Bug 189358 – x11-base/xorg-server-1.2.0-r3 with net-misc/vnc-4.1.2-r2 crashes with active VNC connection

• Status: RESOLVED NEEDINFO
• Product: Gentoo Linux

[Description Jaak Ristioja 2007-08-18 13:14:55 UTC]

When I try to connect to my desktop in another city 64 km away via VNC, Xorg crashes when KDE+KTorrent is running, closing all running X programs, resulting in loss of data. As xdm (kdm) restarts X, I am able to connect via VNC, but running KTorrent again crashes the server.

Finally I was able to produce the following backgrace of X:
#0  0x00002b51dfb9b0e3 in memcpy () from /lib/libc.so.6
#1  0x00002b51ea3b4b84 in ?? ()
#2  0x00002b51e19f73f4 in fbBlt (srcLine=<value optimized out>, srcStride=<value optimized out>, srcX=<value optimized out>, dstLine=0x2b51ea3b4b84,
    dstStride=22, dstX=0, width=704, height=1, alu=3, pm=4294967295, bpp=32, reverse=0, upsidedown=0) at fbblt.c:95
#3  0x00002b51e19f8060 in fbBltStip (src=0x2b51ea3b4b84, srcStride=-510854284, srcX=84, dst=0xffffffff, dstStride=-3, dstX=0, width=704, height=1, alu=3,
    pm=4294967295, bpp=32) at fbblt.c:949
#4  0x00002b51e1a063bb in fbGetImage (pDrawable=<value optimized out>, x=-611, y=-771, w=22, h=1, format=2, planeMask=18446744073709551615,
    d=0x2b51ea3b4b84 <Address 0x2b51ea3b4b84 out of bounds>) at fbimage.c:330
#5  0x00000000004c0e46 in miBSGetImage (pDrawable=0x7413f0, sx=-611, sy=-771, w=22, h=1, format=2, planemask=18446744073709551615,
    pdstLine=0x2b51ea3b4b84 <Address 0x2b51ea3b4b84 out of bounds>) at mibstore.c:609
#6  0x00002b51e1c34f31 in XAAGetImage (pDraw=0x7413f0, sx=-611, sy=-771, w=22, h=1, format=2, planemask=18446744073709551615,
    pdstLine=0x2b51ea3b4b84 <Address 0x2b51ea3b4b84 out of bounds>) at xaaInit.c:301
#7  0x000000000050e209 in cwGetImage (pSrc=<value optimized out>, x=-611, y=-771, w=22, h=1, format=2, planemask=18446744073709551615,
    pdstLine=0x2b51ea3b4b84 <Address 0x2b51ea3b4b84 out of bounds>) at cw.c:357
#8  0x00000000004d392c in miSpriteGetImage (pDrawable=0x7413f0, sx=-611, sy=-771, w=22, h=1, format=2, planemask=18446744073709551615,
    pdstLine=0x2b51ea3b4b84 <Address 0x2b51ea3b4b84 out of bounds>) at misprite.c:299
#9  0x00002b51dff2a88d in XserverDesktop::grabRegion (this=0x7394c0, region=@0x7fffcbc43410) at XserverDesktop.cc:728
#10 0x00002b51e00bd725 in rfb::VNCServerST::checkUpdate (this=0x7395a0) at VNCServerST.cxx:397
#11 0x00002b51e00b8ab3 in rfb::VNCSConnectionST::writeFramebufferUpdate (this=0x721a40) at VNCSConnectionST.cxx:500
#12 0x00002b51e00b93e3 in rfb::VNCSConnectionST::framebufferUpdateRequest (this=0x721a40, r=@0x7fffcbc436b0, incremental=true) at VNCSConnectionST.cxx:461
#13 0x00002b51e00ae0f5 in rfb::SMsgReader::readFramebufferUpdateRequest (this=0x802470) at SMsgReader.cxx:64
#14 0x00002b51e00ae681 in rfb::SMsgReaderV3::readMsg (this=0x802470) at SMsgReaderV3.cxx:48
#15 0x00002b51e00ac697 in rfb::SConnection::processMsg (this=0x721a40) at SConnection.cxx:90
#16 0x00002b51e00ba533 in rfb::VNCSConnectionST::processMessages (this=0x721a40) at VNCSConnectionST.cxx:110
#17 0x00002b51e00be3c2 in rfb::VNCServerST::processSocketEvent (this=0x7395a0, sock=0x7c0d50) at VNCServerST.cxx:158
#18 0x00002b51dff2af60 in XserverDesktop::wakeupHandler (this=0x7394c0, fds=0x6b9200, nfds=1) at XserverDesktop.cc:589
#19 0x00002b51dff21fb5 in vncWakeupHandler (data=0x0, nfds=1, readmask=0x6b9200) at vncExtInit.cc:259
#20 0x000000000044b59e in WakeupHandler (result=1, pReadmask=0x6b9200) at dixutils.c:448
#21 0x0000000000549354 in WaitForSomething (pClientsReady=0x7fffcbc43bc0) at WaitFor.c:241
#22 0x0000000000447b0b in Dispatch () at dispatch.c:383
#23 0x0000000000430e8b in main (argc=8, argv=0x7fffcbc44158, envp=<value optimized out>) at main.c:445

