Ubuntu

plymouthd crashed with SIGSEGV in ply_event_loop_process_pending_events()

Reported by j0sh on 2010-04-02
This bug affects 1168 people
Affects Status Importance Assigned to Milestone
Plymouth
Fix Released
Medium
plymouth (Ubuntu)
High
James Hunt
Declined for Karmic by Steve Langasek
Natty
High
Canonical Foundations Team
Precise
High
James Hunt

Bug Description

Binary package hint: plymouth

just upgraded to lucid, first reboot tried to start accounts

ProblemType: Crash
DistroRelease: Ubuntu 10.04
Package: plymouth 0.8.1-4
ProcVersionSignature: Ubuntu 2.6.32-19.28-generic 2.6.32.10+drm33.1
Uname: Linux 2.6.32-19-generic i686
NonfreeKernelModules: wl
Architecture: i386
Date: Thu Apr 1 22:14:11 2010
DefaultPlymouth: /lib/plymouth/themes/kubuntu-logo/kubuntu-logo.plymouth
ExecutablePath: /sbin/plymouthd
MachineType: Dell Inc. Inspiron 1545
ProcCmdLine: root=UUID=73530dc8-e3cc-4147-b801-4725b2f88141 ro quiet splash vga=792
ProcCmdline: /sbin/plymouthd --mode=boot --attach-to-session
ProcEnviron: PATH=(custom, no user)
ProcFB: 0 inteldrmfb
SegvAnalysis:
 Segfault happened at: 0xfb5fe1 <ply_event_loop_process_pending_events+513>: test %eax,0x4(%esi)
 PC (0x00fb5fe1) ok
 source "%eax" ok
 destination "0x4(%esi)" (0x00000004) not located in a known VMA region (needed writable region)!
SegvReason: writing NULL VMA
Signal: 11
SourcePackage: plymouth
StacktraceTop:
 ply_event_loop_process_pending_events ()
 ply_event_loop_run () from /lib/libply.so.2
 ?? ()
 __libc_start_main () from /lib/tls/i686/cmov/libc.so.6
 ?? ()
TextPlymouth: /lib/plymouth/themes/ubuntu-text/ubuntu-text.plymouth
Title: plymouthd crashed with SIGSEGV in ply_event_loop_process_pending_events()
UserGroups:

dmi.bios.date: 07/17/2009
dmi.bios.vendor: Dell Inc.
dmi.bios.version: A10
dmi.board.name: 0G848F
dmi.board.vendor: Dell Inc.
dmi.chassis.type: 8
dmi.chassis.vendor: Dell Inc.
dmi.modalias: dmi:bvnDellInc.:bvrA10:bd07/17/2009:svnDellInc.:pnInspiron1545:pvr:rvnDellInc.:rn0G848F:rvr:cvnDellInc.:ct8:cvr:
dmi.product.name: Inspiron 1545
dmi.sys.vendor: Dell Inc.

j0sh (zerounix) wrote :

StacktraceTop:
 ply_event_loop_process_pending_events (
 ply_event_loop_run (loop=0x90280a8) at ply-event-loop.c:1312
 main (argc=3, argv=0xbfeba124) at main.c:1916

Changed in plymouth (Ubuntu):
importance: Undecided → Medium
tags: removed: need-i386-retrace
tags: added: bugpattern-needed
Nigel Babu (nigelbabu) on 2010-04-05
visibility: private → public
Changed in plymouth (Ubuntu):
status: New → Confirmed
Martin Pitt (pitti) on 2010-04-07
Changed in plymouth (Ubuntu):
importance: Medium → High
Roy Jamison (xteejx) wrote :

This seemed to happen randomly for me, but didn't appear to affect system stability.

swests (simon-thewests) wrote :

I only seem to get this when I use the new nouveau driver. If I use the Nvidia (Current version) driver I don't seem to get the problem.

