[Bug 328035] Re: *** glibc detected *** free(): invalid next size (fast) for xf86Wakeup() call

[Matt Zimmerman]

I've just seen it again, with a backtrace similar to my previous one
(i.e. DeleteInputDeviceRequest rather than i830_bind_memory).  I don't
understand why libdbus and libhal are in the stack trace, though; are
these callbacks?

*** glibc detected *** /usr/X11R6/bin/X: free(): invalid next size (fast): 0x0000000005f124e0 ***
======= Backtrace: =========
/lib/libc.so.6[0x7f096ada6cb8]
/lib/libc.so.6(cfree+0x76)[0x7f096ada9276]
/usr/X11R6/bin/X(LogVMessageVerb+0x104)[0x4fb964]
/usr/X11R6/bin/X(xf86MsgVerb+0x8f)[0x48f26f]
/usr/X11R6/bin/X[0x4708a6]
/usr/X11R6/bin/X(xf86DeleteInput+0x1a)[0x491b3a]
/usr/X11R6/bin/X(DeleteInputDeviceRequest+0xf2)[0x496872]
/usr/X11R6/bin/X[0x46bf5e]
/usr/X11R6/bin/X[0x46c037]
/usr/lib/libhal.so.1[0x7f096bf53ee9]
/lib/libdbus-1.so.3(dbus_connection_dispatch+0x33b)[0x7f096bd1990b]
/lib/libdbus-1.so.3[0x7f096bd19ccb]
/usr/X11R6/bin/X[0x46b2fb]
/usr/X11R6/bin/X(WakeupHandler+0x4b)[0x451ebb]
/usr/X11R6/bin/X(WaitForSomething+0x1ef)[0x4ef41f]
/usr/X11R6/bin/X(Dispatch+0x80)[0x44e070]
/usr/X11R6/bin/X(main+0x3bd)[0x433ddd]
/lib/libc.so.6(__libc_start_main+0xe6)[0x7f096ad4d5a6]
/usr/X11R6/bin/X[0x433269]


** Description changed:

  Binary package hint: xorg
  
  I have been experiencing X server crashes during suspend/resume testing,
- but no apport report was being left behind.  By stracing the X server, I
- was able to see that this was due to glibc detecting heap corruption and
- aborting the process.
+ but no apport report was being left behind.  The crash is due to heap
+ corruption detected by glibc.  This is logged to /var/log/gdm/:0.log.1
+ and looks like this:
  
- strace output attached.
+ *** glibc detected *** /usr/X11R6/bin/X: free(): invalid next size (fast): 0x0000000005f124e0 ***
+ ======= Backtrace: =========
+ /lib/libc.so.6[0x7f096ada6cb8]
+ /lib/libc.so.6(cfree+0x76)[0x7f096ada9276]
+ /usr/X11R6/bin/X(LogVMessageVerb+0x104)[0x4fb964]
+ /usr/X11R6/bin/X(xf86MsgVerb+0x8f)[0x48f26f]
+ /usr/X11R6/bin/X[0x4708a6]
+ /usr/X11R6/bin/X(xf86DeleteInput+0x1a)[0x491b3a]
+ /usr/X11R6/bin/X(DeleteInputDeviceRequest+0xf2)[0x496872]
+ /usr/X11R6/bin/X[0x46bf5e]
+ /usr/X11R6/bin/X[0x46c037]
+ /usr/lib/libhal.so.1[0x7f096bf53ee9]
+ /lib/libdbus-1.so.3(dbus_connection_dispatch+0x33b)[0x7f096bd1990b]
+ /lib/libdbus-1.so.3[0x7f096bd19ccb]
+ /usr/X11R6/bin/X[0x46b2fb]
+ /usr/X11R6/bin/X(WakeupHandler+0x4b)[0x451ebb]
+ /usr/X11R6/bin/X(WaitForSomething+0x1ef)[0x4ef41f]
+ /usr/X11R6/bin/X(Dispatch+0x80)[0x44e070]
+ /usr/X11R6/bin/X(main+0x3bd)[0x433ddd]
+ /lib/libc.so.6(__libc_start_main+0xe6)[0x7f096ad4d5a6]
+ /usr/X11R6/bin/X[0x433269]
  
  ProblemType: Bug
  Architecture: amd64
  DistroRelease: Ubuntu 9.04
  Package: xorg 1:7.4~5ubuntu12
  ProcEnviron:
   LC_COLLATE=C
   PATH=(custom, user)
   LANG=en_US.UTF-8
   SHELL=/bin/zsh
  ProcVersion: Linux version 2.6.28-7-generic (buildd at yellow) (gcc version 4.3.3 (Ubuntu 4.3.3-3ubuntu2) ) #20-Ubuntu SMP Mon Feb 9 15:42:34 UTC 2009
  
  SourcePackage: xorg
  Uname: Linux 2.6.28-7-generic x86_64
  
  [lspci]
  00:00.0 Host bridge [0600]: Intel Corporation Mobile PM965/GM965/GL960 Memory Controller Hub [8086:2a00] (rev 0c)
      	Subsystem: Lenovo Device [17aa:20b3]
  00:02.0 VGA compatible controller [0300]: Intel Corporation Mobile GM965/GL960 Integrated Graphics Controller [8086:2a02] (rev 0c)
      	Subsystem: Lenovo Device [17aa:20b5]

-- 
*** glibc detected *** free(): invalid next size (fast) for xf86Wakeup() call
https://bugs.launchpad.net/bugs/328035
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs at lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs