Bug 15729 - Graphical version of diskdrake crashes over ssh -X with BadAccess in gdk_window_set_cursor
Summary: Graphical version of diskdrake crashes over ssh -X with BadAccess in gdk_wind...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: x86_64 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact:
URL:
Whiteboard:
Keywords: NEEDINFO
Depends on:
Blocks:
 
Reported: 2015-04-18 01:10 CEST by Pascal Terjan
Modified: 2016-03-23 19:33 CET (History)
1 user (show)

See Also:
Source RPM: drakxtools
CVE:
Status comment:


Attachments

Description Pascal Terjan 2015-04-18 01:10:09 CEST
The window briefly appears then it crashes:

(drakdisk:19157): Gdk-ERROR **: The program 'drakdisk' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAccess (attempt to access private resource denied)'.
  (Details: serial 247 error_code 10 request_code 2 (core protocol) minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the GDK_SYNCHRONIZE environment
   variable to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

Program received signal SIGTRAP, Trace/breakpoint trap.
g_logv (log_domain=0x7fffece86bce "Gdk", log_level=G_LOG_LEVEL_ERROR, format=<optimized out>, args=args@entry=0x7fffffffd7e8) at gmessages.c:1046
1046		  g_private_set (&g_log_depth, GUINT_TO_POINTER (depth));
Missing separate debuginfos, use: debuginfo-install lib64freetype6-2.5.4-2.mga5.x86_64
(gdb) bt
#0  0x00007fffeea03b10 in g_logv (log_domain=0x7fffece86bce "Gdk", log_level=G_LOG_LEVEL_ERROR, format=<optimized out>, args=args@entry=0x7fffffffd7e8) at gmessages.c:1046
#1  0x00007fffeea03d42 in g_log (log_domain=log_domain@entry=0x7fffece86bce "Gdk", log_level=log_level@entry=G_LOG_LEVEL_ERROR, format=format@entry=0x7fffecea29cc "%s")
    at gmessages.c:1079
#2  0x00007fffece5c3bb in _gdk_x11_display_error_event (display=display@entry=0x224f000 [GdkX11Display], error=error@entry=0x7fffffffd990) at gdkdisplay-x11.c:2539
#3  0x00007fffece64bb1 in gdk_x_error (xdisplay=0x2241950, error=0x7fffffffd990) at gdkmain-x11.c:302
#4  0x00007ffff404aedd in _XError (dpy=dpy@entry=0x2241950, rep=rep@entry=0x2e07350) at XlibInt.c:1463
#5  0x00007ffff4047ed7 in handle_error (dpy=0x2241950, err=0x2e07350, in_XReply=<optimized out>) at xcb_io.c:213
#6  0x00007ffff4047f85 in handle_response (dpy=dpy@entry=0x2241950, response=0x2e07350, in_XReply=in_XReply@entry=1) at xcb_io.c:325
#7  0x00007ffff4048e98 in _XReply (dpy=dpy@entry=0x2241950, rep=rep@entry=0x7fffffffdb50, extra=extra@entry=0, discard=discard@entry=1) at xcb_io.c:627
#8  0x00007ffff404497d in XSync (dpy=0x2241950, discard=discard@entry=0) at Sync.c:44
#9  0x00007ffff4044a0b in _XSyncFunction (dpy=<optimized out>) at Synchro.c:35
#10 0x00007ffff4028cce in XDefineCursor (dpy=0x2241950, w=181, cursor=98566155) at DefCursor.c:46
#11 0x00007fffece493e3 in gdk_window_set_cursor (window=0x2257000 [GdkX11Window], cursor=<optimized out>) at gdkwindow.c:5839
#12 0x00007fffef167dd0 in ffi_call_unix64 () at ../src/x86/unix64.S:76
#13 0x00007fffef167838 in ffi_call (cif=<optimized out>, fn=<optimized out>, rvalue=0x7fffffffdd40, avalue=0x2e07100) at ../src/x86/ffi64.c:525
#14 0x00007fffee1307d4 in invoke_c_code (info=0x7ffff6c8ecc0 <main_arena>, info@entry=0x2d86140, func_pointer=0x0, sp=0x7ffff6c8ed18 <main_arena+88>, 
    sp@entry=0x26c9060, ax=-154521216, ax@entry=1, items=61167, 
    items@entry=6, internal_stack_offset=140737488346480, package=0x0, namespace=0x0, function=0x0, mark=<optimized out>) at gperl-i11n-invoke-c.c:202
#15 0x00007fffee1316ce in XS_Glib__Object__Introspection_invoke (my_perl=<optimized out>, cv=<optimized out>) at GObjectIntrospection.xs:985
#16 0x00007ffff7aee60b in Perl_pp_entersub (my_perl=0x603010) at pp_hot.c:2794
#17 0x00007ffff7ae6fd6 in Perl_runops_standard (my_perl=0x603010) at run.c:42
#18 0x00007ffff7a78ded in perl_run (oldscope=1, my_perl=0x603010) at perl.c:2451
#19 0x00007ffff7a78ded in perl_run (my_perl=0x603010) at perl.c:2372
#20 0x0000000000400ea9 in main (argc=2, argv=0x7fffffffe218, env=0x7fffffffe230) at perlmain.c:114


