NetBSD Problem Report #47305

From cheusov@tut.by  Mon Dec 10 13:41:35 2012
Return-Path: <cheusov@tut.by>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	by www.NetBSD.org (Postfix) with ESMTP id 72AB063EA40
	for <gnats-bugs@gnats.netbsd.org>; Mon, 10 Dec 2012 13:41:35 +0000 (UTC)
Message-Id: <s9338ze58jq.fsf@cheusov.imb.invention.com>
Date: Mon, 10 Dec 2012 16:41:13 +0300
From: cheusov@tut.by
To: gnats-bugs@gnats.NetBSD.org
Subject: Xorg segfaults when using X font server
X-Send-Pr-Version: 3.95

>Number:         47305
>Category:       xsrc
>Synopsis:       Xorg segfaults when using X font server
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    xsrc-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Dec 10 13:45:01 +0000 2012
>Last-Modified:  Mon Dec 10 19:30:08 +0000 2012
>Originator:     Aleksey Cheusov
>Release:        NetBSD 6.0.0_PATCH
>Organization:
>Environment:
System: NetBSD cheusov.imb.invention.com 6.0.0_PATCH NetBSD 6.0.0_PATCH (GENERIC) #3: Fri Dec 7 11:55:38 FET 2012 cheusov@cheusov.imb.invention.com:/srv/obj/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:
The following commands

   xset fp+ tcp/hostname:7100
   xlsfonts

crashes X server. Backtrace is below

(gdb) bt
#0  0xbb8d4c27 in _lwp_kill () from /usr/lib/libc.so.12
#1  0xbb8d4bdf in raise (s=6) at /srv/src_netbsd6/lib/libc/gen/raise.c:48
#2  0xbb8d44c3 in abort () at /srv/src_netbsd6/lib/libc/stdlib/abort.c:74
#3  0x08195528 in OsAbort ()
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/os/utils.c:1244
#4  0x080a5b24 in ddxGiveUp ()
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/hw/xfree86/common/xf86Init.c:915
#5  0x080a5bcb in AbortDDX ()
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/hw/xfree86/common/xf86Init.c:961
#6  0x0818eea7 in AbortServer ()
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/os/log.c:414
#7  0x0818ef84 in FatalError (f=0x82099f4 "Caught signal %d (%s). Server aborting\n")
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/os/log.c:540
#8  0x08195deb in OsSigHandler (signo=11, sip=0xbfbfe818, unused=0xbfbfe898)
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/os/osinit.c:153
#9  <signal handler called>
#10 ProcessWorkQueue ()
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/dix/dixutils.c:527
#11 0x0819add8 in WaitForSomething (pClientsReady=0xb7b97c00)
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/os/WaitFor.c:173
#12 0x080943f1 in Dispatch ()
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/dix/dispatch.c:367
#13 0x0806f30e in main (argc=5, argv=0xbfbfed94, envp=0xbfbfedac)
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/dix/main.c:287
(gdb) frame 10
#10 ProcessWorkQueue ()
    at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/dix/dixutils.c:527
527             if ((*q->function) (q->client, q->closure))
(gdb) p q
$1 = (WorkQueuePtr) 0x6c676c6f
(gdb) p p
$2 = (WorkQueuePtr *) 0x822bfb0
(gdb)

>How-To-Repeat:
1)
/etc/rc.d/xfs:
   clone-self = on
   use-syslog = off
   catalogue = /usr/X11R7/lib/X11/fonts/misc/
   error-file = /var/log/xfs.log

   default-point-size = 120
   default-resolutions = 75,75,100,100

2)
/etc/rc.d/xfs onestart

3)
Start Xorg

4)
   xset fp+ tcp/localhost:7100
   xlsfonts
   <crash happens here>

>Fix:

>Audit-Trail:
From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: xsrc/47305: Xorg segfaults when using X font server
Date: Mon, 10 Dec 2012 14:49:16 +0100

 Can you go to this frame:

 #10 ProcessWorkQueue ()
     at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/dix/dixutils.c:527

 and do

   print *q

 please?

 Martin

From: Aleksey Cheusov <cheusov@tut.by>
To: gnats-bugs@netbsd.org
Cc: xsrc-manager@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: xsrc/47305: Xorg segfaults when using X font server
Date: Mon, 10 Dec 2012 18:49:07 +0300

 >  #10 ProcessWorkQueue ()
 >      at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/dix/dixutils.c:527
 >
 >  and do
 >
 >    print *q
 >
 >  please?

 (gdb) p *q
 Cannot access memory at address 0x6c676c6f
 (gdb)

 BTW. Accessing xfs running on remote Linux also crashes X.

From: David Laight <david@l8s.co.uk>
To: 
Cc: gnats-bugs@netbsd.org
Subject: Re: xsrc/47305: Xorg segfaults when using X font server
Date: Mon, 10 Dec 2012 19:42:12 +0000

 On Mon, Dec 10, 2012 at 06:49:07PM +0300, Aleksey Cheusov wrote:
 > >  #10 ProcessWorkQueue ()
 > >      at /srv/xsrc_netbsd6/external/mit/xorg-server/dist/dix/dixutils.c:527
 > >
 > >  and do
 > >
 > >    print *q
 > >
 > >  please?
 > 
 > (gdb) p *q
 > Cannot access memory at address 0x6c676c6f

 That looks like "olgl".
 Might be worth working out where it is read from and finding the
 rest of the string.

 	David

 -- 
 David Laight: david@l8s.co.uk

NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2007 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.