Attachment 1550977 Details for Bug 1695035 – File: backtrace

File: backtrace

backtrace (text/plain), 14.02 KB, created by Lukas Ruzicka on 2019-04-02 11:04:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lukas Ruzicka

Created: 2019-04-02 11:04:50 UTC

Size: 14.02 KB

patch

obsolete

>[New LWP 1290]
>[New LWP 1291]
>[New LWP 1377]
>[New LWP 1292]
>[Thread debugging using libthread_db enabled]
>Using host libthread_db library "/lib64/libthread_db.so.1".
>Core was generated by `/usr/libexec/imsettings-daemon'.
>Program terminated with signal SIGSEGV, Segmentation fault.
>#0  0x00007f068ab55ed9 in g_mutex_lock (mutex=mutex@entry=0x40) at ../glib/gthread-posix.c:1354
>[Current thread is 1 (Thread 0x7f068a4e9880 (LWP 1290))]
>
>Thread 1 (Thread 0x7f068a4e9880 (LWP 1290)):
>#0  0x00007f068ab55ed9 in g_mutex_lock (mutex=mutex@entry=0x40) at ../glib/gthread-posix.c:1354
>        _g_boolean_var_ = <optimized out>
>#1  0x00007f0689424ba5 in xfconf_cache_set_property_reply_handler (proxy=0x555d49dab110, res=0x555d49dbb0e0, user_data=user_data@entry=0x555d49dbcea0) at xfconf-cache.c:608
>        cache = 0x0
>        old_item = 0x555d49dbcea0
>        item = <optimized out>
>        error = 0x0
>        result = <optimized out>
>#2  0x00007f068aceda8a in g_task_return_now (task=0x555d49dbb0e0) at ../gio/gtask.c:1209
>No locals.
>#3  0x00007f068acedacd in complete_in_idle_cb (task=task@entry=0x555d49dbb0e0) at ../gio/gtask.c:1223
>No locals.
>#4  0x00007f068ab068bb in g_idle_dispatch (source=source@entry=0x555d49dbeda0, callback=0x7f068acedac0 <complete_in_idle_cb>, user_data=0x555d49dbb0e0) at ../glib/gmain.c:5627
>        again = <optimized out>
>#5  0x00007f068ab09fa0 in g_main_dispatch (context=0x555d49d85290) at ../glib/gmain.c:3189
>        dispatch = <optimized out>
>        prev_source = 0x0
>        was_in_call = 0
>        user_data = 0x555d49dbb0e0
>        callback = 0x7f068acedac0 <complete_in_idle_cb>
>        cb_funcs = 0x7f068abdc280 <g_source_callback_funcs>
>        cb_data = 0x7f067c01ad20
>        need_destroy = <optimized out>
>        source = 0x555d49dbeda0
>        current = 0x555d49d91f40
>        i = 0
>        __FUNCTION__ = "g_main_dispatch"
>#6  g_main_context_dispatch (context=context@entry=0x555d49d85290) at ../glib/gmain.c:3854
>No locals.
>#7  0x00007f068ab0a338 in g_main_context_iterate (context=0x555d49d85290, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:3927
>        max_priority = 0
>        timeout = 0
>        some_ready = 1
>        nfds = <optimized out>
>        allocated_nfds = 1
>        fds = 0x555d49da70f0
>#8  0x00007f068ab0a683 in g_main_loop_run (loop=0x555d49d93a80) at ../glib/gmain.c:4123
>        self = <optimized out>
>        __FUNCTION__ = "g_main_loop_run"
>#9  0x0000555d499efcc7 in main (argc=<optimized out>, argv=<optimized out>) at main.c:180
>        err = 0x0
>        arg_replace = 0
>        arg_no_logfile = 0
>        arg_xinputrcdir = 0x0
>        arg_xinputdir = 0x0
>        arg_homedir = 0x0
>        arg_moduledir = 0x0
>        loop = 0x555d49d93a80
>        ctx = <optimized out>
>        entries = {{long_name = 0x555d499f73b8 "replace", short_name = 0 '\000', flags = 0, arg = G_OPTION_ARG_NONE, arg_data = 0x7ffedce00550, description = 0x555d499f7240 "Replace the instance of the imsettings daemon.", arg_description = 0x0}, {long_name = 0x555d499f6993 "xinputrcdir", short_name = 0 '\000', flags = 1, arg = G_OPTION_ARG_STRING, arg_data = 0x7ffedce00560, description = 0x555d499f7270 "Set the system-wide xinputrc directory (for debugging purpose)", arg_description = 0x555d499f73c0 "DIR"}, {long_name = 0x555d499f69b0 "xinputdir", short_name = 0 '\000', flags = 1, arg = G_OPTION_ARG_STRING, arg_data = 0x7ffedce00568, description = 0x555d499f72b0 "Set the IM configuration directory (for debugging purpose)", arg_description = 0x555d499f73c0 "DIR"}, {long_name = 0x555d499f6978 "homedir", short_name = 0 '\000', flags = 1, arg = G_OPTION_ARG_STRING, arg_data = 0x7ffedce00570, description = 0x555d499f72f0 "Set a home directory (for debugging purpose)", arg_description = 0x555d499f73c0 "DIR"}, {long_name = 0x555d499f69d6 "moduledir", short_name = 0 '\000', flags = 1, arg = G_OPTION_ARG_STRING, arg_data = 0x7ffedce00578, description = 0x555d499f7320 "Set the imsettings module directory (for debugging purpose)", arg_description = 0x555d499f73c0 "DIR"}, {long_name = 0x555d499f73c4 "no-logfile", short_name = 0 '\000', flags = 1, arg = G_OPTION_ARG_NONE, arg_data = 0x7ffedce00554, description = 0x555d499f73cf "Do not create a log file.", arg_description = 0x0}, {long_name = 0x0, short_name = 0 '\000', flags = 0, arg = G_OPTION_ARG_NONE, arg_data = 0x0, description = 0x0, arg_description = 0x0}}
