Bug 814869

Summary: infinite loop in synaptics driver
Product: [Fedora] Fedora Reporter: Karel Volný <kvolny>
Component: xorg-x11-serverAssignee: Peter Hutterer <peter.hutterer>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: peter.hutterer, xgl-maint
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-05-29 10:37:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Karel Volný 2012-04-20 21:45:12 UTC
Description of problem:
X process is getting stuck, eating 100% cpu. The problems seems to come from the synaptics driver, see below.

Version-Release number of selected component (if applicable):
xorg-x11-server-Xorg-1.12.0-2.fc17.x86_64
xorg-x11-drv-synaptics-1.5.99.903-1.fc17.x86_64

How reproducible:
seldom - once per two days

Steps to Reproduce:
1. just use X ...
  
Actual results:
X eats all cpu, screen doesn't redraw, mouse cursor doesn't move, no reaction to keyboard

Expected results:
(works as usual)

Additional info:
hardware Lenovo B570e

from dmesg:

[    0.803168] psmouse serio1: elantech: assuming hardware version 3 (with firmware version 0x850f03)
[    0.814358] psmouse serio1: elantech: Synaptics capabilities query result 0x18, 0x14, 0x0a.


from Xorg.0.log:

[    18.252] (II) LoadModule: "synaptics"
[    18.253] (II) Loading /usr/lib64/xorg/modules/input/synaptics_drv.so
[    18.253] (II) Module synaptics: vendor="X.Org Foundation"
[    18.253]    compiled for 1.12.0, module version = 1.5.99
[    18.253]    Module class: X.Org XInput Driver
[    18.253]    ABI class: X.Org XInput driver, version 16.0
[    18.253] (II) Using input driver 'synaptics' for 'ETPS/2 Elantech Touchpad'
[    18.253] (**) ETPS/2 Elantech Touchpad: always reports core events
[    18.253] (**) Option "Device" "/dev/input/event4"
[    18.254] (--) synaptics: ETPS/2 Elantech Touchpad: x-axis range 0 - 2934
[    18.254] (--) synaptics: ETPS/2 Elantech Touchpad: y-axis range 0 - 1304
[    18.254] (--) synaptics: ETPS/2 Elantech Touchpad: pressure range 0 - 255
[    18.254] (--) synaptics: ETPS/2 Elantech Touchpad: finger width range 0 - 15
[    18.254] (--) synaptics: ETPS/2 Elantech Touchpad: buttons: left right double triple
[    18.254] (--) synaptics: ETPS/2 Elantech Touchpad: Vendor 0x2 Product 0xe
[    18.254] (--) synaptics: ETPS/2 Elantech Touchpad: touchpad found
[    18.254] (**) ETPS/2 Elantech Touchpad: always reports core events
[    18.254] (**) Option "config_info" "udev:/sys/devices/platform/i8042/serio1/input/input4/event4"
[    18.254] (II) XINPUT: Adding extended input device "ETPS/2 Elantech Touchpad" (type: TOUCHPAD, id 11)
[    18.254] (**) synaptics: ETPS/2 Elantech Touchpad: (accel) MinSpeed is now constant deceleration 2.5
[    18.254] (**) synaptics: ETPS/2 Elantech Touchpad: MaxSpeed is now 1.75
[    18.254] (**) synaptics: ETPS/2 Elantech Touchpad: AccelFactor is now 0.062
[    18.255] (**) ETPS/2 Elantech Touchpad: (accel) keeping acceleration scheme 1
[    18.255] (**) ETPS/2 Elantech Touchpad: (accel) acceleration profile 1
[    18.255] (**) ETPS/2 Elantech Touchpad: (accel) acceleration factor: 2.000
[    18.255] (**) ETPS/2 Elantech Touchpad: (accel) acceleration threshold: 4
[    18.255] (--) synaptics: ETPS/2 Elantech Touchpad: touchpad found
[    18.255] (II) config/udev: Adding input device ETPS/2 Elantech Touchpad (/dev/input/mouse0)
[    18.255] (II) No input driver specified, ignoring this device.
[    18.255] (II) This device may have been added with another device file.