Reproducible: 

Steps to Reproduce:
Comment 1 Pascal Terjan 2015-04-18 01:12:47 CEST
More detailed stack:

#0  0x00007fffeea03b10 in g_logv (log_domain=0x7fffece86bce "Gdk", log_level=G_LOG_LEVEL_ERROR, format=<optimized out>, args=args@entry=0x7fffffffd7e8) at gmessages.c:1046
        domain = 0x0
        data = 0x0
        depth = 0
        log_func = 0x7fffeea033a0 <g_log_default_handler>
        domain_fatal_mask = <optimized out>
        masquerade_fatal = 0
        test_level = <optimized out>
        was_fatal = <optimized out>
        was_recursion = <optimized out>
        msg = 0x2e0e760 "The program 'drakdisk' received an X Window System error.\nThis probably reflects a bug in the program.\nThe error was 'BadAccess (attempt to access private resource denied)'.\n  (Details: serial 247 err"...
        msg_alloc = 0x2e0e760 "The program 'drakdisk' received an X Window System error.\nThis probably reflects a bug in the program.\nThe error was 'BadAccess (attempt to access private resource denied)'.\n  (Details: serial 247 err"...
        i = 2
#1  0x00007fffeea03d42 in g_log (log_domain=log_domain@entry=0x7fffece86bce "Gdk", log_level=log_level@entry=G_LOG_LEVEL_ERROR, format=format@entry=0x7fffecea29cc "%s")
    at gmessages.c:1079
        args = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7fffffffd8c0, reg_save_area = 0x7fffffffd800}}
#2  0x00007fffece5c3bb in _gdk_x11_display_error_event (display=display@entry=0x224e000 [GdkX11Display], error=error@entry=0x7fffffffd990) at gdkdisplay-x11.c:2539
        buf = "BadAccess (attempt to access private resource denied)\000\000\000\000\000\000\000\000\000\000"
        msg = <optimized out>
        display_x11 = 0x224e000 [GdkX11Display]
        tmp_list = <optimized out>
        ignore = 0
#3  0x00007fffece64bb1 in gdk_x_error (xdisplay=0x22417a0, error=0x7fffffffd990) at gdkmain-x11.c:302
        error_display = 0x224e000 [GdkX11Display]
        manager = <optimized out>
        displays = 0x0
        error = 0x7fffffffd990
        xdisplay = 0x22417a0
#4  0x00007ffff404aedd in _XError (dpy=dpy@entry=0x22417a0, rep=rep@entry=0x2e06fe0) at XlibInt.c:1463
        rtn_val = <optimized out>
        event = 
            {type = 0, xany = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522}, xkey = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, root = 0, subwindow = 35924464, time = 140737287079352, x = 0, y = 0, x_root = 35919776, y_root = 0, state = 48263136, keycode = 0, same_screen = -136373648}, xbutton = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, root = 0, subwindow = 35924464, time = 140737287079352, x = 0, y = 0, x_root = 35919776, y_root = 0, state = 48263136, button = 0, same_screen = -136373648}, xmotion = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, root = 0, subwindow = 35924464, time = 140737287079352, x = 0, y = 0, x_root = 35919776, y_root = 0, state = 48263136, is_hint = 0 '\000', same_screen = -136373648}, xcrossing = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, root = 0, subwindow = 35924464, time = 140737287079352, x = 0, y = 0, x_root = 35919776, y_root = 0, mode = 48263136, detail = 0, same_screen = -136373648, focus = 32767, state = 4294957576}, xfocus = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, mode = 0, detail = 0}, xexpose = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, x = 0, y = 0, width = 35924464, height = 0, count = -201275976}, xgraphicsexpose = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, drawable = 522, x = 0, y = 0, width = 35924464, height = 0, count = -201275976, major_code = 32767, minor_code = 0}, xnoexpose = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, drawable = 522, major_code = 0, minor_code = 0}, xvisibility = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, state = 0}, xcreatewindow = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, parent = 522, window = 0, x = 35924464, y = 0, width = -201275976, height = 32767, border_width = 0, override_redirect = 0}, xdestroywindow = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, event = 522, window = 0}, xunmap = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, event = 522, window = 0, from_configure = 35924464}, xmap = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, event = 522, window = 0, override_redirect = 35924464}, xmaprequest = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, parent = 522, window = 0}, xreparent = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, event = 522, window = 0, parent = 35924464, x = -201275976, y = 