1:7.7+1
/var/log/dpkg.log.1:2012-07-16 11:43:34 status installed xserver-xorg-core-dbg:amd64 2:1.12.1.902-1
/var/log/dpkg.log.1:2012-07-16 11:43:34 status installed xserver-xorg-video-intel-dbg:amd64 2:2.19.0-4
/var/log/dpkg.log.1:2012-07-21 15:35:55 status installed xserver-xorg-core:amd64 2:1.12.3-1
/var/log/dpkg.log.1:2012-07-21 15:35:55 status installed xserver-xorg-core-dbg:amd64 2:1.12.3-1
/var/log/dpkg.log.1:2012-07-21 15:35:55 status installed xserver-xorg-dev:amd64 2:1.12.3-1
/var/log/dpkg.log.1:2012-07-25 09:18:55 status installed xserver-xorg-dev:amd64 2:1.12.3-1
/var/log/dpkg.log.1:2012-07-25 09:18:55 status installed xserver-xorg-core:amd64 2:1.12.3-1
/var/log/dpkg.log.1:2012-07-25 09:18:57 status installed xserver-xorg-core-dbg:amd64 2:1.12.3-1
/var/log/dpkg.log.1:2012-07-25 09:19:58 status installed xserver-xorg-dev:amd64 2:1.12.3-1
/var/log/dpkg.log.1:2012-07-25 09:19:58 status installed xserver-xorg-core:amd64 2:1.12.3-1
/var/log/dpkg.log.1:2012-07-25 09:20:00 status installed xserver-xorg-core-dbg:amd64 2:1.12.3-1
/var/log/dpkg.log.1:2012-07-26 20:15:33 status installed xserver-xorg-core-dbg:amd64 2:1.12.3-1
/var/log/dpkg.log:2012-08-08 23:12:08 status installed xserver-xorg-input-synaptics:amd64 1.6.2-1
/var/log/dpkg.log:2012-08-09 11:00:56 status installed xserver-xorg-input-synaptics-dev:all 1.5.99.902-1
/var/log/dpkg.log:2012-08-09 11:00:56 status installed xserver-xorg-input-synaptics:amd64 1.5.99.902-1
/var/log/dpkg.log:2012-08-15 12:45:23 status installed xserver-xorg-input-synaptics-dev:all 1.6.2+git44-ge28575b-1~yarik0
/var/log/dpkg.log:2012-08-15 12:45:23 status installed xserver-xorg-input-synaptics:amd64 1.6.2+git44-ge28575b-1~yarik0

as ...

[Peter Hutterer (peter-hutterer)]

*** Bug 53686 has been marked as a duplicate of this bug. ***

[Ron Aaron (ron-ronware)]

Happens for mo on Lenovo G560, with kubuntu 12.04 latest updates.

When I manually sleep, the bug does not occur (at least, so far)

[Maarten Lankhorst (mlankhorst)]

I get 2 different corruptions right now it seems on xorg 1.13rc4, with --free-file=df:

First one is synaptics out of bounds..

==3097== Invalid write of size 4
==3097== at 0xAEBFE95: UpdateTouchState.isra.12 (synaptics.c:3132)
==3097== by 0xAEC1532: HandleState (synaptics.c:3224)
==3097== by 0xAEC3F73: ReadInput (synaptics.c:1725)
==3097== by 0x19B656: xf86SigioReadInput (xf86Events.c:298)
==3097== by 0x1C4C97: xf86SIGIO (sigio.c:110)
==3097== by 0x56D9CAF: ??? (in /lib/x86_64-linux-gnu/libpthread-2.15.so)
==3097== by 0x56D8D0D: __read_nocancel (syscall-template.S:82)
==3097== by 0x2B8525: _XSERVTransSocketRead (unistd.h:45)
==3097== by 0x2B2FC0: ReadRequestFromClient (io.c:332)
==3097== by 0x15D878: Dispatch (dispatch.c:399)
==3097== by 0x14C559: main (main.c:295)
==3097== Address 0xaae8da8 is 0 bytes after a block of size 8 alloc'd
==3097== at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3097== by 0xAEC0F13: DeviceControl (synaptics.c:1277)
==3097== by 0x153082: ActivateDevice (devices.c:547)
==3097== by 0x1AA30D: xf86NewInputDevice (xf86Xinput.c:858)
==3097== by 0x1C0655: device_added (udev.c:231)
==3097== by 0x1C0CB2: config_udev_init (udev.c:386)
==3097== by 0x1BFC08: config_init (config.c:48)
==3097== by 0x19DB4D: InitInput (xf86Init.c:989)
==3097== by 0x14C518: main (main.c:265)
==3097==

then immediately after that some invalid event:

