Crash on VT switch on FreeBSD about labwc

[johanmalm]

Thanks for reporting.

Would this patch fix it?

diff --git a/src/input/keyboard.c b/src/input/keyboard.c
index 2b53ff0..f628e6a 100644
--- a/src/input/keyboard.c
+++ b/src/input/keyboard.c
@@ -298,12 +298,14 @@ handle_key_release(struct server *server, uint32_t evdev_keycode)
 }
 
 static bool
-handle_change_vt_key(struct server *server, struct keysyms *translated)
+handle_change_vt_key(struct server *server, struct keyboard *keyboard,
+		struct keysyms *translated)
 {
 	for (int i = 0; i < translated->nr_syms; i++) {
 		unsigned int vt =
 			translated->syms[i] - XKB_KEY_XF86Switch_VT_1 + 1;
 		if (vt >= 1 && vt <= 12) {
+			keyboard_cancel_keybind_repeat(keyboard);
 			change_vt(server, vt);
 			return true;
 		}
@@ -395,7 +397,7 @@ handle_compositor_keybindings(struct keyboard *keyboard,
 	}
 
 	/* Catch C-A-F1 to C-A-F12 to change tty */
-	if (handle_change_vt_key(server, &keyinfo.translated)) {
+	if (handle_change_vt_key(server, keyboard, &keyinfo.translated)) {
 		key_state_store_pressed_key_as_bound(event->keycode);
 		return true;
 	}

[jbeich]

Still crashes:

$ seatd-launch labwc -d -c /dev/null -C /dev/null
[...]
00:00:00.000 [DEBUG] [../src/main.c:153] LABWC_PID=1234
[...]
00:00:03.627 [INFO] [seatd/seat.c:621] Switching from VT 2 to VT 1
00:00:03.628 [INFO] [seatd/seat.c:560] Disabling client 2 on seat0
00:00:03.619 [INFO] [libseat] [libseat/backend/seatd.c:207] Disabling seat
00:00:03.628 [INFO] [backend/drm/backend.c:143] DRM fd paused
00:00:03.638 [INFO] [seatd/seat.c:576] Disabled client 2 on seat0
00:00:04.227 [ERROR] [seatd/seat.c:598] Could not set next session: client is not active
00:00:04.227 [INFO] [seatd/client.c:471] Client disconnected
00:00:04.235 [INFO] [seatd/seat.c:524] Closed client 2 on seat0
00:00:04.235 [INFO] [seatd/seat.c:192] Removed client 2 from seat0
00:00:04.250 [INFO] [seatd/seatd.c:218] seatd stopped

$ dmesg | tail -1
pid 1234 (labwc), jid 0, uid 1001: exited on signal 11 (no core dump - disabled via kern.coredump=0)

[johanmalm]

Thanks for trying. Will have to think deeper.

[johanmalm]

When does it happen? I.e. when you're in labwc and press C+A+F<n>, or when you later return to labwc, or something else.
Does it happen every time or only after multiple vt changes?

[jbeich]

labwc crashes immediately, on every VT switch from labwc via Ctrl+Alt+F<n> but not via vidcontrol -s <n> </dev/ttyv<n-1>. I've confirmed (via pgrep -a) labwc process is already gone from another VT (both with and without the patch) before switching back to the VT console it was started from.

[johanmalm]

Hmm... not sure.

@kennylevinsen - I'll carry on with this another day, but just wondered if it triggered any thoughts with you?

[kennylevinsen]

So, I dug a bit and discovered a seatd/libseat issue: CLIENT_SESSION_SWITCH and CLIENT_DISABLE_SEAT requests did not have a formal response, and so their respective commands did not wait for anything - the idea being that the caller did not really care for a result. They could, however, still trigger an error response. As responses are only read where requests are generated, this error response would sit unread in the connection buffer, allowing said buffer to accumulate incoming events until there was no more room and an error was generated.

This was not discovered previously as compositors rarely have key-repeat on builtins, and so these requests wouldn't normally fail. Try the switch-error-fix branch which addres responses to these requests and see if that solves your issues. Note that CI is down for now, so bear with me if it fails on FreeBSD.

There is in general an issue with wlroots-based compositors and key-repeat on VT switch: When the session is switched, you lose access to the keyboard and will not see a key up event. This might be something we should handle in wlroots though. Until then, avoiding key-repeat on this would probably be a good idea to avoid continuously screaming at seatd whenever you switch away.