32767, override_redirect = 0}, xconfigure = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, event = 522, window = 0, x = 35924464, y = 0, width = -201275976, height = 32767, border_width = 0, above = 35919776, override_redirect = 48263136}, xgravity = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, event = 522, window = 0, x = 35924464, y = 0}, xresizerequest = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, width = 0, height = 0}, xconfigurerequest = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, parent = 522, window = 0, x = 35924464, y = 0, width = -201275976, height = 32767, border_width = 0, above = 35919776, detail = 48263136, value_mask = 140737351981680}, xcirculate = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, event = 522, window = 0, place = 35924464}, xcirculaterequest = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, parent = 522, window = 0, place = 35924464}, xproperty = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, atom = 0, time = 35924464, state = -201275976}, xselectionclear = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, selection = 0, time = 35924464}, xselectionrequest = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, owner = 522, requestor = 0, selection = 35924464, target = 140737287079352, property = 0, time = 35919776}, xselection = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, requestor = 522, selection = 0, target = 35924464, property = 140737287079352, time = 0}, xcolormap = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, colormap = 0, new = 35924464, state = 0}, xclient = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, message_type = 0, format = 35924464, data = {b = "\270\305\000\364\377\177\000\000\000\000\000\000\000\000\000\000\240\027$\002", s = {-14920, -3072, 32767, 0, 0, 0, 0, 0, 6048, 548}, l = {140737287079352, 0, 35919776, 48263136, 140737351981680}}}, xmapping = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, request = 0, first_keycode = 0, count = 35924464}, xerror = {type = 0, display = 0x22417a0, resourceid = 181, serial = 247, error_code = 10 '\n', request_code = 2 '\002', minor_code = 0 '\000'}, xkeymap = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, window = 522, key_vector = "\000\000\000\000\000\000\000\000\360)$\002\000\000\000\000\270\305\000\364\377\177\000\000\000\000\000\000\000\000\000"}, xgeneric = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, extension = 522, evtype = 0}, xcookie = {type = 0, serial = 35919776, send_event = 181, display = 0xf7, extension = 522, evtype = 0, cookie = 0, data = 0x22429f0}, pad = {0, 35919776, 181, 247, 522, 0, 35924464, 140737287079352, 0, 35919776, 48263136, 140737351981680, 140737488345608, 140737282765493, 35924464, 48263056, 248, 140737488345648, 0, 35924464, 0, -1, 1, 48263136}}
        async = <optimized out>
        next = <optimized out>
#5  0x00007ffff4047ed7 in handle_error (dpy=0x22417a0, err=0x2e06fe0, in_XReply=<optimized out>) at xcb_io.c:213
        ext = <optimized out>
        ret_code = 32767
#6  0x00007ffff4047f85 in handle_response (dpy=dpy@entry=0x22417a0, response=0x2e06fe0, in_XReply=in_XReply@entry=1) at xcb_io.c:325
        async = <optimized out>
        next = <optimized out>
#7  0x00007ffff4048e98 in _XReply (dpy=dpy@entry=0x22417a0, rep=rep@entry=0x7fffffffdb50, extra=extra@entry=0, discard=discard@entry=1) at xcb_io.c:627
        event = <optimized out>
        req = 0x2e06cf0
        response = 0x2e06f90
        error = 0x0
        c = 0x22429f0
        reply = <optimized out>
        current = 0x2e06cf0
        __PRETTY_FUNCTION__ = "_XReply"
#8  0x00007ffff404497d in XSync (dpy=0x22417a0, discard=discard@entry=0) at Sync.c:44
        rep = {type = 192 '\300', revertTo = 21 '\025', sequenceNumber = 710, length = 0, focus = 36007936, pad1 = 0, pad2 = 36004640, pad3 = 0, pad4 = 46536128, pad5 = 0}
#9  0x00007ffff4044a0b in _XSyncFunction (dpy=<optimized out>) at Synchro.c:35
#10 0x00007ffff4028cce in XDefineCursor (dpy=0x22417a0, w=181, cursor=100663307) at DefCursor.c:46
        req = <optimized out>
#11 0x00007fffece493e3 in gdk_window_set_cursor (window=0x2257000 [GdkX11Window], cursor=<optimized out>) at gdkwindow.c:5839
        device = 0x2256320 [GdkX11DeviceCore]
        device_manager = <optimized out>
        devices = 0x234e380 = {0x2256320, 0x2258830}
        d = 0x234e380 = {0x2256320, 0x2258830}
        display = <optimized out>
        __FUNCTION__ = "gdk_window_set_cursor"
Comment 2 Pascal Terjan 2015-04-18 01:20:10 CEST
in ugtk3.pm, gtkset_mousecursor does:

($w || gtkroot())->set_cursor(Gtk3::Gdk::Cursor->new($type));

and trying to set the cursor on the root fails.

return unless $w prevents the crash.
Comment 3 Pascal Terjan 2015-04-18 17:56:15 CEST
The stack calling gtkset_mousecursor on empty $w:

ugtk3::gtkset_mousecursor('left-ptr') called at /usr/lib/libDrakX/ugtk3.pm line 112
ugtk3::gtkset_mousecursor_normal at /usr/lib/libDrakX/ugtk3.pm line 861
ugtk3::main('ugtk3=HASH(0x4b9a3c8)', 'CODE(0x4bd4cd8)') called at /usr/lib/libDrakX/interactive/gtk.pm line 895
interactive::gtk::ask_fromW('interactive::gtk=HASH(0x2380130)', 'HASH(0x4ae21d8)', 'ARRAY(0x4b9a1d0)') called at /usr/lib/libDrakX/interactive.pm line 653
interactive::ask_from_no_check('interactive::gtk=HASH(0x2380130)', 'HASH(0x4ae21d8)', 'ARRAY(0x295ce28)') called at /usr/lib/libDrakX/interactive.pm line 302
eval {...} at /usr/lib/libDrakX/interactive.pm line 299
interactive::ask_from_listf_raw_no_check('interactive::gtk=HASH(0x2380130)', 'HASH(0x4ae21d8)', 'CODE(0x2685718)', 'ARRAY(0x41da800)', 'Continue') called at /usr/lib/libDrakX/interactive.pm line 284
interactive::ask_from_listf('interactive::gtk=HASH(0x2380130)', 'Read carefully', 'Please make a backup of your data first', 'CODE(0x2685718)', 'ARRAY(0x41da800)', 'Continue') called at /usr/lib/libDrakX/interactive.pm line 275
interactive::ask_from_list_('interactive::gtk=HASH(0x2380130)', 'Read carefully', 'Please make a backup of your data first', 'ARRAY(0x41da800)', 'Continue') called at /usr/lib/libDrakX/diskdrake/hd_gtk.pm line 125
diskdrake::hd_gtk::main('interactive::gtk=HASH(0x2380130)', 'HASH(0x4585d80)', '') called at /usr/libexec/drakdisk line 93
Comment 4 Pascal Terjan 2015-04-18 18:15:11 CEST
Places changing the cursor on the root window:

ugtk3::main
ugtk3::exit
harddrake2 calls gtkset_mousecursor_normal in 3 places

And they are all changing it to normal.
I didn't find anywhere setting the root window cursor to wait, so this doesn't seem useful.

There was one which was removed 10 years ago:

http://gitweb.mageia.org/software/drakx/commit/perl-install/ugtk2.pm?id=3e33ebb9e2d5accc27107c6c087bbb29679dcdf9
Comment 5 Pascal Terjan 2015-04-18 18:31:50 CEST
The hardrake call were added in 2002 in http://gitweb.mageia.org/software/drakx/commit/perl-install/harddrake?id=bc291c590c9f10e01dfa79f028f27e5734d81fa7 to workaround the one which was removed in 2005.
Comment 6 Mageia Robot 2015-04-18 18:38:27 CEST
commit 4998a6d4c66c42d8522ddaf36cda5ccb9dd964e9
Author: Pascal Terjan <pterjan@...>
Date:   Sat Apr 18 16:37:47 2015 +0000

    do not "restore" mouse cursor on the root window, we haven't set it to
    'wait' since 2005 and this causes a crash if we don't own it (mga#15729)
---
 Commit Link:
   http://gitweb.mageia.org/software/drakx/commit/?id=4998a6d4c66c42d8522ddaf36cda5ccb9dd964e9
Comment 7 Samuel Verschelde 2015-06-06 01:38:41 CEST
Does the commint in comment #6 fix the bug?

Keywords: (none) => NEEDINFO

Comment 8 Mageia Robot 2015-07-31 18:22:01 CEST
commit 692c25b460ac8878a4efef0c9fbf7ab5786df418
Author: Thierry Vignaud <thierry.vignaud@...>
Date:   Fri Jul 31 04:22:54 2015 -0400

    do not "restore" mouse cursor on the root window
    
    we haven't set it to 'wait' and this causes a crash if we don't own it
    (mga#15729)
---
 Commit Link:
   http://gitweb.mageia.org/software/control-center/commit/?id=692c25b460ac8878a4efef0c9fbf7ab5786df418
Comment 9 Mageia Robot 2015-08-27 18:20:52 CEST
commit e043da4979e8b9ca12cb9c02dd4029eaf2c21457
Author: Thierry Vignaud <thierry.vignaud@...>
Date:   Fri Jul 31 04:38:13 2015 -0400

    do not "restore" mouse cursor on the window
    
    we haven't set it to 'wait' for a very long time and this can causes a
    crash if we don't own it (mga#15729)
    
    should have been done in commit 4998a6d4c66c42d8522ddaf36cda5ccb9dd964e9
---
 Commit Link:
   http://gitweb.mageia.org/software/drakx/commit/?id=e043da4979e8b9ca12cb9c02dd4029eaf2c21457
Comment 10 Marja Van Waes 2016-03-23 19:31:36 CET
@ Pascal

Did the above commits fix this?

CC: (none) => marja11

Comment 11 Pascal Terjan 2016-03-23 19:33:42 CET
Yes this is fixed

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.