==3097==
==3097== More than 100 errors detected. Subsequent errors
==3097== will still be recorded, but in less detail than before.
==3097== Invalid read of size 8
==3097== at 0x19BDC9: xf86Wakeup (xf86Events.c:276)
==3097== by 0x161D9A: WakeupHandler (dixutils.c:423)
==3097== by 0x2ADCD3: WaitForSomething (WaitFor.c:224)
==3097== by 0x15D790: Dispatch (dispatch.c:357)
==3097== by 0x14C559: main (main.c:295)
==3097== Address 0x235092c0 is 32 bytes inside a block of size 40 free'd
==3097== at 0x4C2A82E: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3097== by 0x19BB4A: xf86RemoveGeneralHandler (xf86Events.c:670)
==3097== by 0x1C5841: lnxCloseACPI (lnx_acpi.c:174)
==3097== by 0x1C58C9: lnxACPIGetEventFromOs (lnx_acpi.c:68)
==3097== by 0x1A993E: xf86HandlePMEvents (xf86PM.c:208)
==3097== by 0x19BDC8: xf86Wakeup (xf86Events.c:279)
==3097== by 0x161D9A: WakeupHandler (dixutils.c:423)
==3097== by 0x2ADCD3: WaitForSomething (WaitFor.c:224)
==3097== by 0x15D790: Dispatch (dispatch.c:357)
==3097== by 0x14C559: main (main.c:295)
==3097==
==3097== Invalid read of size 4
==3097== at 0x19BD89: xf86Wakeup (xf86Events.c:277)
==3097== by 0x161D9A: WakeupHandler (dixutils.c:423)
==3097== by 0x2ADCD3: WaitForSomething (WaitFor.c:224)
==3097== by 0x15D790: Dispatch (dispatch.c:357)
==3097== by 0x14C559: main (main.c:295)
==3097== Address 0xdfdfdfdfdfdfdff7 is not stack'd, malloc'd or (recently) free'd

Which causes it to dump core at this point..

[Jesse Glick (jesse-glick)]

Also no crashes for four days using 1.5.99. Maybe the update center could roll back to this version while the problem is being investigated?

$ sudo apt-get install xserver-xorg-input-synaptics=1.5.99.902-0ubuntu5 && echo 'xserver-xorg-input-synaptics hold' | sudo dpkg --set-selections && dpkg -s xserver-xorg-input-synaptics

[dafreez (dafreez-gmail)]

I can also confirm that downgrading to xserver-xorg-input-synaptics=1.5.99.902 appears to have solved the problem.

[Thomas Novin (thomasn80)]

Argh! Lost data today from a Xorg-crash because xserver-xorg-input-synaptics had been upgraded even though locked in Synaptic. It seems unattended-upgrades don't care about that version lock.

This solves that, create /etc/apt/apt.conf.d/99unattended-upgrades with this content:

// List of packages to not update
Unattended-Upgrade::Package-Blacklist {
      "xserver-xorg-input-synaptics";
};

[Thomas Novin (thomasn80)]

Noted that Ubuntu 12.04.1 was released today. Unless xserver-xorg-input-synaptics was downgraded for this release, very non-serious to have a bug of this significance in such release. A bug that is probable to lead to data loss should be of the highest importance?

[zity (zdevai)]

Can also confirm that downgrading the package solves the issue.

Also found a way to reproduce the bug (on a Lenovo T420s):
1. Boot, set the cursor to an empty space on the desktop
2. Quickly toggle the touchpad enable/disable button (Fn+F8) while
    simultaneously tapping the touchpad
3. The bug will be triggered after about 30-40 taps/toggles

[Maarten Lankhorst (mlankhorst)]

After suspending/resuming I notice this error repeated a whole lot of times
on xorg 1.13rc4 + synaptics 1.6.2 (with finger on touchpad while suspending/resuming by closing lid and pressing power button to wake up):