NeilGreenwood (neil-greenwood) wrote :

I don't have a Nvidia graphics card in the laptop where I saw this crash.

lspci shows:
Intel Corporation Mobile 945GM/GMS, 943/940GML Express Integrated Graphics Controller [8086:27a2]

tags: added: bugpattern-written
removed: bugpattern-needed

For the record, I get this crash on a Dell Mini 10, with Intel 945.

Roy Jamison (xteejx) wrote :

Compaq Presario CQ50 laptop Geforce 8200M here.

Roy Jamison (xteejx) wrote :

Using (current) nvidia driver as well, missed that out. Doesn't look like a graphics driver issue.

Mark Cariaga (mzc) wrote :

@Martin Pitt: I have an AOD250 and HP mini 110-1116NR, both exhibit the
bug.

On Wed, 2010-04-07 at 20:15 +0000, Martin Pitt wrote:
> For the record, I get this crash on a Dell Mini 10, with Intel 945.
>

Mark Cariaga (mzc) wrote :

@Martin Pitt: I have an AOD250 and a HP mini 110-1116NR both exhibit
the same bug

On Wed, 2010-04-07 at 20:15 +0000, Martin Pitt wrote:
> For the record, I get this crash on a Dell Mini 10, with Intel 945.
>

Martin Spacek (mspacek) wrote :

I got this on my Thinkpad W510, quite randomly soon after bootup. It's only happened once so far. I'm running the latest 64 bit lucid, with the latest nvidia binary drivers.

Also see this with dual monitors using nouveau on a nVidia Corporation NV44A [GeForce 6200] (rev a1).

Alessandro Losavio (alo21) wrote :

when i want to update my system there was this bug

tags: added: iso-testing
Yann (lostec) wrote :
Download full text (6.0 KiB)

I had this bug, running pae kernel in a VirtualBox VM: Disk check was running and freezed at this moment...

syslog output around crash:

****

Apr 8 16:15:53 yann-laptop NetworkManager: <info> Activation (eth0) Stage 5 of 5 (IP Configure Commit) scheduled...
Apr 8 16:15:53 yann-laptop NetworkManager: <info> Activation (eth0) Stage 4 of 5 (IP4 Configure Get) complete.
Apr 8 16:15:53 yann-laptop NetworkManager: <info> Activation (eth0) Stage 5 of 5 (IP Configure Commit) started...
Apr 8 16:15:53 yann-laptop avahi-daemon[547]: Joining mDNS multicast group on interface eth0.IPv4 with address 10.0.2.15.
Apr 8 16:15:53 yann-laptop avahi-daemon[547]: New relevant interface eth0.IPv4 for mDNS.
Apr 8 16:15:53 yann-laptop avahi-daemon[547]: Registering new address record for 10.0.2.15 on eth0.IPv4.
Apr 8 16:15:53 yann-laptop dhclient: bound to 10.0.2.15 -- renewal in 33102 seconds.
Apr 8 16:15:53 yann-laptop kernel: [ 44.457002] vboxguest: exports duplicate symbol RTMemExecFree (owned by vboxdrv)
Apr 8 16:15:54 yann-laptop NetworkManager: <info> (eth0): device state change: 7 -> 8 (reason 0)
Apr 8 16:15:54 yann-laptop NetworkManager: <info> Policy set 'Auto eth0' (eth0) as default for routing and DNS.
Apr 8 16:15:54 yann-laptop NetworkManager: <info> Activation (eth0) successful, device activated.
Apr 8 16:15:54 yann-laptop NetworkManager: <info> Activation (eth0) Stage 5 of 5 (IP Configure Commit) complete.
Apr 8 14:15:57 yann-laptop ntpdate[901]: step time server 91.189.94.4 offset -7198.369434 sec
Apr 8 14:16:01 yann-laptop kernel: [ 51.051506] eth0: no IPv6 routers present
Apr 8 14:17:01 yann-laptop CRON[952]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
Apr 8 17:44:21 yann-laptop kernel: imklog 4.2.0, log source = /proc/kmsg started.
Apr 8 17:44:21 yann-laptop rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="514" x-info="http://www.rsyslog.com"] (re)start
Apr 8 17:44:21 yann-laptop rsyslogd: rsyslogd's groupid changed to 103
Apr 8 17:44:21 yann-laptop rsyslogd: rsyslogd's userid changed to 101
Apr 8 17:44:21 yann-laptop rsyslogd-2039: Could no open output file '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ]
Apr 8 17:44:21 yann-laptop kernel: [ 0.000000] Initializing cgroup subsys cpuset
Apr 8 17:44:21 yann-laptop kernel: [ 0.000000] Initializing cgroup subsys cpu
Apr 8 17:44:21 yann-laptop kernel: [ 0.000000] Linux version 2.6.32-19-generic-pae (buildd@palmer) (gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5) ) #28-Ubu
ntu SMP Wed Mar 31 18:57:46 UTC 2010 (Ubuntu 2.6.32-19.28-generic-pae 2.6.32.10+drm33.1)
(...)
Apr 8 17:44:23 yann-laptop cron[710]: (CRON) STARTUP (fork ok)
Apr 8 17:44:23 yann-laptop anacron[706]: Will run job `cron.daily' in 5 min.
Apr 8 17:44:23 yann-laptop anacron[706]: Jobs will be executed sequentially
Apr 8 17:44:24 yann-laptop acpid: 39 rules loaded
Apr 8 17:44:24 yann-laptop acpid: waiting for events: event logging is off
Apr 8 17:44:24 yann-laptop cron[710]: (CRON) INFO (Running @reboot jobs)
Apr 8 17:44:25 yann-laptop kernel: [ 30.573175] vboxdrv: Trying to deactivate the NMI watchdog permanently...
Apr 8 17:44:25 yann-laptop kernel: [ 30....