(gdb) bt full
#0  0x0000000000461f91 in TimerSet (timer=0x16d0c10, flags=flags@entry=0, millis=millis@entry=180, func=func@entry=0x7f85fe2c2b70 <timerFunc>, arg=arg@entry=0x16d06c0) at WaitFor.c:448
        prev = 0x16d0580
        now = 48006355
#1  0x00007f85fe2c2b56 in ReadInput (pInfo=0x16d06c0) at synaptics.c:1645
        priv = 0x16dad40
        hw = 0x16df510
        delay = 180
        newDelay = 1
#2  0x00000000004802f7 in xf86SigioReadInput (fd=<optimized out>, closure=0x16d06c0) at xf86Events.c:298
        errno_save = 11
        pInfo = 0x16d06c0
#3  0x00000000004a4490 in xf86SIGIO (sig=<optimized out>) at ../shared/sigio.c:109
        i = <optimized out>
        ready = {fds_bits = {65536, 0 <repeats 15 times>}}
        to = {tv_sec = 0, tv_usec = 0}
        save_errno = 11
        r = 1
#4  <signal handler called>
No symbol table info available.
#5  TimerSet (timer=0x16d0580, flags=flags@entry=0, millis=48009208, millis@entry=3000, func=func@entry=0x7f8600397770 <intel_cache_expire>, arg=arg@entry=0x113a670) at WaitFor.c:478
        prev = <optimized out>
        now = 48006208
#6  0x00007f860039971f in intel_flush_rendering (intel=0x113a670) at intel_uxa.c:999
No locals.
#7  intel_uxa_block_handler (intel=intel@entry=0x113a670) at intel_uxa.c:1023
No locals.
#8  0x00007f8600395a0e in I830BlockHandler (i=<optimized out>, blockData=<optimized out>, pTimeout=<optimized out>, pReadmask=<optimized out>) at intel_driver.c:755
        screen = 0x114b450
        scrn = <optimized out>
        intel = 0x113a670
#9  0x000000000043812a in BlockHandler (pTimeout=pTimeout@entry=0x7fff3cf74d78, pReadmask=pReadmask@entry=0x7de500) at dixutils.c:392
        i = <optimized out>
        j = <optimized out>
#10 0x000000000046227c in WaitForSomething (pClientsReady=pClientsReady@entry=0x165e120) at WaitFor.c:219
        i = <optimized out>
        waittime = {tv_sec = 2, tv_usec = 955000}
        wt = 0x7fff3cf74d80
        timeout = <optimized out>
        clientsReadable = {fds_bits = {0 <repeats 16 times>}}
        clientsWritable = {fds_bits = {31521008, 16, 18135072, 1, 8248944, 140213510608200, 0, 140213510608200, 0, 18116760, 18116384, 16384, 0, 18116760, 18116384, 16384}}
        selecterr = <optimized out>
        nready = 0
        devicesReadable = {fds_bits = {0, 140213503848810, 4294967634, 33264104, 24420928, 4653900, 18116616, 4619677, 18057968, 32, 0, 0, 0, 18061600, 0, 24420864}}
        now = <optimized out>
        someReady = <optimized out>
#11 0x0000000000434061 in Dispatch () at dispatch.c:366
        clientReady = 0x165e120
        result = <optimized out>
        client = <optimized out>
        nready = <optimized out>
        icheck = 0x7dde70
        start_tick = <optimized out>
#12 0x00000000004233e5 in main (argc=9, argv=0x7fff3cf75188, envp=<optimized out>) at main.c:287
        i = <optimized out>
        alwaysCheckForInput = {0, 1}

Comment 1 Peter Hutterer 2012-04-24 05:55:52 UTC
appears to be list corruption in the server

Comment 2 Karel Volný 2012-04-24 12:24:12 UTC
(In reply to comment #1)
> appears to be list corruption in the server

thanks for the initial inspection

any hints what info from the running system would be interesting if that happens again?

(I've killed the process with SIGABRT, hoping that it will dump core and re-reporting this with abrt-gui will provide more info, but it hasn't appeared on the list of crashes after restart ...)

Comment 3 Peter Hutterer 2012-04-27 00:42:19 UTC
Please give xorg-x11-drv-synaptics-1.5.99.904-1 a try. It has a time-related fix that may trigger this bug. bit of a long shot, but worth testing anyway


http://koji.fedoraproject.org/koji/buildinfo?buildID=315674

Comment 4 Peter Hutterer 2012-04-27 02:52:27 UTC
actually, this really looks like list corruption, currently waiting for some feedback on http://patchwork.freedesktop.org/patch/10100/

Comment 5 Karel Volný 2012-04-27 09:56:33 UTC
ok, I've updated the driver

if I understand the possible nature of the bug, I'm pretty surprised that I saw this only on that one particular machine, and that it happened so often ...

Comment 6 Peter Hutterer 2012-04-29 22:09:51 UTC
just fyi, you'll need the server update (not yet pushed out) to fix this, the driver had no hand it it after all (that patch is for the server alone).

as for the why so often but only on one machine: the timer is set on every touchpad input event. so this code has a potential to corrupt very often, but still needs to interrupt some other code in one specific section. the backtrace shows the intel driver, so you're likely reliant on that as well, and there only since 2.18.0.

