Bug 1650577

Summary: Xorg segfault when opening second session and Wayland session is already running
Product: Red Hat Enterprise Linux 8 Reporter: Tomas Pelka <tpelka>
Component: xorg-x11-serverAssignee: Adam Jackson <ajax>
Status: CLOSED NOTABUG QA Contact: Desktop QE <desktop-qa-list>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.0CC: jkoten
Target Milestone: rc   
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-11-16 14:22:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Tomas Pelka 2018-11-16 14:17:57 UTC
Description of problem:


Version-Release number of selected component (if applicable):
xorg-x11-server-Xorg-1.20.3-1.el8
kernel-4.18.0-39.el8
mutter-3.28.3-5.el8

How reproducible:
100%

Steps to Reproduce:
1. start wayland session
2. user user switch or Ctrl+Alt+F1 to login to second user (different from the user who is laready logged into wayland session) using X11 session
3.

Actual results:
coredumpctl dump /usr/libexec/Xorg
           PID: 26491 (Xorg)
           UID: 1001 (test)
           GID: 1001 (test)
        Signal: 6 (ABRT)
     Timestamp: Fri 2018-11-16 15:07:38 CET (3min 49s ago)
  Command Line: /usr/libexec/Xorg vt3 -displayfd 3 -auth /run/user/1001/gdm/Xauthority -background none -noreset -keeptty -verbose 7 -core
    Executable: /usr/libexec/Xorg
 Control Group: /user.slice/user-1001.slice/session-12.scope
          Unit: session-12.scope
         Slice: user-1001.slice
       Session: 12
     Owner UID: 1001 (test)
       Boot ID: c7007233e67e4c4b9708503725fa3ee1
    Machine ID: 45441ca1fc6643c8ad19f8187c5a0756
      Hostname: t470s
       Storage: /var/lib/systemd/coredump/core.Xorg.1001.c7007233e67e4c4b9708503725fa3ee1.26491.1542377258000000.lz4
       Message: Process 26491 (Xorg) of user 1001 dumped core.
                
                Stack trace of thread 26491:
                #0  0x00007f5f8813a93f __GI_raise (libc.so.6)
                #1  0x00007f5f88124c95 __GI_abort (libc.so.6)
                #2  0x0000561f4c3b0b50 OsAbort (Xorg)
                #3  0x0000561f4c3b6719 AbortServer (Xorg)
                #4  0x0000561f4c3b758d FatalError (Xorg)
                #5  0x0000561f4c3b791e LogInit (Xorg)
                #6  0x0000561f4c296ca4 xf86LogInit (Xorg)
                #7  0x0000561f4c28de2f OsVendorInit (Xorg)
                #8  0x0000561f4c3ae05c OsInit (Xorg)
                #9  0x0000561f4c251eee dix_main (Xorg)
                #10 0x00007f5f88126813 __libc_start_main (libc.so.6)
                #11 0x0000561f4c23bb7e _start (Xorg)
Refusing to dump core to tty (use shell redirection or specify --output).

Expected results:
Xorg should no crash

Additional info:
Core was generated by `/usr/libexec/Xorg vt3 -displayfd 3 -auth /run/user/1001/gdm/Xauthority -backgro'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50	  return ret;
(gdb) set logging file X.bt
(gdb) set logging on
Copying output to X.bt.
(gdb) thread apply all bt full

Thread 1 (Thread 0x7f5f8adb5ac0 (LWP 26491)):
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {171515904, 0, 0, 0, 0, 2, 94692422901216, 67108868, 140048285408704, 0, 47, 140721897239320, 48, 94692458759136, 1, 140048282488183}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1  0x00007f5f88124c95 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x30, sa_sigaction = 0x30}, sa_mask = {__val = {94692458759136, 1, 140048282488183, 4222451712, 94692458759136, 94692458759136, 94692458759136, 94692458759136, 94692458759183, 94692458759236, 94692458759136, 94692458759236, 67108868, 140048285408704, 10676761123150025472, 0}}, 
          sa_flags = 1279173292, sa_restorer = 0x7ffc5eb27300}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x0000561f4c3b0b50 in OsAbort ()
No symbol table info available.
#3  0x0000561f4c3b6719 in AbortServer ()
No symbol table info available.
#4  0x0000561f4c3b758d in FatalError ()
No symbol table info available.
#5  0x0000561f4c3b791e in LogInit ()
No symbol table info available.
#6  0x0000561f4c296ca4 in xf86LogInit ()
No symbol table info available.
#7  0x0000561f4c28de2f in OsVendorInit ()
No symbol table info available.
#8  0x0000561f4c3ae05c in OsInit ()
No symbol table info available.
#9  0x0000561f4c251eee in dix_main ()
No symbol table info available.
#10 0x00007f5f88126813 in __libc_start_main (main=0x561f4c23bb40 <main>, argc=13, argv=0x7ffc5eb297a8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffc5eb29798) at ../csu/libc-start.c:308
        self = <optimized out>
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 5127386375487184022, 94692421385040, 140721897248672, 0, 0, 1508151362684673174, 1560966682396679318}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7ffc5eb29818, 0x7f5f8ade0150}, data = {prev = 0x0, cleanup = 0x0, canceltype = 1588762648}}}
        not_first_call = <optimized out>
#11 0x0000561f4c23bb7e in _start ()
No symbol table info available.
(gdb)

Comment 1 Tomas Pelka 2018-11-16 14:22:55 UTC
Oh double facepalm - test did not have /home, damn.