Bug 1650166

Can it be related to this bug?

https://bugs.freedesktop.org/show_bug.cgi?id=106960

This issue seems to be same as https://bugs.freedesktop.org/show_bug.cgi?id=106960

Can you please provide the Xorg logs of an afefcted system?

So, rebuilding the backtrace manually from the Xorg logs with the crash gives:

...
RROutputIsLeased()      0x118cfe at xorg-server-1.20.1/randr/../include/privates.h:136
xf86DPMSSet()            0xca74d at xorg-server-1.20.1/hw/xfree86/modes/xf86Crtc.c:3026
vmwgfx_disable_scanout() 0x10ab7 at xf86-video-vmware-13.2.1/vmwgfx/vmwgfx_crtc.c:116
drv_leave_vt()            0xe5b3 at xf86-video-vmware-13.2.1/vmwgfx/vmwgfx_driver.c:1213
xf86CrtcCloseScreen()    0xc88dc at xorg-server-1.20.1/hw/xfree86/modes/xf86Crtc.c:770
CursorCloseScreen()      0xe7bf8 at xorg-server-1.20.1/xfixes/cursor.c:206
present_close_screen()  0x132d53 at xorg-server-1.20.1/present/present_screen.c:71
dix_main()               0x604c4
_start()                 0x4a4ce

That shows the crash occurs when closing the screen, i.e. when the Xserver terminates, not a crash that kills the Xserver in the middle of a running session.

I agree that this crash looks like upstream bug fdo#106960, but the fix for this bug is already included in xserver-1.20.1 so most likely the fix upstream is incomplete: https://gitlab.freedesktop.org/xorg/xserver/commit/101d15c

RROutputIsLeased() reads:

120 Bool
121 RROutputIsLeased(RROutputPtr output)
122 {
123     ScreenPtr screen = output->pScreen;
124     rrScrPrivPtr scr_priv = rrGetScrPriv(screen);
125     RRLeasePtr lease;
126     int o;
127 
128     xorg_list_for_each_entry(lease, &scr_priv->leases, list) {
129         for (o = 0; o < lease->numOutputs; o++)
130             if (lease->outputs[o] == output)
131                 return TRUE;
132     }
133     return FALSE;
134 }

The crash occurs in dixGetPrivate() so my guess is that the output is already freed/corrupted when we get there and therefore output->pScreen is invalid.

Created attachment 1507912 [details]
Attachig Xorg logs captured by ABRT.

Created attachment 1508283 [details]
[PATCH v2] xfree86: LeaveVT from xf86CrtcCloseScreen

This is an _updated_ version of the original patch included in el7.6 to fix bug 1635747 / bug 1489977 (i.e. that patch replaces the one wit hthe same name in the xorg-x11-server downstream package)

It keeps the call to `LeaveVT()` from `xf86CrtcCloseScreen()` but does it *after*  clearing up the output data so that in a DDX such as xf86-video-vmware calls back into DPMS in its `LeaveVT()` handler, we don't end up accessing freed data.

My x-server crashes when I attempt to run xfreerdp command. 
I have already published my backtraces - https://bugzilla.redhat.com/show_bug.cgi?id=1659113

Would you be able to direct me to the change logs for the new xorg-x11-server-1.20.1-6.el7 ?

Thanks

(In reply to A. Fernando from comment #52)
> My x-server crashes when I attempt to run xfreerdp command. 

xfreerdp crashing the Xserver is a different issue from this bug, already tracked in bug 1659113, let's not mix those.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2079