Ubuntu 14.04: multi-touch screen can cause desktop to unlock

Bug #1351616 reported by Kirill
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
xorg (Ubuntu)
Expired
Undecided
Unassigned

Bug Description

Steps to reproduce on a laptop with a multitouch screen (in my case, a Lenovo X1 Carbon Gen 2):

1. Lock the desktop.
2. Start lightly tapping away on the laptop screen and triggering various bogus multitouch events.
3. The Xorg issue reported in https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-input-evdev/+bug/1121379 will eventually trigger and gnome-session will crash
4. You are able to view the unlocked desktop, and have limited keyboard/mouse access to the desktop.

The issue seems to be similar to https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572 , which is marked fixed, but it looks like in the event of a crash the screen can still become unlocked.

Relevant logs:
==> /var/log/auth.log <==
Aug 2 09:14:10 SOMEHOST compiz: PAM unable to dlopen(pam_kwallet.so): /lib/security/pam_kwallet.so: cannot open shared object file: No such file or director
y
Aug 2 09:14:10 SOMEHOST compiz: PAM adding faulty module: pam_kwallet.so
Aug 2 09:14:10 SOMEHOST compiz: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "SOMEUSER"

==> /var/log/syslog <==
Aug 2 09:14:24 SOMEHOST gnome-session[2065]: WARNING: App 'compiz.desktop' respawning too quickly
Aug 2 09:14:24 SOMEHOST gnome-session[2065]: WARNING: App 'compiz.desktop' exited with code 1
Aug 2 09:14:24 SOMEHOST gnome-session[2065]: WARNING: App 'compiz.desktop' respawning too quickly

==> /var/log/Xorg.0.log <==
[ 445.600] (EE) Backtrace:
[ 445.600] (EE) 0: /usr/bin/X (xorg_backtrace+0x48) [0x7f6921bd8c78]
[ 445.600] (EE) 1: /usr/bin/X (0x7f6921a30000+0x7d3e7) [0x7f6921aad3e7]
[ 445.600] (EE) 2: /usr/bin/X (0x7f6921a30000+0x138845) [0x7f6921b68845]
[ 445.600] (EE) 3: /usr/bin/X (0x7f6921a30000+0x138357) [0x7f6921b68357]
[ 445.600] (EE) 4: /usr/bin/X (0x7f6921a30000+0x13afa2) [0x7f6921b6afa2]
[ 445.601] (EE) 5: /usr/bin/X (0x7f6921a30000+0x15c1d4) [0x7f6921b8c1d4]
[ 445.601] (EE) 6: /usr/bin/X (mieqProcessDeviceEvent+0x1cd) [0x7f6921bbb0cd]
[ 445.601] (EE) 7: /usr/bin/X (mieqProcessInputEvents+0xf7) [0x7f6921bbb1e7]
[ 445.601] (EE) 8: /usr/bin/X (ProcessInputEvents+0x9) [0x7f6921ac2fe9]
[ 445.601] (EE) 9: /usr/bin/X (0x7f6921a30000+0x55802) [0x7f6921a85802]
[ 445.601] (EE) 10: /usr/bin/X (0x7f6921a30000+0x5994a) [0x7f6921a8994a]
[ 445.601] (EE) 11: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xf5) [0x7f691f56cec5]
[ 445.601] (EE) 12: /usr/bin/X (0x7f6921a30000+0x44e7e) [0x7f6921a74e7e]
[ 445.601] (EE)
[ 445.724] (EE) BUG: triggered 'if (!(event->device_event.flags & (1 << 5)))'
[ 445.724] (EE) BUG: ../../dix/touch.c:644 in TouchConvertToPointerEvent()
[ 445.724] (EE) Non-emulating touch event
[ 445.725] (EE)
[ 445.725] (EE) Backtrace:
[ 445.725] (EE) 0: /usr/bin/X (xorg_backtrace+0x48) [0x7f6921bd8c78]
[ 445.725] (EE) 1: /usr/bin/X (0x7f6921a30000+0x7d3e7) [0x7f6921aad3e7]
[ 445.725] (EE) 2: /usr/bin/X (0x7f6921a30000+0x138845) [0x7f6921b68845]
[ 445.725] (EE) 3: /usr/bin/X (0x7f6921a30000+0x138357) [0x7f6921b68357]
[ 445.725] (EE) 4: /usr/bin/X (0x7f6921a30000+0x13afa2) [0x7f6921b6afa2]
[ 445.726] (EE) 5: /usr/bin/X (0x7f6921a30000+0x15c1d4) [0x7f6921b8c1d4]
[ 445.726] (EE) 6: /usr/bin/X (mieqProcessDeviceEvent+0x1cd) [0x7f6921bbb0cd]
[ 445.726] (EE) 7: /usr/bin/X (mieqProcessInputEvents+0xf7) [0x7f6921bbb1e7]
[ 445.726] (EE) 8: /usr/bin/X (ProcessInputEvents+0x9) [0x7f6921ac2fe9]
[ 445.726] (EE) 9: /usr/bin/X (0x7f6921a30000+0x558c6) [0x7f6921a858c6]
[ 445.726] (EE) 10: /usr/bin/X (0x7f6921a30000+0x5994a) [0x7f6921a8994a]
[ 445.726] (EE) 11: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xf5) [0x7f691f56cec5]
[ 445.726] (EE) 12: /usr/bin/X (0x7f6921a30000+0x44e7e) [0x7f6921a74e7e]
[ 445.727] (EE)
[ 450.837] (II) AIGLX: Suspending AIGLX clients for VT switch