==3097== Invalid write of size 4
==3097== at 0xAEBFE95: UpdateTouchState.isra.12 (synaptics.c:3132)
==3097== by 0xAEC1532: HandleState (synaptics.c:3224)
==3097== by 0xAEC3F73: ReadInput (synaptics.c:1725)
==3097== by 0x19B656: xf86SigioReadInput (xf86Events.c:298)
==3097== by 0x1C4C97: xf86SIGIO (sigio.c:110)
==3097== by 0x56D9CAF: ??? (in /lib/x86_64-linux-gnu/libpthread-2.15.so)
==3097== by 0x56D8D0D: __read_nocancel (syscall-template.S:82)
==3097== by 0x2B8525: _XSERVTransSocketRead (unistd.h:45)
==3097== by 0x2B2FC0: ReadRequestFromClient (io.c:332)
==3097== by 0x15D878: Dispatch (dispatch.c:399)
==3097== by 0x14C559: main (main.c:295)
==3097== Address 0xaae8da8 is 0 bytes after a block of size 8 alloc'd
==3097== at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3097== by 0xAEC0F13: DeviceControl (synaptics.c:1277)
==3097== by 0x153082: ActivateDevice (devices.c:547)
==3097== by 0x1AA30D: xf86NewInputDevice (xf86Xinput.c:858)
==3097== by 0x1C0655: device_added (udev.c:231)
==3097== by 0x1C0CB2: config_udev_init (udev.c:386)
==3097== by 0x1BFC08: config_init (config.c:48)
==3097== by 0x19DB4D: InitInput (xf86Init.c:989)
==3097== by 0x14C518: main (main.c:265)

I guess if it happens multiple times it could get out of bounds enough to cause overflow..

[Rik Shaw (rik-shaw)]

I am experiencing some crashes again after resuming from suspend. The xserver-xorg-input-synaptics is indeed at the prior version, and for at least a few weeks this seemed to solve the issues (to reveiw, for me at least on my Thinkpad T520 the problem occurred in me being kicked out to the login screen).

However, the last few weeks there have been some other crashes. These "new" crashes have the mouse pointer moving, but can't click on Unity top bar or launcher. Keyboard also appears locked. Hard reboot required. Has anyone else experienced these issues? I am guessing a different xorg bug?

[Scott Howard (showard314)]

Upgrading to critical:
This is a bug that meets all of the following:
"A bug which has a severe impact on a large portion of Ubuntu users

    Causes data corruption
    Crashes the entire operating system
    Renders the system temporarily or permanently unusable
    Severely affects applications beyond the package responsible for the root cause "

[Thomas Novin (thomasn80)]

Had a crash today after resuming even with the downgraded xorg synaptics.

Attaching my Xorg.0.log.old.

[B.M. (maresr12temp)]

I have been reproducing this on my Acer Aspire 1410-2285 (year 2009) for several weeks now. Graphics processor is Intel GMA 4500MHD. I will report back after further testing. (Have to suspend now, and not sure my browser will survive the resume.)

[dronus (paul-geisler)]

Me too had no crashes since downgrading to 1.5.99.902-ubuntu5 .

For all those who also downgraded, please check again if you downgraded to that version or earlier, and that the packaged is 'locked' after the old version is forced to prevent it being upgraded again. Also there where some reports that unattended updates don't care for the lock sometimes, so it would be useful to check the version actually used on every crash.

[Thomas Novin (thomasn80)]

I have had one crash on 1.5.99.902-0ubuntu5. That is the crash log in post #70.

With this older version my touchpad never works after resuming from suspend.

If I reboot and login, it works but after suspend / resume it's dead.. except for scrolling!

[Anders Glent Buch (andersgb1)]

I can confirm the exact behavior that ThomasNovin describes, using 1.5.99.902-0ubuntu5 on my Lenovo W520.

[bitinerant (bitinerant)]

The "except for scrolling" phrase from ThomasNovin really caught my attention because, on two laptops using xserver-xorg-input-synaptics 1.5.99.902, I have seen the touchpad become inoperable except for scrolling. I have both configured for two-finger scrolling, and when this happens, it switches to 'one-finger scrolling' with no way to move the pointer position. Sometimes it is fixed with "sudo modprobe -r psmouse; sleep 2; sudo modprobe psmouse" but sometimes this crashes Xorg (back to login screen). What is different, however, is that rather than happening at resume, it happens randomly, perhaps more during high CPU usage.

It seems to me that the 'one-finger scrolling' is a different bug.

[Peter Hutterer (peter-hutterer)]

Thanks! that really helped finding the issue

http://patchwork.freedesktop.org/patch/11873/

[dafreez (dafreez-gmail)]

While downgrading has solved this crash fo me I also occasionaly still get the freeze described in post 68. Anyone have an idea what this might be related to?
Instead of a hard reboot you can use ctr-alt-f1 to get a teminal, login and issue the command 'pkill -KILL -t tty7' which should send you back to the login screen

[Launchpad Janitor (janitor)]

This bug was fixed in the package xserver-xorg-input-synaptics - 1.6.2-1ubuntu5

---------------
xserver-xorg-input-synaptics (1.6.2-1ubuntu5) quantal; urgency=low

  * Added 130_reset-num_active_touches-on-deviceoff.patch (LP: #956071)
 -- Timo Aaltonen <email address hidden> Thu, 30 Aug 2012 20:13:39 +0300

[Timo Aaltonen (tjaalton)]

thanks for the patch, fixed it for me!

