Bug 460444 - kwin_wayland segfault in gbm_bo_create_with_modifiers() when moving cursor over Task Manager entries and triggering tooltips
Summary: kwin_wayland segfault in gbm_bo_create_with_modifiers() when moving cursor ov...
Status: RESOLVED FIXED
Alias: None
Product: kwin
Classification: Plasma
Component: wayland-generic (show other bugs)
Version: 5.26.0
Platform: Neon Linux
: NOR crash
Target Milestone: ---
Assignee: KWin default assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-10-14 18:01 UTC by Enrico
Modified: 2022-10-24 21:32 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
log from journalctl (5.77 KB, text/x-log)
2022-10-14 18:01 UTC, Enrico
Details
wayland login freezed after CTRL+ALT+F1 (105.12 KB, image/jpeg)
2022-10-15 00:59 UTC, Enrico
Details
First backtrace (13.00 KB, text/plain)
2022-10-16 07:20 UTC, Enrico
Details
second backtrace (3.68 KB, text/plain)
2022-10-16 07:20 UTC, Enrico
Details
3rd backtrace of kwin_wayland (13.72 KB, text/plain)
2022-10-21 20:29 UTC, Enrico
Details
4th backtrace of kwin_wayland (11.67 KB, text/plain)
2022-10-21 20:30 UTC, Enrico
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Enrico 2022-10-14 18:01:35 UTC
Created attachment 152822 [details]
log from journalctl

SUMMARY
Hello,
in the last week I have many wayland crash on my system. I thought it was due to some application, but in the last days it happens very often (2-3 times a day). I tried to read the journalctl log and I found the attached log. I hope it's enough, otherwise please feel free to ask.
It starts with a:
kwin_wayland[1079]: segfault at 10 ip 00007fb5372e5b81 sp 00007ffeb38215e0 error 6 in libc-2.31.so[7fb537270000+178000]"

STEPS TO REPRODUCE
1. Can't find exact steps to reproduce. It seems random and not related to a specific application.

OBSERVED RESULT
The screen goes black and the only visible thing is the mouse cursor at the center of the screen. If I move the mouse or press the normal keyboard keys, nothing happens.
The system is still running because I can press CTRL+ALT+F2 to get a console and reboot the system. I can also open a console and run "startx" which opens a X11 session, but without the "start bar" at the bottom of the screen

EXPECTED RESULT


Operating System: KDE neon 5.26
KDE Plasma Version: 5.26.0
KDE Frameworks Version: 5.98.0
Qt Version: 5.15.6
Kernel Version: 5.15.0-50-generic (64-bit)
Graphics Platform: Wayland
Processors: 4 × Intel® Pentium® Silver N5000 CPU @ 1.10GHz
Memory: 7.6 GiB of RAM
Graphics Processor: Mesa Intel® UHD Graphics 605
Manufacturer: Micro-Star International Co., Ltd.
Product Name: Cubi N 8GL (MS-B171)
System Version: 1.1
Comment 1 Nate Graham 2022-10-14 19:51:32 UTC
If something crashed, we need a backtrace of it so we can figure out what's going on. See https://community.kde.org/Guidelines_and_HOWTOs/Debugging/How_to_create_useful_crash_reports.

Can you please attach one? Thanks!
Comment 2 Enrico 2022-10-15 00:59:12 UTC
Created attachment 152825 [details]
wayland login freezed after CTRL+ALT+F1
Comment 3 Enrico 2022-10-15 00:59:34 UTC
(In reply to Nate Graham from comment #1)
> If something crashed, we need a backtrace of it so we can figure out what's
> going on. See
> https://community.kde.org/Guidelines_and_HOWTOs/Debugging/
> How_to_create_useful_crash_reports.
> 
> Can you please attach one? Thanks!