EDIT: I looked again, I was mistaken. There will be a key up: seatd's disable seat event results in a call to libinput_suspend, which in turn causes input devices to be removed. The finish handler on wlr_keyboard calls key up for all pressed keys. But on my laptop, doing sudo chvt 2\n in a terminal emulator results in some key repeat spam from the enter press, just not indefinite spam.

[johanmalm]

Thanks for looking+patching.

Until then, avoiding key-repeat on this would probably be a good idea to avoid continuously screaming at seatd whenever you switch away.

Do you think it would be enough to cancel the key-repeat timer before calling wlr_session_change_vt()

[johanmalm]

Just to clarify, I can’t actually reproduce the issue, so can’t verify if this solves it.
@jbeich any chance you go try it?

[kennylevinsen]

I edited my comment as it was not entirely accurate. Key up should happen when things work correctly, it just happens late in the process so that a fast key repeat with short wait is likely to trigger repeatedly during the process.

[jbeich]

seatd@7f2f23e (switch-error-fix) vs. unpatched labwc 0.7.0:

• VT switch from labwc doesn't crash labwc
• switching back to labwc often fails: back to previous VT or video from labwc but keyboard/mouse input goes to previous VT until another VT switch
• exiting or killing labwc crashes seatd, see below

seatd backtrace

$ seatd-launch labwc
<exit via context menu>
00:00:02.829 [INFO] [seatd/seat.c:402] No clients on seat0 to activate
00:00:02.829 [INFO] [seatd/seat.c:501] Closed client 2 on seat0
00:00:02.829 [INFO] [seatd/seat.c:191] Removed client 2 from seat0
Assertion failed: (elem->prev == NULL && elem->next == NULL), function linked_list_insert, file ../common/linked_list.c, line 14.
00:00:02.815 [ERROR] [libseat] [libseat/backend/seatd.c:299] Could not poll connection: Broken pipe
(lldb) bt
* thread #1, name = 'seatd', stop reason = signal SIGABRT
  * frame #0: 0x000000082293469a libc.so.7`__sys_thr_kill at thr_kill.S:4
    frame #1: 0x00000008228a2194 libc.so.7`__raise(s=6) at raise.c:48:10
    frame #2: 0x00000008229634c9 libc.so.7`abort at abort.c:61:8
    frame #3: 0x00000008228840a1 libc.so.7`__assert(func=<unavailable>, file=<unavailable>, line=<unavailable>, failedexpr=<unavailable>) at assert.c:47:2
    frame #4: 0x0000000000205784 seatd`linked_list_insert(list=0x00000008207b9498, elem=0x0000095106210000) at linked_list.c:14:2
    frame #5: 0x000000000020b4ee seatd`handle_close_seat(client=0x0000095106210000) at client.c:209:2
    frame #6: 0x000000000020ae17 seatd`client_handle_opcode(client=0x0000095106210000, opcode=2, size=0) at client.c:384:9
    frame #7: 0x000000000020ac8e seatd`client_handle_connection(fd=4, mask=1, data=0x0000095106210000) at client.c:522:8
    frame #8: 0x0000000000208060 seatd`dispatch(poller=0x00000008207b9440) at poller.c:305:3
    frame #9: 0x0000000000207b92 seatd`poller_poll(poller=0x00000008207b9440) at poller.c:324:2
    frame #10: 0x000000000020ceb8 seatd`main(argc=6, argv=0x00000008207b9610) at seatd.c:204:7
    frame #11: 0x0000000822873d9a libc.so.7`__libc_start1(argc=6, argv=0x00000008207b9610, env=0x00000008207b9648, cleanup=<unavailable>, mainX=(seatd`main at seatd.c:59)) at libc_start1.c:157:7
    frame #12: 0x0000000000205270 seatd`_start at crt1_s.S:83

seatd@7f2f23e (switch-error-fix) vs. labwc 0.7.0 + #1429: labwc crashes like before, see