Read more...

Guy Taylor (thebiggerguy) wrote :

Running under VMware Workstation 6.5.3 build-185404c with VMware tools installed I get the same error.
Here is my log

Apr 8 22:50:50 Guy-dev tpvmlpd[2038]: device type not supported
Apr 8 22:50:50 Guy-dev init: plymouth-stop pre-start process (2115) terminated with status 1
Apr 8 22:50:53 Guy-dev kernel: [ 15.648161] eth0: no IPv6 routers present

/proc/version: Linux version 2.6.32-19-generic-pae (buildd@palmer) (gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5) ) #28-Ubuntu SMP Wed Mar 31 18:57:46 UTC 2010

Mark Cariaga (mzc) wrote :

The bug is still present on Beta2!

Simon (simon-west-family) wrote :

Acer 5810T was running disk check an d froze at 75%, no disk activity. Reboot brought it back to life.

timuckun (timuckun) wrote :

Asus k42Jr. ATI mobility Radeon 5470

Riccardo Padovani (rpadovani) wrote :

Dell inspirion 6000 , Ati Mobility Radeon X300

justy55555 (justy55555) wrote :

Acer Aspire One AOD250, Intel GMA 950

Kai Vogel (kai-vogel) wrote :

GeForce 7300 GS with NVidia's "Current" Driver

No more crashes afte I've reseted all profiles in "ccsm" and activated the basic profile in "simple-ccsm".

Notice: I've also reinstalled virtualbox-ose, but I'm not sure if this causes the crashes...

Hope this helps...

+1
Lenovo S10e
00:02.1 Display controller: Intel Corporation Mobile 945GM/GMS/GME, 943/940GML Express Integrated Graphics Controller (rev 03)

Sonsum (scottonsum) wrote :

Samsung N120. Pretty sure its an Intel GMA 950

cyberb764 (rmills764) wrote :

Doesn't anyone know why ub untuone cannot be manually configured to work? It works fine on my other computer, even after upgrading it.

cyberb764 (rmills764) wrote :

still not able to change a configuration that does'nt exist in the folder it is suppose to be.

cyberb764 (rmills764) wrote :

I am alm ost going to give up on it.