[Timo Aaltonen (tjaalton)]

tested the patch locally with precise and it works

[Peter Hutterer (peter-hutterer)]

commit a245d42f53096b1ae81e6702729f97ca508e5b5b
Author: Peter Hutterer <email address hidden>
Date: Thu Aug 30 16:38:38 2012 +1000

    Reset num_active_touches on DeviceOff (#52496)

[Chris Halse Rogers (raof)]

Hello Jonatan, or anyone else affected,

Accepted xserver-xorg-input-synaptics into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/xserver-xorg-input-synaptics/1.6.2-1ubuntu1~precise2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[dronus (paul-geisler)]

If I understand the fix right, there may be a method to reliable reproduce this error with the buggy version, and thus check the fix after updating:

- Put two or more fingers to the touchpad
- Send the computer to standby, or disable the pad if hotkey exists with the fingers still on the pad
- Remove the fingers
- Resume the computer or enable the touchpad again
- Place some fingers on the pad again

On the first or after just a few of these cycles the computer should crash.

Can anyone still affected by this bug check this out?

[Daniel Tedesco (anmeldemails+launchpad)]

The fix does not work for me. It crashed again.

[David (sheepweevil)]

This affects me on a T410i with integrated graphics:
Backtrace:
[ 8987.859] 0: /usr/bin/X (xorg_backtrace+0x37) [0xb76a2627]
[ 8987.859] 1: /usr/bin/X (0xb751a000+0x18c3aa) [0xb76a63aa]
[ 8987.859] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xb74f740c]
[ 8987.859] 3: /usr/bin/X (XIGetDeviceProperty+0x38) [0xb763ad08]
[ 8987.859] 4: /usr/bin/X (0xb751a000+0x120db7) [0xb763adb7]
[ 8987.859] 5: /usr/bin/X (0xb751a000+0x12140f) [0xb763b40f]
[ 8987.859] 6: /usr/bin/X (0xb751a000+0x116f97) [0xb7630f97]
[ 8987.859] 7: /usr/bin/X (0xb751a000+0x3791d) [0xb755191d]
[ 8987.859] 8: /usr/bin/X (0xb751a000+0x2535a) [0xb753f35a]
[ 8987.859] 9: /lib/i386-linux-gnu/libc.so.6 (__libc_start_main+0xf3) [0xb717c4d3]
[ 8987.859] 10: /usr/bin/X (0xb751a000+0x25699) [0xb753f699]
[ 8987.859] Segmentation fault at address 0xd
[ 8987.859]
Caught signal 11 (Segmentation fault). Server aborting

lshw display information:
        *-display
             description: VGA compatible controller
             product: Core Processor Integrated Graphics Controller
             vendor: Intel Corporation
             physical id: 2
             bus info: pci@0000:00:02.0
             version: 02
             width: 64 bits
             clock: 33MHz
             capabilities: msi pm vga_controller bus_master cap_list rom
             configuration: driver=i915 latency=0
             resources: irq:42 memory:f2000000-f23fffff memory:d0000000-dfffffff ioport:1800(size=8)

Trying out the proposed fix soon.

[Scott Howard (showard314)]

No crashes in 4 days from the package in precise-proposed, looks good so far.

[Romano Giannetti (romano-giannetti)]

The method for triggering the bug explained in #81 does not work for me. Is still useful to test the package from -proposed?

[James M. Leddy (jm-leddy)]

Marking verification-done based on comment #84

In response to comment #85, it's probably not useful for you to test proposed unless you can reliabley reproduce with the -updates package _or_ you know that this bug triggers frequently enough that when you install the new package you know it's fixed because it doesn't crash.

[Ghislain Vaillant (ghisvail)]

In my case, I get a similar crash (same title in Apport than in this bug) but it happens on both supsend/resume and cold boot. Not sure if I should test the fix in -proposed or open a different bug report. My machine is a Vostro V131 running 12.04. Please let me know what you think I should do.