>        connection = 0x555d49d87060
>
>Thread 2 (Thread 0x7f068a4e8700 (LWP 1291)):
>#0  0x00007f068a9c1847 in __GI___poll (fds=0x555d49d76d30, nfds=1, timeout=4807) at ../sysdeps/unix/sysv/linux/poll.c:29
>        resultvar = 18446744073709551100
>        sc_cancel_oldtype = 0
>        sc_ret = <optimized out>
>#1  0x00007f068ab0a2ae in g_main_context_poll (priority=<optimized out>, n_fds=1, fds=0x555d49d76d30, timeout=<optimized out>, context=0x555d49d7a9a0) at ../glib/gmain.c:4228
>        ret = <optimized out>
>        errsv = <optimized out>
>        poll_func = 0x7f068ab19e20 <g_poll>
>        poll_func = <optimized out>
>        ret = <optimized out>
>        errsv = <optimized out>
>#2  g_main_context_iterate (context=context@entry=0x555d49d7a9a0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:3922
>        max_priority = 2147483647
>        timeout = 4807
>        some_ready = <optimized out>
>        nfds = 1
>        allocated_nfds = 1
>        fds = 0x555d49d76d30
>#3  0x00007f068ab0a3e3 in g_main_context_iteration (context=0x555d49d7a9a0, may_block=may_block@entry=1) at ../glib/gmain.c:3988
>        retval = <optimized out>
>#4  0x00007f068ab0a431 in glib_worker_main (data=<optimized out>) at ../glib/gmain.c:5868
>No locals.
>#5  0x00007f068ab336f2 in g_thread_proxy (data=0x555d49d7ac00) at ../glib/gthread.c:805
>        thread = 0x555d49d7ac00
>        __FUNCTION__ = "g_thread_proxy"
>#6  0x00007f068aa9f5a2 in start_thread (arg=<optimized out>) at pthread_create.c:486
>        ret = <optimized out>
>        pd = <optimized out>
>        now = <optimized out>
>        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139666066933504, -1519340285119629847, 140732604088734, 140732604088735, 140732604088880, 139666066931328, 1506221612515522025, 1506222476055737833}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
>        not_first_call = <optimized out>
>#7  0x00007f068a9cc5c3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
>No locals.
>
>Thread 3 (Thread 0x7f0689414700 (LWP 1377)):
>#0  syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
>No locals.
>#1  0x00007f068ab5613e in g_cond_wait_until (cond=cond@entry=0x555d49d785b8, mutex=mutex@entry=0x555d49d785b0, end_time=end_time@entry=34900521) at ../glib/gthread-posix.c:1460
>        now = {tv_sec = 34, tv_nsec = 400521988}
>        span = {tv_sec = 0, tv_nsec = 499999012}
>        sampled = 8
>        res = <optimized out>
>#2  0x00007f068aadb011 in g_async_queue_pop_intern_unlocked (queue=0x555d49d785b0, wait=wait@entry=1, end_time=34900521) at ../glib/gasyncqueue.c:422
>        retval = <optimized out>
>        __FUNCTION__ = "g_async_queue_pop_intern_unlocked"
>#3  0x00007f068aadb6c1 in g_async_queue_timeout_pop_unlocked (queue=<optimized out>, timeout=timeout@entry=500000) at ../glib/gasyncqueue.c:574
>        end_time = <optimized out>
>        __FUNCTION__ = "g_async_queue_timeout_pop_unlocked"
>#4  0x00007f068ab3427a in g_thread_pool_wait_for_new_task (pool=<optimized out>) at ../glib/gthreadpool.c:263
>        task = <optimized out>
>        task = <optimized out>
>#5  g_thread_pool_thread_proxy (data=<optimized out>) at ../glib/gthreadpool.c:297
>        task = <optimized out>
>        pool = 0x555d49d76740
>#6  0x00007f068ab336f2 in g_thread_proxy (data=0x555d49d7af20) at ../glib/gthread.c:805
>        thread = 0x555d49d7af20
>        __FUNCTION__ = "g_thread_proxy"
>#7  0x00007f068aa9f5a2 in start_thread (arg=<optimized out>) at pthread_create.c:486
>        ret = <optimized out>
>        pd = <optimized out>
>        now = <optimized out>