Thanks for your reply. I tried, but I'm   not able to run gdb for this reason:
- If I run gdb from Konsole inside a Wayland session, I can't re-open that Konsole window after the crash.
- If I press CTRL+ALT+F3 to open a different CLI session I can't go back to Wayland because when I press CTRL+ALT+F1 it shows the login window completely freezed (see attachment). I can't enter the wayland session anymore and I need to reboot.

How can I run the gdb command and access it after the crash?
Comment 4 Enrico 2022-10-16 07:18:56 UTC
Hello,
after hours and hours of testing, I'm now able to tell you the steps to reproduce the problem

1) Open few applications (I've test opening Discover, Dolphin, Firefox, Konsole)
2) Let them open
3) Move the mouse very slowly on the "Start" bar to make the application previews pop-up
4) This makes wayland crash.

I'll attach two backtrace I can get opening another shell session and running the following type of GDB commands (with some variations...). I'm not sure it's the backtrace you expected, but I hope they can be useful. Please let me know

e.g.
sudo gdb -p 1084 -batch -ex "set logging file kwin_wayland_1084.gdb" -ex "set logging on" -ex "continue" -ex "thread apply all backtrace" -ex "quit"
Comment 5 Enrico 2022-10-16 07:20:37 UTC
Created attachment 152876 [details]
First backtrace
Comment 6 Enrico 2022-10-16 07:20:51 UTC
Created attachment 152877 [details]
second backtrace
Comment 7 Nate Graham 2022-10-17 18:10:29 UTC
Thanks a lot for that! Pasting them inline for searchability:


Thread 1 "kwin_wayland" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007f9cc64e0859 in __GI_abort () at abort.c:79
#2  0x00007f9cc654b26e in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f9cc6675298 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007f9cc65532fc in malloc_printerr (str=str@entry=0x7f9cc66771e0 "munmap_chunk(): invalid pointer") at malloc.c:5347
#4  0x00007f9cc655354c in munmap_chunk (p=<optimized out>) at malloc.c:2830
#5  0x00007f9cc926a724 in KWaylandServer::SurfaceInterface::setOutputs(QVector<KWaylandServer::OutputInterface*> const&) () from /lib/x86_64-linux-gnu/libkwin.so.5
#6  0x00007f9cc90a69b1 in KWin::PointerInputRedirection::updateCursorOutputs() () from /lib/x86_64-linux-gnu/libkwin.so.5
#7  0x00007f9cc90a6b4e in KWin::PointerInputRedirection::updatePosition(QPointF const&) () from /lib/x86_64-linux-gnu/libkwin.so.5
#8  0x00007f9cc90a77aa in KWin::PointerInputRedirection::processMotionInternal(QPointF const&, QSizeF const&, QSizeF const&, unsigned int, unsigned long long, KWin::InputDevice*) () from /lib/x86_64-linux-gnu/libkwin.so.5
#9  0x00007f9cc90a88b4 in KWin::PointerInputRedirection::processMotion(QSizeF const&, QSizeF const&, unsigned int, unsigned long long, KWin::InputDevice*) () from /lib/x86_64-linux-gnu/libkwin.so.5
#10 0x00007f9cc779f2f2 in QtPrivate::QSlotObjectBase::call (a=0x7ffd741fd1a0, r=0x55bf5e469810, this=0x55bf5e4c0a10) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#11 doActivate<false> (sender=0x55bf5eede280, signal_index=6, argv=0x7ffd741fd1a0) at kernel/qobject.cpp:3919
#12 0x00007f9cc8fadf9d in KWin::InputDevice::pointerMotion(QSizeF const&, QSizeF const&, unsigned int, unsigned long long, KWin::InputDevice*) () from /lib/x86_64-linux-gnu/libkwin.so.5
#13 0x00007f9cc91e4dd7 in KWin::LibInput::Connection::processEvents() () from /lib/x86_64-linux-gnu/libkwin.so.5
#14 0x00007f9cc7795d09 in QObject::event (this=0x55bf5e3d8c90, e=0x7f9ca8004780) at kernel/qobject.cpp:1347
#15 0x00007f9cc6c31e43 in QApplicationPrivate::notify_helper (this=this@entry=0x55bf5e393f50, receiver=receiver@entry=0x55bf5e3d8c90, e=e@entry=0x7f9ca8004780) at kernel/qapplication.cpp:3637
#16 0x00007f9cc6c3ac58 in QApplication::notify (this=0x7ffd741fda00, receiver=0x55bf5e3d8c90, e=0x7f9ca8004780) at kernel/qapplication.cpp:3161
#17 0x00007f9cc776803a in QCoreApplication::notifyInternal2 (receiver=0x55bf5e3d8c90, event=0x7f9ca8004780) at ../../include/QtCore/5.15.6/QtCore/private/../../../../../src/corelib/thread/qthread_p.h:332
#18 0x00007f9cc776a941 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x55bf5e36b3f0) at kernel/qcoreapplication.cpp:1821
#19 0x00007f9cc77bff1e in QEventDispatcherUNIX::processEvents (this=0x55bf5e3a8e30, flags=...) at kernel/qeventdispatcher_unix.cpp:468
#20 0x000055bf5cbb2c61 in QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
#21 0x00007f9cc7766b3b in QEventLoop::exec (this=this@entry=0x7ffd741fd7a0, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:141
#22 0x00007f9cc776ece4 in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#23 0x000055bf5caaedf3 in main (argc=<optimized out>, argv=<optimized out>) at ./src/main_wayland.cpp:613
[Inferior 1 (process 1102) detached]