Comment 7 Karel Volný 2012-05-12 13:12:40 UTC
after exceptionally long time without a hang, it happened again - see the backtrace below, it looks almost the same

so I can confirm that the driver(s) update is not enough; now there is:

xorg-x11-server-Xorg-1.12.0-2.fc17.x86_64
xorg-x11-drv-synaptics-1.6.0-1.fc17.x86_64
xorg-x11-drv-intel-2.19.0-1.fc17.x86_64

(gdb) bt full
#0  0x0000000000461f97 in TimerSet (timer=0x267c980, flags=flags@entry=0, millis=millis@entry=1000000000, func=func@entry=0x7f8eb108ae70 <timerFunc>, 
    arg=arg@entry=0x25ee430) at WaitFor.c:446
        prev = 0x2671d60
        now = 23396280
#1  0x00007f8eb108ae59 in ReadInput (pInfo=0x25ee430) at synaptics.c:1684
        priv = 0x267c5c0
        hw = 0x2680dc0
        delay = 1000000000
        newDelay = 1
#2  0x00000000004802f7 in xf86SigioReadInput (fd=<optimized out>, closure=0x25ee430) at xf86Events.c:298
        errno_save = 11
        pInfo = 0x25ee430
#3  0x00000000004a4490 in xf86SIGIO (sig=<optimized out>) at ../shared/sigio.c:109
        i = <optimized out>
        ready = {fds_bits = {65536, 0 <repeats 15 times>}}
        to = {tv_sec = 0, tv_usec = 0}
        save_errno = 11
        r = 1
#4  <signal handler called>
No symbol table info available.
#5  0x0000000000461fe5 in TimerSet (timer=0x2671d60, flags=flags@entry=0, millis=23399112, millis@entry=3000, func=func@entry=0x7f8eb315ed70 <intel_cache_expire>, 
    arg=arg@entry=0x20dbee0) at WaitFor.c:477
        prev = 0x2671d60
        now = 23396112
#6  0x00007f8eb31609ff in intel_flush_rendering (intel=0x20dbee0) at intel_uxa.c:979
No locals.
#7  intel_uxa_block_handler (intel=intel@entry=0x20dbee0) at intel_uxa.c:1003
No locals.
#8  0x00007f8eb315d03e in I830BlockHandler (i=<optimized out>, blockData=<optimized out>, pTimeout=<optimized out>, pReadmask=<optimized out>) at intel_driver.c:753
        screen = 0x20ecc90
        scrn = <optimized out>
        intel = 0x20dbee0
#9  0x000000000043812a in BlockHandler (pTimeout=pTimeout@entry=0x7fffd74ef088, pReadmask=pReadmask@entry=0x7de500) at dixutils.c:392
        i = <optimized out>
        j = <optimized out>
#10 0x000000000046227c in WaitForSomething (pClientsReady=pClientsReady@entry=0x268b860) at WaitFor.c:219
        i = <optimized out>
        waittime = {tv_sec = 2, tv_usec = 896000}
        wt = 0x7fffd74ef090
        timeout = <optimized out>
        clientsReadable = {fds_bits = {0 <repeats 16 times>}}
        clientsWritable = {fds_bits = {34524304, 37703952, 48563472, 48563476, 37773192, 140250855845305, 37703952, 140250866648623, 48563560, 5244799, 0, 37775184, 
            37775184, 48563472, 37773192, 140250884482313}}
        selecterr = <optimized out>
        nready = 0
        devicesReadable = {fds_bits = {34506592, 34524304, 0, 34524304, 34521280, 48563472, 8194080, 1073741826, 893, 5085704, 50236400, 0, 63369105, 4542626, 
            63369105, 50236400}}
        now = <optimized out>
        someReady = <optimized out>
#11 0x0000000000434061 in Dispatch () at dispatch.c:366
        clientReady = 0x268b860
        result = <optimized out>
        client = <optimized out>
        nready = <optimized out>
        icheck = 0x7dde70
        start_tick = <optimized out>
#12 0x00000000004233e5 in main (argc=9, argv=0x7fffd74ef498, envp=<optimized out>) at main.c:287
        i = <optimized out>
        alwaysCheckForInput = {0, 1}

Comment 8 Fedora Update System 2012-05-14 04:20:39 UTC
xorg-x11-server-1.12.0-5.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/xorg-x11-server-1.12.0-5.fc17

Comment 9 Fedora Update System 2012-05-15 02:31:15 UTC
Package xorg-x11-server-1.12.0-5.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing xorg-x11-server-1.12.0-5.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-7836/xorg-x11-server-1.12.0-5.fc17
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2012-05-29 10:37:41 UTC
xorg-x11-server-1.12.0-5.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.