[dafreez (dafreez-gmail)]

Since updating to the fixed package, no more crashes whatsoever. Very happy;)

[Nathaniel Beaver (nathanielmbeaver)]

I tried 1.6.2-1ubuntu1~precise2. No crashes, but the touchpad doesn't work either. It worked briefly, then stopped working even after reboot.

[Thomas Novin (thomasn80)]

System is doing fine on 1.6.2-1ubuntu1~precise2 regarding crashes.

However, touchpad does not work OK! That little red pointer-thing (on my Lenovo) works though. Also scrolling on the touchpad works.

Ubuntu developers: Are you going to reset bug status to confirmed or whatever or do we need to open a new bug for this regression?

[Scott Kitterman (kitterman)]

Thomas: Is the touchpad problem fixed if you downgrade back to the previous package?

[Donald Siuchninski (dsiuchninski)]

Still broken.

Using a Lenovo t410 - Intel ® Integrated Graphics and NVIDIA® NVS3100M Discrete Graphics

Bubmblebee is installed.

I can confirm that this does not happen without bumblebee.

For me, logoff occurs immediately after returning from suspend. I then get this message:

"An problem has been detected." Followed by an apport popup that doesn't seem to work.

[dronus (paul-geisler)]

I can confirm that 1.6.2-1ubuntu1~precise2 doesn't completely fix the bug on Lenovo T420s.

While I have not seen any random crashes for some time, the touchpad can still be killed by the test described in #81. After some cycles of disabling it by hotkey with fingers on and reenabling with fingers off the pad is not working anymore. However, this procedure doesn't crash X so far, as it reliably does with ..~precise1 before.

[Thomas Novin (thomasn80)]

@Scott: I never noticed this problem when I was on 1.6.2-1ubuntu1~precise1. I now run 1.6.2-1ubuntu1~precise1 since it was released to proposed and I have only noticed the touchpad problem twice since. Right now it's working fine even though I have done several suspend / resumes. So I cannot reproduce "breaking" it.

[Adam Conrad (adconrad)]

Adding a regression-proposed tag for now to prevent migration until we can get some more feedback as to how this is better (no crashing sounds good) or worse (it seems some touchpads don't work when they previously did?) than the previous version.

[Romano Giannetti (romano-giannetti)]

Well, I could not trigger the bug, but had crashes every few hours. Since when updating to the proposed package, I had no more crashes - can't be 100% sure it's fixed, given the random nature of the thing, but it seems ok, and it's for sure much better than before.

[Timo Aaltonen (tjaalton)]

My findings so far (with my T420s):

- disabling the touchpad with 'xinput disable/enable' works as many times as I like
- disabling the touchpad with the hotkey fails to enable it, even though the logfile gets a new "touchpad found" entry, and the same with the old driver version... Logging out (=xserver restart) makes it work again

so I'm not sure if it really has regressed with the new version. Would still like to know if downgrading the driver (to ~precise1) makes it work again for Nathaniel or others.

[Nathaniel Beaver (nathanielmbeaver)]

Touchpad works now. I tried downgrading and upgrading with logout or reboot, but I cannot reproduce thus far. ~precise2 hasn't crashed yet.

[patty (patplh)]

i installed the update a few days ago and have only had one crash since (and it was the same day as the update).. i use to have them almost consistently everytime i went out of suspend (at least 4 times a day).

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xserver-xorg-input-synaptics - 1.6.2-1ubuntu1~precise2

---------------
xserver-xorg-input-synaptics (1.6.2-1ubuntu1~precise2) precise-proposed; urgency=low

  * Added 130_reset-num_active_touches-on-deviceoff.patch (LP: #956071)
 -- Timo Aaltonen <email address hidden> Thu, 30 Aug 2012 20:32:12 +0300

[Timo Aaltonen (tjaalton)]

The hotkey bug is a separate issue and needs to be tracked elsewhere. It's likely reported already, so if someone knows the master bug for it, please add a link here. Otherwise I'll file it and do the same.

[Timo Aaltonen (tjaalton)]

the hotkey bug for thinkpads at least is bug 804109

[Romano Giannetti (romano-giannetti)]

Great. Is there any instruction on how to undo the - proposal activation ? I used the method described in the wiki to add only this package (the trick with priorities), is deselecting the proposed repository sufficient? Thanks!

[Timo Aaltonen (tjaalton)]

Romano: disable it from the software center (edit - app sources - updates)

[Jesse Glick (jesse-glick)]

1.6.2-1ubuntu1~precise2 still occasionally crashing for me with what seems to be the same SIGSEGV, under similar conditions as before (as in comment #6—unlocking screen after longish period of inactivity).