Kirill (kkourtchikov)
description: updated
Revision history for this message
Seth Arnold (seth-arnold) wrote :

I'm surprised an X crash leaves enough of X running for you to interact with it; that seems highly surprising.

information type: Private Security → Public Security
Revision history for this message
Kirill (kkourtchikov) wrote :

Agreed. If X crashed hard and killed the session, I would probably be a little bit less worried, however, that does not seem to be the case.

Here is a video demonstrating the behavior:
https://www.youtube.com/watch?v=K6gkE-tB7zw

Please let me know if there is any other diagnostic information I may provide to aid in diagnosing/addressing the issue.

Revision history for this message
Seth Arnold (seth-arnold) wrote :

That's a superb video. Thanks!

Changed in unity (Ubuntu):
status: New → Confirmed
affects: unity (Ubuntu) → xorg (Ubuntu)
Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

It would be nice to get an unity crash report, see:
  https://wiki.ubuntu.com/Unity/FilingBugs#Getting_a_stack_trace

As for the security issue it seems related to lp:1308800

Revision history for this message
Timo Aaltonen (tjaalton) wrote :

I'm unable to reproduce this with both trusty and utopic on a machine that has an N-Trig Duosense multitouch panel.. Both installations are stock ones with no added extras. I wonder if there might be something else needed to trigger this?

Changed in xorg (Ubuntu):
status: Confirmed → Incomplete
Revision history for this message
Kirill (kkourtchikov) wrote :

I was able to trace 2 separate crashes. It appears as though the second crash/trace can only be triggered immediately after the first one. I was able to do so by typing "bt<Enter>run<Enter>y<Enter>bt<Enter>" in the GDB shell after kicking off the initial "run". Attached is the output. @Timo, were you unable to reproduce just the gnome-session issue or the Xorg crash as well?

Revision history for this message
Timo Aaltonen (tjaalton) wrote :

Do you have all updates installed? I had, so it was not a "stock" in that sense.. I see no crashes, nothing in Xorg log either.

Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote :

Mh, it looks like it crashes on the gdk XError handler... To make sure this is the case, can you also install the gtk-3 symbols and run again gdb?

Thanks.

Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for xorg (Ubuntu) because there has been no activity for 60 days.]

Changed in xorg (Ubuntu):
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.