Xorg crashing in pci_device_vgaarb_set_target

[Adam Jackson]

On Mon, 2017-10-09 at 13:07 +0200, Peter Kasza wrote:
> Hi all,
> 
> I'm getting itermittent crashes on a vfio enabled machine. I'm not
> able to recreate it on purpose, but it seems to be occurring when
> virtualbox VMs and Firefox are running.
> 
> From the backtrace I suspect that some bogus parameter is passed to
> the snprintf call, but other than that I'm not sure.
> 
> The crash occurs in libpciaccess - pci_device_vgaarb_set_target. I
> have the latest release installed (0.13.5).
> 
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  0x00007f17082667a3 in __GI__IO_default_xsputn () from /usr/lib/libc.so.6
> [Current thread is 1 (Thread 0x7f170aa11940 (LWP 491))]
> (gdb) bt
> #0  0x00007f17082667a3 in __GI__IO_default_xsputn () at /usr/lib/libc.so.6
> #1  0x00007f1708259b2d in __GI__IO_padn () at /usr/lib/libc.so.6
> #2  0x00007f1708239938 in vfprintf () at /usr/lib/libc.so.6
> #3  0x00007f17082efcbb in __vsnprintf_chk () at /usr/lib/libc.so.6
> #4  0x00007f17082efbe5 in __snprintf_chk () at /usr/lib/libc.so.6
> #5  0x00007f1709a966b8 in pci_device_vgaarb_set_target () at /usr/lib/libpciaccess.so.0
> #6  0x00005616427d1fc8 in  ()

Any chance you can (install debuginfo and) see the rest of this call
trace? I suspect the value of 'dev' being passed into
pci_device_vgaarb_set_target is just bogus, but without the call trace
up through Xorg it's hard to see how that could happen.

- ajax