[Rephorm-b (rephorm-b)]

Although this patch makes the situation much better, it looks like a similar bug is present elsewhere. Using git commit On git rev 3cb14dcccf5574366d90e24f351e3ad04b35e35f, I see an occasional crash after several days of using a laptop with ~10 suspensions per day.

The following diagnostic messages and backtrace appears three times in the Xorg log before Xorg quits:

[121305.099] BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
[121305.099] BUG: synaptics.c:2615 in UpdateTouchState()
[121305.099]
[121305.099] Backtrace:
[121305.384] 0: /usr/bin/X (xorg_backtrace+0x36) [0x560366]
[121305.384] 1: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7ff504292000+0x2c47) [0x7ff504294c47]
[121305.384] 2: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7ff504292000+0x4cdb) [0x7ff504296cdb]
[121305.384] 3: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7ff504292000+0x6744) [0x7ff504298744]
[121305.384] 4: /usr/bin/X (0x400000+0x6efd7) [0x46efd7]
[121305.384] 5: /usr/bin/X (0x400000+0x93370) [0x493370]
[121305.384] 6: /usr/lib/libpthread.so.0 (0x7ff508a94000+0xf170) [0x7ff508aa3170]
[121305.384] 7: /usr/bin/X (0x400000+0x164540) [0x564540]
[121305.384] 8: /usr/lib/libpthread.so.0 (0x7ff508a94000+0xf170) [0x7ff508aa3170]
[121305.384] 9: /usr/lib/libc.so.6 (0x7ff50791f000+0x7ba57) [0x7ff50799aa57]
[121305.384] 10: /usr/lib/libc.so.6 (__libc_malloc+0x70) [0x7ff50799be50]
[121305.389] 11: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x3fa6d) [0x7ff505aaaa6d]
[121305.389] 12: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x4b7b8) [0x7ff505ab67b8]
[121305.389] 13: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x4d09b) [0x7ff505ab809b]
[121305.389] 14: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x80d9b) [0x7ff505aebd9b]
[121305.389] 15: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x813b3) [0x7ff505aec3b3]
[121305.389] 16: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7ff505a6b000+0x88466) [0x7ff505af3466]
[121305.390] 17: /usr/bin/X (0x400000+0xebc5b) [0x4ebc5b]
[121305.390] 18: /usr/bin/X (0x400000+0x34531) [0x434531]
[121305.390] 19: /usr/bin/X (0x400000+0x23615) [0x423615]
[121305.390] 20: /usr/lib/libc.so.6 (__libc_start_main+0xf5) [0x7ff507940725]
[121305.390] 21: /usr/bin/X (0x400000+0x238ed) [0x4238ed]

[Peter Hutterer (peter-hutterer)]

Hard to read the backtrace without symbols, but please try to find a reproducible test-case. The number of fingers on the touchpad at suspend time vs at resume time is almost certainly the trigger for this, but I haven't found a reliable trigger yet.

[Jesse Glick (jesse-glick)]

1.6.2-1ubuntu1~precise2 which I think has this patch, and also 1.5.99, continue to crash for me with this SEGV on occasion, shortly but not immediately after unlocking the screen (not necessarily after resume from suspend). No clear way to reproduce. Anything that can be done to help? (Any all-in-one instructions available for rebuilding X + drivers with symbols and running through Valgrind?)

[Moondrake (moondrake)]

A couple of weeks ago I experienced a similar bug once or twice (at least a similar backtrace as in comment 16), but I also did not have symbols installed.

However, it may be noteworthy that I did not trigger it by a resume, but by putting very heavy load on the machine. I have not done so since, but I will try to get some better debug info when I have time to try and reproduce this.

[Moondrake (moondrake)]

I am not sure if it is still the same issue, but the last comments in this bug are very similar to what is reported in bug 55821.

A reproducible test case I could not find. It just happens during normal use, though a heavy load (suspend/resume) may trigger it quicker. It is hard to be really sure of this however.

This is on a Lenovo T410 with fedora 18 (note: I think 17 did not have this problem).