This occurred for me during a disk check (at 73% if that has any relevance...).

Asus EEE 1000, Intel video card; I've had Plymouth hang on disk checks at 70% and 73% (never visibly complete one successfully), and the disk check screen has been the only time I've seen the start-up splash screen for more than a moment (though usually doesn't appear at all). Once everything's booted, though, seems fine. Might also be relevant that the SSD memory in the computer is split into two drives, which I've set respectively to root and /home.

Son (son.caokim) wrote :

acer asprire one - AOA110

Roy Jamison (xteejx) wrote :

cyberb764, this bug report has absolutely nothing to do with Ubuntu One. If you are having problems with it, ask in #ubuntu on irc.freenode.net for support questions, or if it is a bug, file one with ubuntu-bug.

Laurie (welcome) wrote :

Problem occurred when sending an e-mail using claws-mail. It did not stop the e-mail being sent or have any obvious harmful effects.

Noel Arzola (noel.arzola) wrote :

dell dimension 2350 lucid beta 2 this was at random

Noel Arzola (noel.arzola) wrote :

Occured right on boot just now, after a reboot. Not seeing anything other than it reporting the crash. Desktop and everything appears to load without issue. Crash icon shows up.

Polemaker1 (polemaker1) wrote :

Same problem with an Acer Aspire One AOA150

Martin Karpinski (mkarpinski) wrote :

I had this happen in Lucid beta 2 amd64 (virtualised) when I opened up the language support menu.

hatzigia (hatzigia) wrote :

Same problem trying to install support for greek language after I opened up the language support menu

André Lucas (andre.lucas) wrote :

Got this on my HP Mini 210. I have a blank screen as the system boots, with a flashing text-mode cursor, and I get the crash report on logging in.

Odin Hørthe Omdal (velmont) wrote :

There is just so much crashing with Lucid Lynx :-(((((((

I get a crash every 1-2 hours. The intel 845-issue.

The boot took LONG time today, so I thought it'd hang and shut it of. Turns out (I think) that it was doing ureadahead-logging or something. After that the display didn't work, so I had to SSH in and run dpkg --configure -a to fix it. (also did dpkg-reconfigure linux-image-generic plymouth ureadahead, and deleted all the ureadahead-files).

