Bug#1059041: Xorg segfault when unlocking from Xscreensaver while video playback

[Bernhard Übelacker]

On Tue, 19 Dec 2023 20:22:43 +0100 Eduard Bloch  wrote:


#7  0x7fb14945a510 __restore_rt (libc.so.6 + 0x3c510)
#8  0x7fb149186702 n/a (amdgpu_drv.so + 0x16702)
#9  0x7fb149186c96 n/a (amdgpu_drv.so + 0x16c96)
#10 0x5577d8e75a6b xf86DPMSSet (Xorg + 0xd3a6b)



Hello,
I am not maintainer of xserver-xorg-video-amdgpu,
just tried to collect some more information.

The interesting lines above in the stacktrace translate to this:

Stack trace of thread 1011552:
...
#7  0x7fb14945a510 __restore_rt (libc.so.6 + 0x3c510) |
#8  0x7fb149186702 n/a (amdgpu_drv.so + 0x16702)  | in drmmode_set_mode at 
../../src/drmmode_display.c:1267
#9  0x7fb149186c96 n/a (amdgpu_drv.so + 0x16c96)  | in 
drmmode_set_mode_major at ../../src/drmmode_display.c:1371
#10 0x5577d8e75a6b xf86DPMSSet (Xorg + 0xd3a6b)   | in xf86DPMSSet
...

This leads to this [1] upstream issue and merge request [2].
Unfortunately this is not yet part of an upstream release.

A workaround could be a local build of xserver-xorg-video-amdgpu
containing the two commits. They are the first commits after the 23.0.0 release.

Kind regards,
Bernhard

[1] https://gitlab.freedesktop.org/xorg/driver/xf86-video-amdgpu/-/issues/70
[2] 
https://gitlab.freedesktop.org/xorg/driver/xf86-video-amdgpu/-/merge_requests/85
# 2024-05-04 Trixie/testing amd64 qemu VM



apt install gdb xserver-xorg xserver-xorg-video-amdgpu xserver-xorg-core-dbgsym 
xserver-xorg-video-amdgpu-dbgsym
apt build-dep xserver-xorg-video-amdgpu



mkdir /home/benutzer/source/xserver-xorg-video-amdgpu/orig -p
cd/home/benutzer/source/xserver-xorg-video-amdgpu/orig
apt source xserver-xorg-video-amdgpu



gdb -q
set width 0
set pagination off
directory 
/home/benutzer/source/xserver-xorg-video-amdgpu/orig/xserver-xorg-video-amdgpu-23.0.0/debian/patches
file /usr/lib/xorg/Xorg
tb main
run
call dlopen("/usr/lib/xorg/modules/drivers/amdgpu_drv.so",0x101)
print (int)getpid()
shell cat /proc/2535/maps | grep amdgpu_drv | head -n1
b *(0x774f9000 + 0x16c96)
b *(0x774f9000 + 0x16702)
info b
pipe disassemble drmmode_set_mode_major | grep -i c96 -C3
pipe disassemble drmmode_set_mode | grep -i 702 -C3
list drmmode_display.c:1371
list drmmode_display.c:1267