[Comment 1 Jaak Ristioja 2007-08-18 13:17:04 UTC]

[ebuild   R   ] x11-base/xorg-server-1.2.0-r3  USE="debug dmx dri ipv6 nptl sdl xorg xprint (-3dfx) -kdrive -minimal" INPUT_DEVICES="keyboard mouse -acecad -aiptek -calcomp -citron -digitaledge -dmc -dynapro -elo2300 -elographics -evdev -fpit -hyperpen -jamstudio -joystick -magellan -microtouch -mutouch -palmax -penmount -spaceorb -summa -synaptics -tek4957 -ur98 -vmmouse -void -wacom" VIDEO_CARDS="fbdev nv radeon vesa vga -apm -ark -chips -cirrus -cyrix -dummy -epson -fglrx -glint -i128 (-i740) -i810 (-impact) (-imstt) -mach64 -mga -neomagic (-newport) (-nsc) -nvidia -r128 -rendition -s3 -s3virge -savage -siliconmotion -sis -sisusb (-sunbw2) (-suncg14) (-suncg3) (-suncg6) (-sunffb) (-sunleo) (-suntcx) -tdfx -tga -trident -tseng -v4l -via -vmware -voodoo" 0 kB
[ebuild   R   ] net-misc/vnc-4.1.2-r2  USE="server" 0 kB

emerge --info:
Portage 2.1.2.11 (default-linux/amd64/2007.0, gcc-4.1.2, glibc-2.5-r4, 2.6.22-gentoo-r2-worship x86_64)
=================================================================
System uname: 2.6.22-gentoo-r2-worship x86_64 AMD Athlon(tm) 64 Processor 3200+
Gentoo Base System release 1.12.9
Timestamp of tree: Fri, 17 Aug 2007 08:30:01 +0000
distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632) [disabled]
dev-java/java-config: 1.3.7, 2.0.33-r1
dev-lang/python:     2.4.4-r4
dev-python/pycrypto: 2.0.1-r6
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.17
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.23b
virtual/os-headers:  2.6.22-r2
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=athlon64"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-O2 -pipe -march=athlon64"
DISTDIR="/usr/portage/distfiles"
FEATURES="collision-protect distlocks fixpackages metadata-transfer parallel-fetch sandbox sfperms splitdebug strict usersandbox"
GENTOO_MIRRORS="http://ftp.linux.ee/pub/gentoo/distfiles/ http://trumpetti.atm.tut.fi/gentoo/"
LANG="en_US.UTF-8"
LC_ALL="en_US.UTF-8"
LINGUAS="en et en_GB en_US de"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="3dnow X aac acl alsa amd64 arts bash-completion berkdb bitmap-fonts bzip2 cairo cjk cli cracklib crypt cups dbus directfb dri encode fbcon ffmpeg flac fortran gdbm gif gmp gpm gtk gtk2 hal iconv imagemagick imlib ipv6 isdnlog jbig jpeg jpeg2k kde lcms midi mmx mng mp3 mpeg mudflap ncurses nptl nptlonly ogg opengl openmp pam pcre perl pic png pppd python quicktime readline reflection samba sdl session sndfile spl sse sse2 ssl svg tcpd theora threads tiff truetype truetype-fonts type1-fonts unicode vhosts vorbis xinerama xml xorg xprint xscreensaver xv xvid zlib" ALSA_CARDS="intel8x0 intel8x0m via82xx virmidi" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en et en_GB en_US de" LIRC_DEVICES="irdeo" USERLAND="GNU" VIDEO_CARDS="ati radeon nv vesa fbdev vga"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LDFLAGS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

[Comment 2 Jakub Moc (RETIRED) 2007-09-29 21:52:51 UTC]

Can you reproduce this w/ 1.3.0.0?