Tareks (tatas8s) on 2010-04-13
Changed in plymouth (Ubuntu Lucid):
status: Confirmed → Incomplete
Changed in plymouth (Ubuntu Lucid):
assignee: nobody → Scott James Remnant (scott)
milestone: none → ubuntu-10.04
Steve Langasek (vorlon) on 2010-04-13
Changed in plymouth (Ubuntu Lucid):
status: Incomplete → Triaged
Changed in plymouth (Ubuntu Lucid):
assignee: Scott James Remnant (scott) → Steve Langasek (vorlon)
status: Triaged → Fix Committed
Steve Langasek (vorlon) on 2010-04-16
Changed in plymouth (Ubuntu Lucid):
status: Fix Committed → Triaged
Colin Watson (cjwatson) on 2010-04-26
Changed in plymouth (Ubuntu Lucid):
milestone: ubuntu-10.04 → lucid-updates
tags: added: patch
Gilles (gilles-civario) on 2010-05-24
tags: added: apport-collected
Changed in plymouth (Ubuntu):
status: Triaged → Fix Committed
Changed in plymouth (Ubuntu):
status: Fix Committed → Triaged
Neil Perry (nperry) on 2010-06-15
Changed in plymouth:
importance: Undecided → Unknown
status: New → Unknown
tags: added: patch-forwarded-upstream
removed: patch
Loïc Minier (lool) on 2010-08-19
Changed in plymouth (Ubuntu Maverick):
milestone: lucid-updates → maverick-updates
Gary M (garym) on 2010-08-30
tags: added: maverick
Loïc Minier (lool) on 2010-08-31
Changed in plymouth (Ubuntu Maverick):
milestone: maverick-updates → ubuntu-10.10-beta
Steve Langasek (vorlon) on 2010-08-31
Changed in plymouth (Ubuntu Maverick):
milestone: ubuntu-10.10-beta → ubuntu-10.10
Changed in plymouth:
importance: Unknown → Medium
status: Unknown → Confirmed
Changed in plymouth (Ubuntu Maverick):
milestone: ubuntu-10.10 → none
milestone: none → maverick-updates
Changed in plymouth (Ubuntu Natty):
milestone: maverick-updates → natty-alpha-2
Changed in plymouth (Ubuntu Natty):
assignee: Steve Langasek (vorlon) → Canonical Foundations Team (canonical-foundations)
Changed in plymouth (Ubuntu Maverick):
assignee: Steve Langasek (vorlon) → Canonical Foundations Team (canonical-foundations)
Changed in plymouth (Ubuntu Lucid):
assignee: Steve Langasek (vorlon) → Canonical Foundations Team (canonical-foundations)
Colin Watson (cjwatson) on 2011-01-21
Changed in plymouth (Ubuntu Natty):
milestone: natty-alpha-2 → ubuntu-11.04-beta
Changed in plymouth:
importance: Medium → Unknown
Changed in plymouth:
importance: Unknown → Medium
Changed in plymouth (Ubuntu Natty):
status: Triaged → Fix Released
Al-Faris (ahmedmuqdad) on 2011-04-20
Changed in plymouth (Ubuntu Natty):
assignee: Canonical Foundations Team (canonical-foundations) → Al-Faris (ahmedmuqdad)
assignee: Al-Faris (ahmedmuqdad) → nobody
Colin Watson (cjwatson) on 2011-04-20
Changed in plymouth (Ubuntu Natty):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
milestone: ubuntu-11.04-beta-1 → none
dino99 (9d9) on 2011-09-13
tags: added: oneiric
118 comments hidden view all 198 comments

apport information

apport information

apport information

dino99 (9d9) wrote : UdevDb.txt

apport information

dino99 (9d9) wrote : UdevLog.txt

apport information

Steve Langasek (vorlon) on 2011-09-14
Changed in plymouth (Ubuntu Oneiric):
status: Fix Released → Confirmed
tags: added: rls-mgr-o-tracking
dino99 (9d9) wrote :

seems to be fixed now on Oneiric i386 b1, does not get that crash since a few days now

Brian Murray (brian-murray) wrote :

Recent versions of this crash are still appearing in bug 849414 and its duplicates.

Steve Langasek (vorlon) wrote :

These crash reports are caused by a bug in plymouth, the boot-time splash screen. Sometimes the errors are not reported for quite a while after the crash actually happens.

If someone here is able to reproduce this bug reliably, please do the following:
 - edit /etc/default/grub so that GRUB_CMDLINE_LINUX_DEFAULT is set to "quiet splash plymouth:debug"
 - run sudo update-grub
 - reboot, and when you receive the prompt asking whether to report a crash about plymouthd, say "yes"
 - attach /var/log/plymouth-debug.log to the new bug report

Changed in plymouth (Ubuntu Oneiric):
status: Confirmed → Incomplete
1 comments hidden view all 198 comments
Bruce Pieterse (octoquad) wrote :

Steve,

I did not get the error message again, however after enabling debugging for plymouth I noticed a few files missing like x11.so on line 100, double slashes in path names and plymouthd.conf not existing.

See attached file.

Hi Bruce,

On Wed, Sep 21, 2011 at 08:53:11PM -0000, Bruce Pieterse wrote:
> I did not get the error message again, however after enabling debugging
> for plymouth I noticed a few files missing like x11.so on line 100,
> double slashes in path names and plymouthd.conf not existing.

These are all expected behavior and not related to this bug. I need a
plymouth debug log that corresponds to an actual crash in order to make
progress here.