labwc backtrace

$ HOME=/var/empty seatd-launch labwc
00:00:00.000 [INFO] [seatd/seat.c:39] Created VT-bound seat seat0
00:00:00.000 [INFO] [seatd/seatd.c:194] seatd started
00:00:00.000 [ERROR] [../src/config/rcxml.c:1429] cannot read (/rc.xml)
00:00:00.014 [INFO] [seatd/server.c:146] New client connected (pid: 13064, uid: 1001, gid: 1001)
00:00:00.014 [INFO] [seatd/seat.c:169] Added client 2 to seat0
00:00:00.014 [INFO] [seatd/seat.c:461] Opened client 2 on seat0
00:00:00.109 [ERROR] [../src/menu/menu.c:561] cannot read /menu.xml
00:00:02.432 [INFO] [seatd/seat.c:588] Switching from VT 2 to VT 1
00:00:02.434 [INFO] [seatd/seat.c:534] Disabling client 2 on seat0
00:00:02.450 [INFO] [seatd/seat.c:547] Disabled client 2 on seat0
00:00:03.033 [ERROR] [seatd/seat.c:564] Could not set next session: client is not active
00:00:03.223 [INFO] [seatd/client.c:485] Client disconnected
00:00:03.231 [INFO] [seatd/seat.c:501] Closed client 2 on seat0
00:00:03.231 [INFO] [seatd/seat.c:191] Removed client 2 from seat0
00:00:03.241 [INFO] [seatd/seatd.c:218] seatd stopped
(lldb) bt
* thread #1, name = 'labwc', stop reason = signal SIGSEGV
  * frame #0: 0x000000082347f279 libwayland-server.so.0`wl_event_source_timer_update(source=0x0000000000000000, ms_delay=40) at event-loop.c:615:48
    frame #1: 0x000000000024899d labwc`handle_keybind_repeat(data=0x00000e439bbe5fe0) at keyboard.c:459:2
    frame #2: 0x0000000823480582 libwayland-server.so.0`wl_timer_heap_dispatch(timers=0x00000e4399c24088) at event-loop.c:526:4
    frame #3: 0x00000008234802df libwayland-server.so.0`wl_event_loop_dispatch(loop=0x00000e4399c24040, timeout=-1) at event-loop.c:1020:7
    frame #4: 0x000000082347bfdf libwayland-server.so.0`wl_display_run(display=0x00000e4399c6b000) at wayland-server.c:1493:3
    frame #5: 0x0000000000220c39 labwc`main(argc=1, argv=0x00000008210c2e38) at main.c:179:2
    frame #6: 0x000000082c11bd9a libc.so.7`__libc_start1(argc=1, argv=0x00000008210c2e38, env=0x00000008210c2e48, cleanup=<unavailable>, mainX=(labwc`main at main.c:81)) at libc_start1.c:157:7
    frame #7: 0x000000000021a7e0 labwc`_start at crt1_s.S:83
(lldb) f 0
frame #0: 0x000000082347f279 libwayland-server.so.0`wl_event_source_timer_update(source=0x0000000000000000, ms_delay=40) at event-loop.c:615:48
   612  {
   613          struct wl_event_source_timer *tsource =
   614                  wl_container_of(source, tsource, base);
-> 615          struct wl_timer_heap *timers = &tsource->base.loop->timers;
   616
   617          if (ms_delay > 0) {
   618                  struct timespec deadline;
(lldb) f 1
frame #1: 0x000000000024899d labwc`handle_keybind_repeat(data=0x00000e439bbe5fe0) at keyboard.c:459:2
   456
   457          handle_compositor_keybindings(keyboard, &event);
   458          int next_repeat_ms = 1000 / keyboard->keybind_repeat_rate;
-> 459          wl_event_source_timer_update(keyboard->keybind_repeat,
   460                  next_repeat_ms);
   461
   462          return 0; /* ignored per wl_event_loop docs */

[johanmalm]

@jbeich Thanks. I've pushed another fix on #1429
Would you be happy to try again?

[jbeich]

labwc 0.7.0 + #1429 (1d376a2) no longer crashes on VT switch. seatd@7f2f23e (switch-error-fix) is not necessary to fix the crash but with #1429 (1d376a2) also no longer exhibits the issue of sending keyboard/mouse input to previous VT after switching back to labwc.

[kennylevinsen]

exiting or killing labwc crashes seatd, see below

Woops, fixed on that branch.

As for the issue switching back to labwc before the key repeat is fixed, I'll try to reproduce but the debug log of seatd would be useful (seatd-launch -l debug -- labwc) to see why it gets mad/confused.

[johanmalm]

labwc 0.7.0 + #1429 (1d376a2) no longer crashes on VT switch. seatd@7f2f23e (switch-error-fix) is not necessary to fix the crash but with #1429 (1d376a2) also no longer exhibits the issue of sending keyboard/mouse input to previous VT after switching back to labwc.

Thanks for testing. That's great. Will ask someone to review fix.

[johanmalm]

exiting or killing labwc crashes seatd, see below

Woops, fixed on that branch.

As for the issue switching back to labwc before the key repeat is fixed, I'll try to reproduce but the debug log of seatd would be useful (seatd-launch -l debug -- labwc) to see why it gets mad/confused.

Merge auto-closed this issue. @kennylevinsen do you want me to re-open for the above?