benutzer@debian:~$ gdb -q
(gdb) set width 0
(gdb) set pagination off
(gdb) directory 
/home/benutzer/source/xserver-xorg-video-amdgpu/orig/xserver-xorg-video-amdgpu-23.0.0/debian/patches
Source directories searched: 
/home/benutzer/source/xserver-xorg-video-amdgpu/orig/xserver-xorg-video-amdgpu-23.0.0/debian/patches:$cdir:$cwd
(gdb) file /usr/lib/xorg/Xorg
Reading symbols from /usr/lib/xorg/Xorg...
Reading symbols from 
/usr/lib/debug/.build-id/77/6f662cfdbd2d0952921614575518e7c1b90261.debug...
(gdb) tb main
Temporary breakpoint 1 at 0x4d260: file ../../../../dix/stubmain.c, line 33.
(gdb) run
Starting program: /usr/lib/xorg/Xorg 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Temporary breakpoint 1, main (argc=1, argv=0x7fffe478, envp=0x7fffe488) 
at ../../../../dix/stubmain.c:33
33  ../../../../dix/stubmain.c: Datei oder Verzeichnis nicht gefunden.
(gdb) call dlopen("/usr/lib/xorg/modules/drivers/amdgpu_drv.so",0x101)
$1 = (void *) 0x55803a80
(gdb) info inferior
  Num  Description   Connection   Executable
* 1process 2535  1 (native)   /usr/lib/xorg/Xorg 
(gdb) print (int)getpid()
$2 = 2535
(gdb) shell cat /proc/2535/maps | grep amdgpu_drv | head -n1
774f9000-7750 r--p  08:12 681046 
/usr/lib/xorg/modules/drivers/amdgpu_drv.so
(gdb) b *(0x774f9000 + 0x16c96)
Breakpoint 2 at 0x7750fc96: file ../../src/drmmode_display.c, line 1371.
(gdb) b *(0x774f9000 + 0x16702)
Breakpoint 3 at 0x7750f702: file ../../src/drmmode_display.c, line 1267.
(gdb) info b
Num Type   Disp Enb AddressWhat
2   breakpoint keep y   0x7750fc96 in drmmode_set_mode_major at 
../../src/drmmode_display.c:1371
3   breakpoint keep y   0x7750f702 in drmmode_set_mode at 
../../src/drmmode_display.c:1267
(gdb) pipe disassemble drmmode_set_mode_major | grep -i c96 -C3
   0x7750fc8b <+955>:   mov%r14,%rsi
   0x7750fc8e <+958>:   mov%rbx,%rdi
   0x7750fc91 <+961>:   call   0x7750f650 
   0x7750fc96 <+966>:   test   %eax,%eax
   0x7750fc98 <+968>:   jne0x7750fef8 

   0x7750fc9e <+974>:   mov0x30(%rsp),%rdi
   0x7750fca3 <+979>:   lea0x60(%rsp),%rsi
(gdb) pipe disassemble drmmode_set_mode | grep -i 702 -C3
   0x7750f6f8 <+168>:   jne0x7750f710 
   0x7750f6fa <+170>:   mov0x78(%rsi),%rsi
   0x7750f6fe <+174>:   mov0x10(%rsi),%rsi
   0x7750f702 <+178>:   mov(%rsi),%r11d
   0x7750f705 <+181>:   movslq %ecx,%rsi
   

Bug#1059041: Xorg segfault when unlocking from Xscreensaver while video playback

[Eduard Bloch]

Package: xserver-xorg-video-amdgpu
Version: 23.0.0-1
Severity: important

Prerequisites:

- icewm
- xscreensaver
- vlc

Repro:

a) let a fullscreen video run in VLC
b) wait until xscreensaver blackens the screen
c) push any key in the very same second

Result:

Whole Xorg going down, see below. Following the trace dump smells like
the error would originate in the video driver.

$ coredumpctl dump > /tmp/xorg-video-playback-crash.log


   PID: 1011552 (Xorg)
   UID: 0 (root)
   GID: 0 (root)
Signal: 6 (ABRT)
 Timestamp: Tue 2023-12-19 20:09:34 CET (5min ago)
  Command Line: /usr/lib/xorg/Xorg :0 -seat seat0 -auth 
/var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch
Executable: /usr/lib/xorg/Xorg
 Control Group: /system.slice/lightdm.service
  Unit: lightdm.service
 Slice: system.slice
   Boot ID: 67cdd05639504fd48e987b5f02106871
Machine ID: ae90e3d096ca29949df8c700456b394f
  Hostname: zombie
   Storage: 
/var/lib/systemd/coredump/core.Xorg.0.67cdd05639504fd48e987b5f02106871.1011552.170301297400.zst
 (present)
  Size on Disk: 7.1M
   Message: Process 1011552 (Xorg) of user 0 dumped core.

Module libzstd.so.1 from deb libzstd-1.5.5+dfsg2-2.amd64
Module libsystemd.so.0 from deb systemd-255-1.amd64
Module libudev.so.1 from deb systemd-255-1.amd64
Stack trace of thread 1011552:
#0  0x7fb1494a80fc __pthread_kill_implementation (libc.so.6 
+ 0x8a0fc)
#1  0x7fb14945a472 __GI_raise (libc.so.6 + 0x3c472)
#2  0x7fb149b2 __GI_abort (libc.so.6 + 0x264b2)
#3  0x5577d8f7ae30 OsAbort (Xorg + 0x1d8e30)
#4  0x5577d8f80649 n/a (Xorg + 0x1de649)
#5  0x5577d8f81619 FatalError (Xorg + 0x1df619)
#6  0x5577d8f78019 n/a (Xorg + 0x1d6019)
#7  0x7fb14945a510 __restore_rt (libc.so.6 + 0x3c510)
#8  0x7fb149186702 n/a (amdgpu_drv.so + 0x16702)
#9  0x7fb149186c96 n/a (amdgpu_drv.so + 0x16c96)
#10 0x5577d8e75a6b xf86DPMSSet (Xorg + 0xd3a6b)
#11 0x5577d8e41485 n/a (Xorg + 0x9f485)
#12 0x5577d8eb5c56 n/a (Xorg + 0x113c56)
#13 0x5577d8f57335 mieqProcessInputEvents (Xorg + 0x1b5335)
#14 0x5577d8e4177d ProcessInputEvents (Xorg + 0x9f77d)
#15 0x5577d8e01f93 n/a (Xorg + 0x5ff93)
#16 0x5577d8e062cc n/a (Xorg + 0x642cc)
#17 0x7fb1494456ca __libc_start_call_main (libc.so.6 + 
0x276ca)
#18 0x7fb149445785 __libc_start_main_impl (libc.so.6 + 
0x27785)
#19 0x5577d8def281 _start (Xorg + 0x4d281)

Stack trace of thread 1011555:
#0  0x7fb1494a3156 __futex_abstimed_wait_common64 
(libc.so.6 + 0x85156)
#1  0x7fb1494a5818 __pthread_cond_wait_common (libc.so.6 + 
0x87818)
#2  0x7fb146d198ed n/a (radeonsi_dri.so + 0x1198ed)
#3  0x7fb146cf96cb n/a (radeonsi_dri.so + 0xf96cb)
#4  0x7fb146d1981b n/a (radeonsi_dri.so + 0x11981b)
#5  0x7fb1494a63ec start_thread (libc.so.6 + 0x883ec)
#6  0x7fb149526a5c __clone3 (libc.so.6 + 0x108a5c)

Stack trace of thread 1011556:
#0  0x7fb1494a3156 __futex_abstimed_wait_common64 
(libc.so.6 + 0x85156)
#1  0x7fb1494a5818 __pthread_cond_wait_common (libc.so.6 + 
0x87818)
#2  0x7fb146d198ed n/a (radeonsi_dri.so + 0x1198ed)
#3  0x7fb146cf96cb n/a (radeonsi_dri.so + 0xf96cb)
#4  0x7fb146d1981b n/a (radeonsi_dri.so + 0x11981b)
#5  0x7fb1494a63ec start_thread (libc.so.6 + 0x883ec)
#6  0x7fb149526a5c __clone3 (libc.so.6 + 0x108a5c)

Stack trace of thread 1011557:
#0  0x7fb1494a3156 __futex_abstimed_wait_common64 
(libc.so.6 + 0x85156)
#1  0x7fb1494a5818 __pthread_cond_wait_common (libc.so.6 + 
0x87818)
#2  0x7fb146d198ed n/a (radeonsi_dri.so + 0x1198ed)
#3  0x7fb146cf96cb n/a (radeonsi_dri.so + 0xf96cb)
#4  0x7fb146d1981b n/a (radeonsi_dri.so + 0x11981b)
#5  0x7fb1494a63ec start_thread (libc.so.6 + 0x883ec)
#6  0x7fb149526a5c __clone3 (libc.so.6 + 0x108a5c)

Stack trace of thread 1011562:
#0  0x7fb1494a3156 __futex_abstimed_wait_common64 
(libc.so.6 + 0x85156)
#1  0x7fb1494a5818 __pthread_cond_wait_common (libc.so.6 + 
0x87818)
#2  0x7fb146d198ed n/a (radeonsi_dri.so + 0x1198ed)
#3  0x7fb146cf96cb n/a (radeonsi_dri.so + 0xf96cb)