--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
<email address hidden> <email address hidden>

Bruce Pieterse (octoquad) wrote :

Ok,

Well, I'll leave plymouth debugging on just in case the error does crop up again. I'm currently using 11.10 Beta 1.

Jared (jared-vanvolkenburg) wrote :

I just received this crash after a reboot. I am using 11.10 beta 2 about 30 seconds after logging into unity.

Jared (jared-vanvolkenburg) wrote :

Sorry for the mis-edit of my comment should read:

I just received this crash after a reboot about 30 seconds after logging into unity.
I am using 11.10 beta 2 .

I have not had coffee yet this morning.

Steve Langasek (vorlon) on 2011-09-30
Changed in plymouth (Ubuntu Oneiric):
milestone: none → oneiric-updates
tags: added: rls-mgr-p-tracking
removed: rls-mgr-o-tracking
Adam-cowan (adam-cowan) wrote :

This bug is also affecting me on 11.10 beta 2 with all the current updates.

Steve Langasek (vorlon) wrote :

This bug (and other similar crasher bugs like it) is known to affect a large number of users, but inconveniently the developers are not able to reproduce the bug - which means we can't fix it.

If this crash happens consistently for you, please add the option 'plymouth:debug=file:/var/log/plymouth-debug.log' to your boot settings, and the next time you see this crash, please report it as a new bug with apport and attach the /var/log/plymouth-debug.log file to the report.

James Hunt (jamesodhunt) wrote :

If anyone is getting this issue, please help us by obtaining the plymouth debug log.

Note that most updates on this issue are now being added to bug 849414.

Steve Langasek (vorlon) on 2011-10-26
tags: added: rls-p-tracking
Kangarooo Jānis (kangarooo) wrote :

Heres with splash plymouth:debug
and without crash. cant get crash anymore with this line added but got this file.

Steve Langasek (vorlon) on 2011-11-16
Changed in plymouth (Ubuntu Precise):
milestone: none → ubuntu-12.04
James Hunt (jamesodhunt) on 2011-12-07
Changed in plymouth (Ubuntu Precise):
assignee: Canonical Foundations Team (canonical-foundations) → James Hunt (jamesodhunt)
Matthijs ten Kate (igadget) wrote :

Just got this after booting a freshly installed and updated 12.04 alpha 2. Amazing it seems to be present for so many releases but still remains unfixed. If it happens again I'll dive deeper into all the comments above.

Kangarooo Jānis (kangarooo) wrote :

Where actually is the problem?
Its that this problem comes up. Nothing crashes actually but it just comes up.
Make this bug disable to show up:
1.) Add this bug ignorance
2.) Remove plymouth

Changed in plymouth (Ubuntu Precise):
status: Incomplete → Confirmed
Ewano (i-launchpad-ewano-net) wrote :

FWIW:

HP ze2000 laptop: Fresh install of 12.04 beta using the mini.iso - non PAE. Installed fine, then installed LXDE. Upon login to LXDE I get this error.

I can gather logs and sys info if required.

jerrylamos (jerrylamos) wrote :

Booted up, idle, and this crash occurred.

Jerry

Same problem as others, after fresh boot and loging into my user account, the crash dialog pops up. HP Pavillion dv4 64bit Ubuntu 12.04 amd64 beta up to date March 25 2012. I can give you any other information that can help to solve this, its not a big issue but anoying.

Martin Wildam (mwildam) wrote :

Through different versions of Ubuntu I see SIGSEGV related errors
coming and going. And I have the impression, they always start if I
begin to install different desktop environments on the same machine to
make every user choose his prefered one. Mostly I see them on my
testing machines where I install basically all available Desktop
environments. Not sure if that idea helps.

--
Martin Wildam

http://martin.wildam.org/

James Hunt (jamesodhunt) wrote :

At long last, I can now recreate this problem at will.

Although I haven't debugged the actual cause yet (and hence don't yet have a fix), it is triggered when the following occur "very close together":

    plymouth show-splash
    plymouth quit

Note that the problem can occur on boot (where plymouthd is run with '--mode=boot') and shutdown (where plymouthd is run with '--mode=shutdown').