EE) BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
(EE) BUG: synaptics.c:3122 in UpdateTouchState()
(EE)
(EE) Backtrace:
(EE) 0: /usr/bin/X (xorg_backtrace+0x36) [0x46c496]
(EE) 1: /usr/lib64/xorg/modules/input/synaptics_drv.so (0x7fda46838000+0x2e97) [0x7fda4683ae97]
(EE) 2: /usr/lib64/xorg/modules/input/synaptics_drv.so (0x7fda46838000+0x4593) [0x7fda4683c593]
(EE) 3: /usr/lib64/xorg/modules/input/synaptics_drv.so (0x7fda46838000+0x6fd2) [0x7fda4683efd2]
(EE) 4: /usr/bin/X (0x400000+0x89747) [0x489747]
(EE) 5: /usr/bin/X (0x400000+0xb2e88) [0x4b2e88]
(EE) 6: /lib64/libpthread.so.0 (0x35ea800000+0xf000) [0x35ea80f000]
(EE) 7: /lib64/libc.so.6 (__select+0x13) [0x35ea0eb773]
(EE) 8: /usr/bin/X (WaitForSomething+0x190) [0x469a10]
(EE) 9: /usr/bin/X (0x400000+0x39301) [0x439301]
(EE) 10: /usr/bin/X (0x400000+0x280ba) [0x4280ba]
(EE) 11: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x35ea021a05]
(EE) 12: /usr/bin/X (0x400000+0x283fd) [0x4283fd]
(EE)

(gdb) info symbol 0x2e97
UpdateTouchState.isra.12 + 167 in section .text of /usr/lib64/xorg/modules/input/synaptics_drv.so
(gdb) info symbol 0x4593
HandleState + 499 in section .text of /usr/lib64/xorg/modules/input/synaptics_drv.so
(gdb) info symbol 0x6fd2
ReadInput + 130 in section .text of /usr/lib64/xorg/modules/input/synaptics_drv.so

(gdb) info symbol 0x489747
xf86SigioReadInput + 39 in section .text of /usr/bin/X
(gdb) info symbol 0x4b2e88
xf86SIGIO + 440 in section .text of /usr/bin/X

Touchpad is locked into "scrolling". A possible solution is probably to not increase num_active_touches if priv->num_active_touches > priv->num_slots.
But this would obviously not fix the underlying cause (just fix the annoying loss of trackpad).

[Jesse Glick (jesse-glick)]

FWIW this bug only happens to me when unlocking the screen saver, usually though not always after a resume from suspend. I think it happens when I start typing a password quickly and right away. (The crash does not happen immediately—a few seconds later.)

If I take care to wait a moment until the caret in the password text field is blinking steadily I seem to be able to avoid it. This hypothesis would explain why the crash seems to happen most often when the computer is under load (either from a resume, or because there is a substantial background process like a big compile)—in such cases the screen saver GUI is a little slower to react.

Alternatively it is possible the crash is related to my fingers accidentally brushing the touchpad while typing the password.

[Jan Schmidt (thaytan)]

*** Bug 55821 has been marked as a duplicate of this bug. ***

[Peter Hutterer (peter-hutterer)]

There are suggestions that http://lists.x.org/archives/xorg-devel/2012-October/034149.html helps with this issue, but unconfirmed so far.

[Moondrake (moondrake)]

My eeepc running mint has suddenly (after an update) also started to exhibit this bug. It is starting to get annoying! I will try the patch mentioned in the coming days (but confirmation can take some time, I only hit this once a week or less).

[Moondrake (moondrake)]

Hmm, Peter, can you confirm that patch is already in Fedora 18. It seems to have been merged as part of:
* Tue Oct 30 2012 Peter Hutterer <email address hidden> 1.13.0-6
- Add touchscreen fixes (including pointer emulation) #871064

So unless it was reverted by a later patch (at 1.13.2-1 now), this is not it (unless these fixes are causing it instead of preventing it, but that is not what you meant is it?)

[Peter Hutterer (peter-hutterer)]

right, that was the one and it hasn't been reverted, it just got integrated into upstream 1.13.1 so we don't need the patch anymore. back to the drawing board.

[Jesse Glick (jesse-glick)]

I have not encountered this bug after upgrading to Raring.

[Jesse Glick (jesse-glick)]

Have not yet seen this bug in xserver-xorg-input-synaptics 1.6.2-1ubuntu6 (Raring).

[N-charles (n-charles)]

I'm seeing this on an Lenovo T420. I frequently see it when coming out of hibernation (because my system is still swapping in).

I can "recover" by suspending to memory and then unresponding. At that point the touchpad works again just fine without restarting X.

Debian Wheezy:
xserver-xorg-input-synaptics 1.6.2-2 amd64

[N-charles (n-charles)]

I can still produce this bug on Debian stable. It requires me to run a process that does a lot of random io in a a large file, such that some swap is consumed.