Thread 1 (Thread 0x7fee3c3349c0 (LWP 1084)):
#0  0x00007fee40af1b81 in _int_malloc (av=av@entry=0x7fee40c46b80 <main_arena>, bytes=bytes@entry=12) at malloc.c:3671
#1  0x00007fee40af4299 in __GI___libc_malloc (bytes=12) at malloc.c:3066
#2  0x00007fee3a3cb227 in ?? () from /usr/lib/x86_64-linux-gnu/dri/iris_dri.so
#3  0x00007fee3a3cb8cf in ?? () from /usr/lib/x86_64-linux-gnu/dri/iris_dri.so
#4  0x00007fee396dc697 in ?? () from /usr/lib/x86_64-linux-gnu/dri/iris_dri.so
#5  0x00007fee4004b98f in ?? () from /lib/x86_64-linux-gnu/libgbm.so.1
#6  0x00007fee4004a111 in gbm_bo_create_with_modifiers () from /lib/x86_64-linux-gnu/libgbm.so.1
#7  0x00007fee43742bd8 in KWin::DrmBackend::createBo(QSize const&, unsigned int, QVector<unsigned long> const&) () from /lib/x86_64-linux-gnu/libkwin.so.5
#8  0x00007fee43742db6 in KWin::DrmBackend::createDmaBufTexture(QSize const&, unsigned int, unsigned long) () from /lib/x86_64-linux-gnu/libkwin.so.5
#9  0x00007fee435993f8 in KWin::Platform::createDmaBufTexture(KWin::DmaBufParams const&) () from /lib/x86_64-linux-gnu/libkwin.so.5
#10 0x0000557d1486298e in ?? ()
#11 0x00007fee40fff3fb in impl_port_use_buffers (object=<optimized out>, direction=<optimized out>, port_id=<optimized out>, flags=<optimized out>, buffers=<optimized out>, n_buffers=<optimized out>) at ../src/pipewire/stream.c:832
#12 0x00007fee40ff81a5 in negotiate_mixer_buffers (n_buffers=16, buffers=<optimized out>, flags=<optimized out>, port=0x557d167ab820) at ../src/pipewire/impl-port.c:1467
#13 pw_impl_port_use_buffers (port=0x557d167ab820, mix=mix@entry=0x7fee2ca180c8, flags=flags@entry=1, buffers=buffers@entry=0x7ffcc66e4d30, n_buffers=n_buffers@entry=16) at ../src/pipewire/impl-port.c:1508
#14 0x00007fee2cb27f4c in client_node_port_use_buffers (object=<optimized out>, direction=<optimized out>, port_id=<optimized out>, mix_id=<optimized out>, flags=<optimized out>, n_buffers=<optimized out>, buffers=<optimized out>) at ../src/modules/module-client-node/remote-node.c:730
#15 0x00007fee2cb3a8bf in client_node_demarshal_port_use_buffers (object=<optimized out>, msg=<optimized out>) at ../src/modules/module-client-node/protocol-native.c:517
#16 0x00007fee2cb7bcda in process_remote (impl=impl@entry=0x557d16714d60) at ../src/modules/module-protocol-native.c:789
#17 0x00007fee2cb7c230 in on_remote_data (data=0x557d16714d60, fd=222, mask=1) at ../src/modules/module-protocol-native.c:823