For those interested, to recreate the problem:

# in 1 window...
$ sudo apt-get install plymouth-x11
$ ./test_plymouth.sh -s /sbin/plymouthd

# in another window
$ ./force_crash.sh

After a few seconds, a crash will occur.

test_plymouth.sh and force_crash.sh are available here:

  http://people.canonical.com/~jhunt/plymouth/

What I can see currently is that objects are being corrupted and a repeating pattern appears to be timeout/pending calls.

Further investigation is required, but atleast once we have a fix available, we now have a way to test it.

James Hunt (jamesodhunt) wrote :

One other point to note - this problem only seems to occur if using the "script" splash plugin (which Ubuntu uses).

Bob Bib (bobbib) on 2012-03-31
tags: added: natty precise
Fakrul (eirul-a) on 2012-04-02
Changed in plymouth (Ubuntu Precise):
assignee: James Hunt (jamesodhunt) → Fakrul (eirul-a)
Colin Watson (cjwatson) on 2012-04-02
Changed in plymouth (Ubuntu Precise):
assignee: Fakrul (eirul-a) → James Hunt (jamesodhunt)
devtry (devtry) wrote :

I'm using an up to date Ubuntu 12.04.

Ubuntu automatically raised a bug report with the same title ("plymouthd crashed with SIGSEGV in ply_event_loop_process_pending_events()") while I was going to print a pdf file to pdf.

Hope this helps!

Francesco Muriana (f-muriana) wrote :

This happened to me today on startup, ubuntu 12.04 x86

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package plymouth - 0.8.2-2ubuntu30

---------------
plymouth (0.8.2-2ubuntu30) precise; urgency=low

  [ Philip Muškovac ]
  * debian/patches/kubuntu-text.patch:
    Change kubuntu-text theme to new grey (LP: #979824)

  [ James Hunt ]
  * Temporary work-around that minimizes chance of referencing invalid
    sources (LP: #553745).
 -- James Hunt <email address hidden> Fri, 13 Apr 2012 15:11:36 +0100

Changed in plymouth (Ubuntu Precise):
status: Confirmed → Fix Released
Adolfo Jayme (fitoschido) wrote :

Maverick has reached end of life, so invalidating

Changed in plymouth (Ubuntu Maverick):
status: Triaged → Invalid

I think I've worked out what is going on here (and which caused me to
raise the erroneous bug 42285):

In ply_event_loop_process_pending_events(),
ply_event_loop_handle_timeouts() is being called *after* epoll_wait(),
but ply_event_loop_handle_timeouts() may free event sources.

I can reliabily force plymouthd to SIGSEGV (in various parts of the
code) by running the following:

  plymouth show-splash
  plymouth quit

I'm seeing epoll_wait() return with a single valid fd event.
ply_event_loop_handle_timeouts() then runs, and calls
main.c:on_boot_splash_idle(). This causes the event source object
referred to in the epoll_wait() event set to be freed and its reference
count set to zero. After ply_event_loop_handle_timeouts() finishes, the
now invalid source object pointed to by the epoll event data is
referenced (it now has a reference_count of 1), and the invalid event is
now processed with varying SIGSEGV scenarios ensuing.

Currently ply_event_loop_process_pending_events() can be summarized as:

1. get events.
2. handle timeouts.
3. reference event sources.
4. process events.
5. unreference event sources.

The attached patch changes this slightly to be effectively:

1. get events.
2. reference event sources.
3. handle timeouts.
4. process events.
5. unreference event sources.

Created attachment 60179
reference event sources before calling timeout handler to ensure events stay valid for loop iteration.

If ply_event_loop_handle_timeouts() is called before the events returned
by epoll_wait() are referenced, a timeout handler can free an event
source leading to undefined behaviour (and frequently SIGSEGV crashes)
once ply_event_loop_handle_timeouts() has finished since
ply_event_loop_process_pending_events() continues to try and process the
now invalid event sources. Thanks to cjwatson for a simpler solution to
my original fix.

