Bug 815360

Summary: X crashes when switching users
Product: [Fedora] Fedora Reporter: Kamil Páral <kparal>
Component: xorg-x11-drv-qxlAssignee: Dave Airlie <airlied>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: airlied, awilliam, collura, crobinso, hdegoede, marcandre.lureau, oliver.henshaw, robatino, sandmann, tflink, xgl-maint
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: RejectedBlocker
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-06-26 18:42:11 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Xorg log
none
backtrace generated by abrt none

Description Kamil Páral 2012-04-23 13:16:34 UTC 
Description of problem:
[   762.208] Backtrace:
[   762.208] 0: /usr/bin/Xorg (xorg_backtrace+0x4a) [0x80abe5a]
[   762.209] 1: /usr/bin/Xorg (0x8047000+0x69dd8) [0x80b0dd8]
[   762.209] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xb773940c]
[   762.209] 3: /lib/libpixman-1.so.0 (pixman_image_get_width+0x6) [0x48bb7356]
[   762.209] 4: /usr/lib/xorg/modules/drivers/qxl_drv.so (0xb7612000+0x822b) [0xb761a22b]
[   762.209] 5: /usr/lib/xorg/modules/drivers/qxl_drv.so (0xb7612000+0x55a4) [0xb76175a4]
[   762.209] 6: /usr/bin/Xorg (0x8047000+0x10b90e) [0x815290e]
[   762.209] 7: /usr/bin/Xorg (0x8047000+0xe2c2e) [0x8129c2e]
[   762.209] 8: /usr/bin/Xorg (dixDestroyPixmap+0x14) [0x8072264]
[   762.209] 9: /usr/bin/Xorg (0x8047000+0x538cd) [0x809a8cd]
[   762.209] 10: /usr/bin/Xorg (FreeResource+0xec) [0x809b09c]
[   762.209] 11: /usr/bin/Xorg (0x8047000+0x2b51f) [0x807251f]
[   762.209] 12: /usr/bin/Xorg (0x8047000+0x3032d) [0x807732d]
[   762.209] 13: /usr/bin/Xorg (0x8047000+0x1dc35) [0x8064c35]
[   762.209] 14: /lib/libc.so.6 (__libc_start_main+0xf5) [0x48066635]
[   762.209] 15: /usr/bin/Xorg (0x8047000+0x1df79) [0x8064f79]
[   762.209] 
[   762.209] Segmentation fault at address (nil)
[   762.209] 
Fatal server error:
[   762.209] Caught signal 11 (Segmentation fault). Server aborting

I get this when switching users in my KVM machine. I reproduced in also in a freshly installed VM. It seems easily reproducible.

Version-Release number of selected component (if applicable):
xorg-x11-drv-qxl-0.0.22-0.fc17.i686
xorg-x11-server-Xorg-1.12.0-2.fc17.i686

How reproducible:
always

Steps to Reproduce:
1. log in
2. hit switch user, display switches to gdm
3. wait a while (few seconds, max minutes)
4. X restarts
Comment 1 Kamil Páral 2012-04-23 13:17:11 UTC 
Created attachment 579534 [details]
Xorg log
Comment 2 Kamil Páral 2012-04-23 13:19:50 UTC 
Smolt: http://www.smolts.org/client/show/pub_38e3de8d-df77-4306-b80e-73cda92413d0
Comment 3 Kamil Páral 2012-04-23 13:20:42 UTC 
Created attachment 579536 [details]
backtrace generated by abrt
Comment 4 Kamil Páral 2012-04-23 13:24:45 UTC 
Proposing as F17 Blocker.
Comment 5 Kamil Páral 2012-04-23 13:33:18 UTC 
When I switch from qxl driver to cirrus the VM does no longer crash.
Comment 6 Tim Flink 2012-04-26 18:51:08 UTC 
While it is nasty, I don't think that this hits any of the F17 release criteria and I'm thinking this could be fixed with an update. Granted, it can't be fixed for the lives but I have a hard time seeing many people switch users in a livecd environment.

I'm a weak -1 blocker on this
Comment 7 Tim Flink 2012-05-01 21:52:01 UTC 
Discussed in the 2012-05-01 blocker bug review meeting. Rejected as a blocker for F17 final because it doesn't hit any of the F17 release criteria, is specific to VMs and could be fixed with an update.
Comment 8 Adam Williamson 2012-05-08 15:06:13 UTC 
Fix up - tflink left it blocking.



-- 
Fedora Bugzappers volunteer triage team
https://fedoraproject.org/wiki/BugZappers
Comment 9 Oliver Henshaw 2012-06-22 16:17:14 UTC 
Similar problem in bug #737924 - the reporter has done a bit of digging.
Comment 10 Cole Robinson 2012-07-08 23:58:10 UTC 
*** Bug 737924 has been marked as a duplicate of this bug. ***
Comment 11 Cole Robinson 2012-07-08 23:58:48 UTC 
Hans' comments from the F15 bug:

Steps to Reproduce:
1. Take a 64 bit F-15 vm, using spice of course
2. Make sure it is fully up2date
3. Login to the fallback gnome desktop
4. switch to a text VT
5. Wait a bit
  
Actual results:
Xorg crashes, and restarts taking you back to the gdm login screen

Expected results:
Being able to work on the text VT and then return to the open
gnome-session.

Additional info:
I've been debugging this and the problem is that src/qxl_surface.c: qxl_surface_kill() gets called on a surface with a NULL host_image, moreover &surface->cache->all_images[id] != surface, so this smells like memory
corruption to me.
Comment 12 Adam Williamson 2012-07-09 06:30:56 UTC 
Cole: would https://bugzilla.redhat.com/show_bug.cgi?id=805017 be the same thing? Summary says 'Segmentation fault in anaconda when switching TTYs', but I've always just thought of it as 'the bug for when you switch to a VT in a VM and X crashes'.
Comment 13 Oliver Henshaw 2012-07-09 08:27:43 UTC 
Is http://article.gmane.org/gmane.comp.emulators.spice.devel/9534 intended to address this?
Comment 14 Cole Robinson 2013-06-26 18:42:11 UTC 
I don't think this was ever addressed in F17, and given that end-of-life is approaching I don't think it ever will be fixed. I haven't seen this issue on F18+, but if someone can reproduce on something newer, please reopen.