[Comment 3 Jaak Ristioja 2007-10-01 10:41:02 UTC]

Yes. It still crashes the same way.

[Comment 4 Jaak Ristioja 2008-03-17 23:13:06 UTC]

Here's the backtrace with from Xorg's logs when using xorg-server-1.3.0.0-r5 with vnc-4.1.2-r3:

Backtrace:
0: /usr/bin/X(xf86SigHandler+0x6d) [0x49107d]
1: /lib/libc.so.6 [0x2b3d1f93d430]
2: /lib/libc.so.6(memcpy+0xa0) [0x2b3d1f982970]
3: /usr/lib64/xorg/modules//libfb.so(fbBlt+0x124) [0x2b3d228b8a94]
4: /usr/lib64/xorg/modules//libfb.so(fbBltStip+0x40) [0x2b3d228b9700]
5: /usr/lib64/xorg/modules//libfb.so(fbGetImage+0x29b) [0x2b3d228c7a5b]
6: /usr/bin/X [0x4da926]
7: /usr/lib64/xorg/modules//libxaa.so [0x2b3d22aef5d1]
8: /usr/bin/X [0x52e4a9]
9: /usr/bin/X [0x4ed3ec]
10: /usr/lib64/xorg/modules/extensions//libvnc.so(_ZN14XserverDesktop10grabRegionERKN3rfb6RegionE+0x106) [0x2b3d1ff111d6]
11: /usr/lib/librfb.so.0(_ZN3rfb11VNCServerST11checkUpdateEv+0x17e) [0x2b3d20182d0e]
12: /usr/lib/librfb.so.0(_ZN3rfb16VNCSConnectionST22writeFramebufferUpdateEv+0x96) [0x2b3d20181306]
13: /usr/lib/librfb.so.0(_ZN3rfb16VNCSConnectionST24framebufferUpdateRequestERKNS_4RectEb+0xa6) [0x2b3d201819f6]
14: /usr/lib/librfb.so.0(_ZN3rfb10SMsgReader28readFramebufferUpdateRequestEv+0x183) [0x2b3d20177b53]
15: /usr/lib/librfb.so.0(_ZN3rfb16VNCSConnectionST15processMessagesEv+0x30) [0x2b3d20180940]
16: /usr/lib64/xorg/modules/extensions//libvnc.so(_ZN14XserverDesktop13wakeupHandlerEP6fd_seti+0xf6) [0x2b3d1ff10b66]
17: /usr/lib64/xorg/modules/extensions//libvnc.so [0x2b3d1ff08b29]
18: /usr/bin/X(WakeupHandler+0x4e) [0x45475e]
19: /usr/bin/X(WaitForSomething+0x1c4) [0x569594]
20: /usr/bin/X(Dispatch+0x8b) [0x450c9b]
21: /usr/bin/X(main+0x45b) [0x439f6b]
22: /lib/libc.so.6(__libc_start_main+0xf4) [0x2b3d1f92ab74]
23: /usr/bin/X(FontFileCompleteXLFD+0x229) [0x439259]

Btw, what's blocking fixing this bug? This bug has been around for months...

[Comment 5 Donnie Berkholz (RETIRED) 2008-05-09 08:39:00 UTC]

Is this still an issue with xorg-server 1.4.0.90-r4 (add '=x11-base/xorg-server-1.4.0.90-r4 **' to package.keywords to test)? If so, I'll help you get this issue upstream.

[Comment 6 Jaak Ristioja 2009-02-14 18:10:21 UTC]

(In reply to comment #5)
> Is this still an issue with xorg-server 1.4.0.90-r4 (add
> '=x11-base/xorg-server-1.4.0.90-r4 **' to package.keywords to test)? If so,
> I'll help you get this issue upstream.
> 

I'm truly uninterested in this right now, since I started using x11vnc after about a year from reporting this issue. Moreso I can't currently afford to test this.