I also had an instance of X crashing as a result:

[ 84441.029] BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
[ 84441.029] BUG: ../../src/synaptics.c:3122 in UpdateTouchState()
[ 84441.029]
[ 84441.029] Backtrace:
[ 84441.029] 0: /usr/bin/X (xorg_backtrace+0x36) [0x7f9db58fbd16]
[ 84441.029] 1: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x3067) [0x7f9dafb4b067]
[ 84441.029] 2: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x4733) [0x7f9dafb4c733]
[ 84441.029] 3: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x7164) [0x7f9dafb4f164]
[ 84441.029] 4: /usr/bin/X (0x7f9db577d000+0x8d947) [0x7f9db580a947]
[ 84441.029] 5: /usr/bin/X (0x7f9db577d000+0xb1c18) [0x7f9db582ec18]
[ 84441.029] 6: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7f9db4aa5000+0xf0a0) [0x7f9db4ab40a0]
[ 84441.029] 7: /lib/x86_64-linux-gnu/libc.so.6 (__select+0x13) [0x7f9db3881293]
[ 84441.029] 8: /usr/bin/X (WaitForSomething+0x190) [0x7f9db58f9150]
[ 84441.029] 9: /usr/bin/X (0x7f9db577d000+0x52bb1) [0x7f9db57cfbb1]
[ 84441.029] 10: /usr/bin/X (0x7f9db577d000+0x41ec5) [0x7f9db57beec5]
[ 84441.029] 11: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xfd) [0x7f9db37c9ead]
[ 84441.029] 12: /usr/bin/X (0x7f9db577d000+0x4219d) [0x7f9db57bf19d]
[ 84441.029]
[ 84441.115] BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
[ 84441.115] BUG: ../../src/synaptics.c:3122 in UpdateTouchState()
[ 84441.115]
[ 84441.115] Backtrace:
[ 84441.115] 0: /usr/bin/X (xorg_backtrace+0x36) [0x7f9db58fbd16]
[ 84441.115] 1: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x3067) [0x7f9dafb4b067]
[ 84441.115] 2: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x4733) [0x7f9dafb4c733]
[ 84441.115] 3: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x7164) [0x7f9dafb4f164]
[ 84441.115] 4: /usr/bin/X (0x7f9db577d000+0x8d947) [0x7f9db580a947]
[ 84441.115] 5: /usr/bin/X (0x7f9db577d000+0xb1c18) [0x7f9db582ec18]
[ 84441.115] 6: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7f9db4aa5000+0xf0a0) [0x7f9db4ab40a0]
[ 84441.115] 7: /lib/x86_64-linux-gnu/libc.so.6 (__select+0x13) [0x7f9db3881293]
[ 84441.115] 8: /usr/bin/X (WaitForSomething+0x190) [0x7f9db58f9150]
[ 84441.115] 9: /usr/bin/X (0x7f9db577d000+0x52bb1) [0x7f9db57cfbb1]
[ 84441.115] 10: /usr/bin/X (0x7f9db577d000+0x41ec5) [0x7f9db57beec5]
[ 84441.115] 11: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xfd) [0x7f9db37c9ead]
[ 84441.115] 12: /usr/bin/X (0x7f9db577d000+0x4219d) [0x7f9db57bf19d]
[ 84441.115]
[ 84442.200] BUG: triggered 'if (priv->num_active_touches > priv->num_slots)'
[ 84442.200] BUG: ../../src/synaptics.c:3122 in UpdateTouchState()
[ 84442.200]
[ 84442.200] Backtrace:
[ 84442.200] 0: /usr/bin/X (xorg_backtrace+0x36) [0x7f9db58fbd16]
[ 84442.200] 1: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x3067) [0x7f9dafb4b067]
[ 84442.200] 2: /usr/lib/xorg/modules/input/synaptics_drv.so (0x7f9dafb48000+0x4733) [0x7f9dafb4c733]
[ 84442.200] 3: /usr/lib/xorg/module...

[N-charles (n-charles)]

Is this bug tracker actually used?

[Peter Hutterer (peter-hutterer)]

Fixes for that are in synaptics 1.8 and 1.7.6. It was caused by missing SYN_DROPPED handling.

You'll need libevdev 1.2 or later, iirc to get rid of the bug in synaptics 1.8.

Otherwise, the commit on the 1.7 branch was:
http://cgit.freedesktop.org/xorg/driver/xf86-input-synaptics/commit/?h=synaptics-1.7-branch&id=bbaf4d646ebf4393a1ee0eb9bcc569054ed878f9

[Ajax-a (ajax-a)]

*** Bug 54283 has been marked as a duplicate of this bug. ***