RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1067709 - qxl driver doesn't implement shadow hooks, crashes when rotation code called
Summary: qxl driver doesn't implement shadow hooks, crashes when rotation code called
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: xorg-x11-drv-qxl
Version: 7.0
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Marc-Andre Lureau
QA Contact: Desktop QE
URL:
Whiteboard: abrt_hash:d7bc8891738d5f946daaf44371f...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-02-20 22:27 UTC by Alois Mahdal
Modified: 2015-03-05 13:33 UTC (History)
7 users (show)

Fixed In Version: xorg-x11-drv-qxl-0.1.1-11.el7
Doc Type: Bug Fix
Doc Text:
Cause: QXL driver is trying to call CrtcRotate while it does not support screen rotations Consequence: Under some circumstances (for example trying to access a tigervnc instance running in a guest), guest Xorg would crash Fix: Stop calling CrtcRotate Result: No more Xorg crash
Clone Of:
Environment:
Last Closed: 2015-03-05 13:33:12 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
File: backtrace (16.66 KB, text/plain)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
File: cgroup (153 bytes, text/plain)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
File: core_backtrace (2.18 KB, text/plain)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
File: dso_list (4.72 KB, text/plain)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
File: environ (84 bytes, text/plain)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
File: limits (1.29 KB, text/plain)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
File: maps (23.79 KB, text/plain)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
File: proc_pid_status (1.02 KB, text/plain)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
File: var_log_messages (744 bytes, text/plain)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
File: sosreport.tar.xz (1.08 MB, application/octet-stream)
2014-02-20 22:27 UTC, Alois Mahdal 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:0578 0 normal SHIPPED_LIVE xorg-x11-drv-qxl bug fix update 2015-03-05 17:07:22 UTC

Description Alois Mahdal 2014-02-20 22:27:00 UTC 
Description of problem:
Following reproducer in other bug[1], I have

*   installed tigervnc packages on two machines (A, B),
*   changed keyboard layout and added some X11 config files
    on machine A
*   turned off firewall
*   and attempted to connect from machine B using
        $ vncviewer <ip-address>
    called from GNOME session

(Please visit the link for full reproducer.)

  [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1054118#c5

The connection was closed by B after showing the screen. Then I found this
crash report on machine B.

Note that the above reproducer is written for RHEL6.5 and different version of
tigervnc.

Hint: "ajax says it doesn't implement ->shadow_allocate"

Version-Release number of selected component:
xorg-x11-server-Xorg-1.15.0-3.el7

Additional info:
reporter:       libreport-2.1.11
backtrace_rating: 4
cmdline:        /usr/bin/Xorg :0 -background none -verbose -auth /run/gdm/auth-for-gdm-2MDhUA/database -seat seat0 -nolisten tcp vt1
crash_function: OsAbort
executable:     /usr/bin/Xorg
kernel:         3.10.0-86.el7.x86_64
open_fds:       
runlevel:       N 5
type:           CCpp
uid:            0

Truncated backtrace:
Thread no. 1 (10 frames)
 #2 OsAbort at utils.c:1328
 #3 ddxGiveUp at xf86Init.c:1097
 #4 AbortDDX at xf86Init.c:1141
 #5 AbortServer at log.c:770
 #6 FatalError at log.c:911
 #7 OsSigHandler at osinit.c:147
 #9 ??
 #10 xf86CrtcRotate at xf86Rotate.c:411
 #11 drmmode_set_mode_major at qxl_drmmode.c:197
 #12 drmmode_xf86crtc_resize at qxl_drmmode.c:821
Comment 1 Alois Mahdal 2014-02-20 22:27:04 UTC 
Created attachment 865735 [details]
File: backtrace
Comment 2 Alois Mahdal 2014-02-20 22:27:06 UTC 
Created attachment 865736 [details]
File: cgroup
Comment 3 Alois Mahdal 2014-02-20 22:27:09 UTC 
Created attachment 865737 [details]
File: core_backtrace
Comment 4 Alois Mahdal 2014-02-20 22:27:11 UTC 
Created attachment 865738 [details]
File: dso_list
Comment 5 Alois Mahdal 2014-02-20 22:27:13 UTC 
Created attachment 865739 [details]
File: environ
Comment 6 Alois Mahdal 2014-02-20 22:27:15 UTC 
Created attachment 865740 [details]
File: limits
Comment 7 Alois Mahdal 2014-02-20 22:27:17 UTC 
Created attachment 865741 [details]
File: maps
Comment 8 Alois Mahdal 2014-02-20 22:27:20 UTC 
Created attachment 865742 [details]
File: proc_pid_status
Comment 9 Alois Mahdal 2014-02-20 22:27:22 UTC 
Created attachment 865743 [details]
File: var_log_messages
Comment 10 Alois Mahdal 2014-02-20 22:27:29 UTC 
Created attachment 865744 [details]
File: sosreport.tar.xz
Comment 12 Alois Mahdal 2014-02-21 22:08:50 UTC 
To work around this bug, you can either (for KVM machine) use stdvga graphics device or add following section to xorg.conf:

~

Section "Device"
     Identifier "default"
     Driver "modesetting"
EndSection
Comment 15 Marc-Andre Lureau 2014-09-01 17:04:57 UTC 
I am looking at this.
Comment 16 Marc-Andre Lureau 2014-09-03 16:04:56 UTC 
patch on ML:
http://lists.freedesktop.org/archives/spice-devel/2014-September/017333.html
Comment 22 Alois Mahdal 2015-01-16 02:36:09 UTC 
Oops, I accidentally removed the needinfo as I was adding ajax to the CC.


However, the good news is that I have finally reproduced the bug with

    xorg-x11-drv-qxl-0.1.1-9.el7

that is, on a KVM machine installed from RHEL-7.0-20140507.0.

~

The reproducer:

 1. install tigervnc-server-module

 2. `service firewalld stop`

 3. create the .conf files stated below (10-module.conf,
    30-screen.conf).

 4. `killall -r gdm` (restarting just gdm.service does not
    suffice)

     *  verify with `netstat -ntlp | grep 5900` that the
        moduile is loaded and listening

 5. connect from outside using tigervnc


Now the thing is that sometimes the bug is reproduced, sometimes not.  However, the actual **rotation** is not necessary, the bug (by my wild guess + what I hazily remember) happens during negotiation phase, maybe around time client decides to adjust the size.

So keep trying.  (I remember being annoyed by the bug when trying to reproduce the other, layout-related one, so it probably was not very rare, though.)

~

/etc/X11/xorg.conf.d/10-module.conf:

Section "Module"
	Load	"vnc"
EndSection


/etc/X11/xorg.conf.d/30-screen.conf:

Section "Screen"
    Identifier "Screen0"
    DefaultDepth 24
    Subsection "Display"
       Viewport 0 0
       Depth 24
       Modes "1024x768"
    EndSubsection
    Option "SecurityTypes" "None"
EndSection


~

Let me know if I can help any more.
Comment 24 Vaclav Ehrlich 2015-01-21 18:51:19 UTC 
In my case, resizing to very small window caused lost connection.
Also thank you Alois for all information.
Comment 27 errata-xmlrpc 2015-03-05 13:33:12 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0578.html
Note You need to log in before you can comment on or make changes to this bug.