Package: xserver-xorg-core
Version: 2:21.1.16-1.3+deb13u4
Severity: important
Tags: upstream
Dear Maintainer,
Xorg crashes with a NULL function pointer call when a hotplugged secondary GPU
(a USB display adapter exposed as a DRM/KMS card) is removed while the X server
is running. The crash is inside Xorg, in the CloseScreen chain of the removed
GPU screen. Removing only the HDMI cable from the adapter does not crash.
== Environment ==
Debian: 13.7 (trixie)
Kernel: 6.12.115+deb13.1-amd64
xserver-xorg-core 2:21.1.16-1.3+deb13u4 (X.Org X Server 1.21.1.16)
Display manager: lxdm 0.5.3-6, started as: /usr/lib/xorg/Xorg -background none :0 vt07 -nolisten tcp -novtswitch
Primary GPU: Intel GeminiLake UHD Graphics 600 [8086:3185], modesetting driver, glamor enabled
Hot-plugged GPU: USB adapter StarTech USB32HDES (USB ID 0711:5601, MCT T6), DRM card1
driven by an out-of-tree kernel module ("trigger6", DRM/KMS, shmem GEM,
same design as the in-tree udl driver). The kernel is therefore tainted.
Xorg config: /etc/X11/xorg.conf.d/10-monitor.conf only (ServerFlags BlankTime/StandbyTime/SuspendTime/OffTime = 0)
Mesa: llvmpipe is used for the secondary GPU (see log below)
== Steps to reproduce ==

  1.
Start X (modesetting driver on the Intel GPU), with the USB adapter plugged in.
     *
Xorg adds it as a GPU screen: (II) modeset(G0): ...
The log also contains:
(II) modeset(G0): Refusing to try glamor on llvmpipe
(II) modeset(G0): glamor initialization failed
  2.
Optionally enable the new output (xrandr --output HDMI-1-3 --auto ...).
  3.
Unplug the USB cable of the adapter.

== Actual result ==
Xorg dies with SIGSEGV (then abort()). Xorg.0.log:
(II) config/udev: removing GPU device /sys/devices/pci0000:00/0000:00:15.0/usb2/2-2/2-2:1.0/drm/card1 /dev/dri/card1
xf86: remove device 1 /sys/devices/pci0000:00/0000:00:15.0/usb2/2-2/2-2:1.0/drm/card1
(EE) Backtrace:
(EE) unw_get_proc_name failed: no unwind info found [-10]
(EE) 0: /usr/lib/xorg/Xorg (?+0x0) [0x...]
(EE) 1: /lib/x86_64-linux-gnu/libc.so.6 (?+0x0) [0x...]
(EE) Segmentation fault at address 0x0
Fatal server error:
(EE) Caught signal 11 (Segmentation fault). Server aborting
The session is lost (lxdm restarts X).
== Backtrace from a core dump (symbolized with debuginfod, build-id e858b9a34d43fe9c19eae19231b2f40b7714af5f) ==
Two separate crashes (15:27:05 and 15:32:06) gave the same chain. Frames 0-7 are the
signal handler / abort(); the relevant frames are:
#8 0x0000000000000000 in ?? () <- call through a NULL function pointer
#9 DGACloseScreen hw/xfree86/common/xf86DGA.c:272
#10 present_close_screen present/present_screen.c:64
#11 xf86platformRemoveDevice hw/xfree86/common/xf86platformBus.c:730
#12 DeleteGPUDeviceRequest hw/xfree86/os-support/linux/lnx_platform.c:217
#13 device_removed config/udev.c:339
#14 socket_handler config/udev.c:379
#15 ospoll_wait os/ospoll.c:643
#16 WaitForSomething
... main loop
(Symbol names and lines were resolved with addr2line against the debuginfod
debug file; the gdb output itself only showed raw addresses for Xorg frames.)
Interpretation: when the GPU screen is closed, present_close_screen() restores and
calls its saved CloseScreen, which is DGACloseScreen(). DGACloseScreen() then calls the
next CloseScreen pointer saved at DGAInit() time, which is NULL for this GPU screen.
I have not checked the xserver source beyond the symbolized lines above.
== Expected result ==
Xorg removes the GPU screen and keeps running, as it does when only the monitor is unplugged.
== Additional information ==

  *
Reproducibility: it crashed on 3 of the 4 unplugs I tried on this machine; the first
     *
one did not crash. I do not know what differs.
  *
Removing only the HDMI cable from the adapter (the GPU stays) does not crash.
  *
I tried making the kernel driver announce the removal first (mark connectors
     *
disconnected, send a hotplug uevent, wait up to 1.5 s for the compositor to switch the
CRTCs off, and only then remove the card). Xorg did NOT switch the CRTC off within
1500 ms ("outputs still active after 1500 ms"), and the crash still occurred.
So the driver cannot avoid it by ordering.
  *
The adapter's driver is out of tree (github.com/ramifriedman/mct-t6-linux, with local
     *
I believe the NULL pointer is an Xorg issue because it is a call through an unset
CloseScreen pointer in generic xfree86 code, but I cannot rule out that the DRM device
behaves in an unusual way. I can test patches or provide a core dump.
  *
Possibly related: glamor initialization fails on the GPU screen (llvmpipe). I do not know
     *
whether that influences the CloseScreen chain.

I can provide the full Xorg.0.log (the crashed session is Xorg.0.log.old) and the core
dump (about 200 MB) on request.
Thanks.



Met vriendelijke groet,

Best regards,


[image004.png]

René Timmermans

Senior System Engineer

Infodatek Systems BV


Web: www.infodatek.com<https://www.infodatek.com>

Email: rtimmermans@infodatek.com<mailto:rtimmermans@infodatek.com>

[cid:8d5d5b7a-789a-495c-b128-2b67cbe951b1]<https://www.linkedin.com/company/infodatek>

[cid:15cd18e5-6d15-41d5-a25e-dffbb3900105]<https://www.facebook.com/Infodatek/>