#18 0x00007fee16d16783 in loop_iterate (object=0x557d16328978, timeout=<optimized out>) at ../spa/plugins/support/loop.c:333
#19 0x0000557d14858751 in ?? ()
#20 0x00007fee41d3b2f2 in QtPrivate::QSlotObjectBase::call (a=0x7ffcc66e5cd0, r=0x557d16714780, this=0x557d167b5cd0) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#21 doActivate<false> (sender=0x557d165e6b20, signal_index=3, argv=0x7ffcc66e5cd0) at kernel/qobject.cpp:3919
#22 0x00007fee41d34587 in QMetaObject::activate (sender=sender@entry=0x557d165e6b20, m=m@entry=0x7fee41fa0b40 <QSocketNotifier::staticMetaObject>, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7ffcc66e5cd0) at kernel/qobject.cpp:3979
#23 0x00007fee41d3f3d3 in QSocketNotifier::activated (this=this@entry=0x557d165e6b20, _t1=..., _t2=<optimized out>, _t3=...) at .moc/moc_qsocketnotifier.cpp:178
#24 0x00007fee41d3fb73 in QSocketNotifier::event (this=0x557d165e6b20, e=0x7ffcc66e5fa0) at kernel/qsocketnotifier.cpp:302
#25 0x00007fee411cde43 in QApplicationPrivate::notify_helper (this=this@entry=0x557d15236f50, receiver=receiver@entry=0x557d165e6b20, e=e@entry=0x7ffcc66e5fa0) at kernel/qapplication.cpp:3637
#26 0x00007fee411d6c58 in QApplication::notify (this=0x7ffcc66e6390, receiver=0x557d165e6b20, e=0x7ffcc66e5fa0) at kernel/qapplication.cpp:3161
#27 0x00007fee41d0403a in QCoreApplication::notifyInternal2 (receiver=0x557d165e6b20, event=0x7ffcc66e5fa0) at ../../include/QtCore/5.15.6/QtCore/private/../../../../../src/corelib/thread/qthread_p.h:332
#28 0x00007fee41d5bdab in QEventDispatcherUNIXPrivate::activateSocketNotifiers (this=0x557d1524c490) at kernel/qeventdispatcher_unix.cpp:304
#29 0x00007fee41d5c20b in QEventDispatcherUNIX::processEvents (this=<optimized out>, flags=...) at kernel/qeventdispatcher_unix.cpp:511
#30 0x0000557d14934c61 in ?? ()
#31 0x00007fee41d02b3b in QEventLoop::exec (this=this@entry=0x7ffcc66e6130, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:141
#32 0x00007fee41d0ace4 in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#33 0x0000557d14830df3 in ?? ()
#34 0x00007fee40a7e083 in __libc_start_main (main=0x557d1482f620, argc=14, argv=0x7ffcc66e65d8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffcc66e65c8) at ../csu/libc-start.c:308
#35 0x0000557d1483295e in ?? ()
Comment 8 Enrico 2022-10-20 17:48:27 UTC
Just to report that this bug remains also after updating some KDE packages (with the **):

Operating System: KDE neon 5.26
KDE Plasma Version: 5.26.0
KDE Frameworks Version: **5.99.0**
Qt Version: 5.15.6
Kernel Version: **5.15.0-52-generic (64-bit)**
Graphics Platform: Wayland
Comment 9 Zamundaaa 2022-10-21 20:06:52 UTC
As we have two different backtraces, this is a bit hard to track down. Can you check the backtraces of a few other crashes and see if they're different, too, or if they're all similar to one of the two?
You should be able to get backtraces for past crashes with
> coredumpctl list kwin_wayland
and then start gdb for a given PID (where the corefile is still present) with
> coredumpctl debug PID
Comment 10 Enrico 2022-10-21 20:28:49 UTC
(In reply to Zamundaaa from comment #9)
> As we have two different backtraces, this is a bit hard to track down. Can
> you check the backtraces of a few other crashes and see if they're
> different, too, or if they're all similar to one of the two?
> You should be able to get backtraces for past crashes with
> > coredumpctl list kwin_wayland
> and then start gdb for a given PID (where the corefile is still present) with
> > coredumpctl debug PID

Hello,
thanks a lot for your help. I can generate all the backtraces you need as I can reproduce the bug every single time I move the mouse on the bottom bar to generate the window previews. Unfortunately I can't read them: I attach 2 new backtraces, but I don't know if they are more useful than the previous two. Please let me know what I should search in the backtraces and I'll be happy to help.
Comment 11 Enrico 2022-10-21 20:29:37 UTC
Created attachment 153101 [details]
3rd backtrace of kwin_wayland

3rd backtrace of kwin_wayland crash
Comment 12 Enrico 2022-10-21 20:30:03 UTC
Created attachment 153102 [details]
4th backtrace of kwin_wayland
Comment 13 Pbryanw 2022-10-22 07:22:00 UTC
Hi, I first encountered this bug after upgrading to KDE 5.26 (I'm  also using Wayland), and as Enrico described, it only occurs when application previews are triggered by mouse movement on the taskbar. I can workaround this for the time being, by disabling tooltips and "highlight window when hovering over task tooltips" (right-click on taskbar -> Configure Icons-only Task Manager). 

Recent updates, including Plasma Frameworks 5.99.0, haven't fixed this for me. I'm not very technically inclined, so don't know if I can be any help with troubleshooting, but just wanted to say that I'm also experiencing this.
Comment 14 Enrico 2022-10-24 13:58:03 UTC
Hello,
the problem seems fixed after updating the base to Ubuntu 22.04 LTS. The window preview pop-ups are pretty slow, but at least Wayland doesn't crash anymore.
Pbryanw, can you please confirm (if you already updated to 22.04)?

Operating System: KDE neon 5.26
KDE Plasma Version: 5.26.1
KDE Frameworks Version: 5.99.0
Qt Version: 5.15.6
Kernel Version: 5.15.0-52-generic (64-bit)
Graphics Platform: Wayland
Comment 15 Pbryanw 2022-10-24 18:43:37 UTC
(In reply to Enrico from comment #14)
> Hello,
> the problem seems fixed after updating the base to Ubuntu 22.04 LTS. The
> window preview pop-ups are pretty slow, but at least Wayland doesn't crash
> anymore.
> Pbryanw, can you please confirm (if you already updated to 22.04)?
> 
> Operating System: KDE neon 5.26
> KDE Plasma Version: 5.26.1
> KDE Frameworks Version: 5.99.0
> Qt Version: 5.15.6
> Kernel Version: 5.15.0-52-generic (64-bit)
> Graphics Platform: Wayland
Hi Enrico, thanks for the heads up regarding the Ubuntu 22.04 LTS release. I've just upgraded, and can confirm this issue also appears fixed for me as well - so far, so good. Thanks again.
Comment 16 Nate Graham 2022-10-24 21:32:48 UTC
Great news!