Save errno values to ensure logic is robust in case handler makes
system call.

James Hunt (jamesodhunt) wrote :

We now belive we understand the whole problem. A patch has been submitted upstream - see https://bugs.freedesktop.org/show_bug.cgi?id=28548

1 comments hidden view all 198 comments

Hi,

(In reply to comment #2)
> I think I've worked out what is going on here (and which caused me to
> raise the erroneous bug 42285):
great!

> In ply_event_loop_process_pending_events(),
> ply_event_loop_handle_timeouts() is being called *after* epoll_wait(),
> but ply_event_loop_handle_timeouts() may free event sources.
ah ha. So to be a little more specific, a timeout callback may call ply_event_loop_stop_watching_fd and if that fd became ready at the same time as the callback then crash would result.

> I can reliabily force plymouthd to SIGSEGV (in various parts of the
> code) by running the following:
>
> plymouth show-splash
> plymouth quit
In this case plymouth quit queues a callback to get called after the animation gets to an idle state, on_boot_splash_idle calls functions that ultimately stops watching the terminal fd. if that callback happens in the same iteration of the loop that the terminal fd becomes ready, then boom. Makes sense. Thanks for figuring this out.

Comment on attachment 60179
reference event sources before calling timeout handler to ensure events stay valid for loop iteration.

Review of attachment 60179:
-----------------------------------------------------------------

::: src/libply/ply-event-loop.c
@@ +1296,5 @@
> + {
> + ply_event_source_t *source;
> + source = (ply_event_source_t *) (events[i].data.ptr);
> +
> + ply_event_source_take_reference (source);

we can't just take the reference inside the loop, since the loop may get called repeatedly because of EINTR. We could explicitly check for EINTR and not take the reference in that case, I guess. We do need to ensure events don't get dispatched after they are no longer being watched, but I think we should still be okay. The source is going to stick around, now, but the destination will still get free'd at stop_watching_fd time, so the source will in effect be orphaned and harmless.

Alright, pushed with minor changes:

http://cgit.freedesktop.org/plymouth/commit/?id=16c7b306b34839d95a05f246f2184a7aab03b180

Thanks for tracking this down!

2 comments hidden view all 198 comments
James Hunt (jamesodhunt) wrote :

The full fix has now been accepted and committed upstream.

Changed in plymouth:
status: Confirmed → Fix Released
3 comments hidden view all 198 comments
Matthew (justapawn) wrote :

I'm experiencing this bug using 12.10 Quantal Quetzal.

When I try to do "also affects project" it will let me add "quantal-backports" but not "Quantal", and that doesn't seem right. (Is it?)
So I don't know what to do.
Thanks for your help.

I am experiencing this problem using 13.04.

Thomas Hotz (thotz) on 2013-05-17
Changed in plymouth (Ubuntu Oneiric):
status: Incomplete → Invalid
dino99 (9d9) on 2013-05-17
tags: added: raring
removed: maverick natty oneiric
no longer affects: plymouth (Ubuntu Lucid)
no longer affects: plymouth (Ubuntu Maverick)
no longer affects: plymouth (Ubuntu Oneiric)
Mo Z (zmau1962) wrote :

Funny Story :

I had this bug infinite number of times. I was not able to work at all. The system would get to log-in window and crash after a few seconds. Once I was able to work a whole minuet before restart.....

In the following link I saw a comment which told me that this is a consequence of a race between two drivers https://bugs.freedesktop.org/show_bug.cgi?id=48894

So, I pulled out the Ethernet cable, and the problem disappeared. After the system is UP, I can re-connect the Ethernet, and there is no problem.....

More information : I am working with Ubuntu 12.04 on an Ivy Bridge machine....

Displaying first 40 and last 40 comments. View all 198 comments or add a comment.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Patches

Remote bug watches

Bug watches keep track of this bug in other bug trackers.