>        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139666049287936, -1519340285119629847, 139666058537470, 139666058537471, 139666058537616, 139666049285760, 1506219385574979049, 1506222476055737833}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
>        not_first_call = <optimized out>
>#8  0x00007f068a9cc5c3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
>No locals.
>
>Thread 4 (Thread 0x7f0689ce7700 (LWP 1292)):
>#0  0x00007f068a9c1847 in __GI___poll (fds=0x555d49d91e90, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
>        resultvar = 18446744073709551100
>        sc_cancel_oldtype = 0
>        sc_ret = <optimized out>
>#1  0x00007f068ab0a2ae in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x555d49d91e90, timeout=<optimized out>, context=0x555d49d8fc80) at ../glib/gmain.c:4228
>        ret = <optimized out>
>        errsv = <optimized out>
>        poll_func = 0x7f068ab19e20 <g_poll>
>        poll_func = <optimized out>
>        ret = <optimized out>
>        errsv = <optimized out>
>#2  g_main_context_iterate (context=0x555d49d8fc80, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:3922
>        max_priority = 2147483647
>        timeout = -1
>        some_ready = <optimized out>
>        nfds = 2
>        allocated_nfds = 2
>        fds = 0x555d49d91e90
>#3  0x00007f068ab0a683 in g_main_loop_run (loop=0x555d49d8fd70) at ../glib/gmain.c:4123
>        self = <optimized out>
>        __FUNCTION__ = "g_main_loop_run"
>#4  0x00007f068ad56aba in gdbus_shared_thread_func (user_data=0x555d49d8fc50) at ../gio/gdbusprivate.c:275
>        data = 0x555d49d8fc50
>#5  0x00007f068ab336f2 in g_thread_proxy (data=0x555d49d7aca0) at ../glib/gthread.c:805
>        thread = 0x555d49d7aca0
>        __FUNCTION__ = "g_thread_proxy"
>#6  0x00007f068aa9f5a2 in start_thread (arg=<optimized out>) at pthread_create.c:486
>        ret = <optimized out>
>        pd = <optimized out>
>        now = <optimized out>
>        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139666058540800, -1519340285119629847, 140732604089150, 140732604089151, 140732604089296, 139666058538624, 1506220513540765161, 1506222476055737833}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
>        not_first_call = <optimized out>
>#7  0x00007f068a9cc5c3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
>No locals.
>From                To                  Syms Read   Shared Object Library
>0x00007f068ae26ab0  0x00007f068ae28f72  Yes         /lib64/libnotify.so.4
>0x00007f068ae17cf0  0x00007f068ae1c834  Yes         /lib64/libimsettings.so.5
>0x00007f068ac7e1f0  0x00007f068ad81476  Yes         /lib64/libgio-2.0.so.0
>0x00007f068abf1eb0  0x00007f068ac23a0e  Yes         /lib64/libgobject-2.0.so.0
>0x00007f068abdf450  0x00007f068abe0333  Yes         /lib64/libgmodule-2.0.so.0
>0x00007f068aad6b30  0x00007f068ab56782  Yes         /lib64/libglib-2.0.so.0
>0x00007f068aa9db50  0x00007f068aaabf05  Yes         /lib64/libpthread.so.0
>0x00007f068a8f3670  0x00007f068aa3e85f  Yes         /lib64/libc.so.6
>0x00007f068a8adcd0  0x00007f068a8c447d  Yes         /lib64/libgdk_pixbuf-2.0.so.0
>0x00007f068a88e5f0  0x00007f068a89b878  Yes         /lib64/libz.so.1
>0x00007f068a839590  0x00007f068a873aa2  No          /lib64/libmount.so.1
>0x00007f068a805850  0x00007f068a81d680  Yes         /lib64/libselinux.so.1
>0x00007f068a7e5730  0x00007f068a7f1580  Yes         /lib64/libresolv.so.2
>0x00007f068a7d82c0  0x00007f068a7dcd84  Yes         /lib64/libffi.so.6
>0x00007f068a7d1270  0x00007f068a7d2029  Yes         /lib64/libdl.so.2
>0x00007f068a75e390  0x00007f068a7aeb7e  Yes         /lib64/libpcre.so.1
>0x00007f068ae40110  0x00007f068ae5f704  Yes         /lib64/ld-linux-x86-64.so.2
>0x00007f068a623390  0x00007f068a6bea68  Yes         /lib64/libm.so.6
>0x00007f068a5e6230  0x00007f068a608785  Yes         /lib64/libpng16.so.16
>0x00007f068a593e70  0x00007f068a5c6fa2  No          /lib64/libblkid.so.1
>0x00007f068a580610  0x00007f068a5840a1  No          /lib64/libuuid.so.1
>0x00007f068a576710  0x00007f068a579ab0  Yes         /lib64/librt.so.1
>0x00007f068a4f0490  0x00007f068a54b8a1  Yes         /lib64/libpcre2-8.so.0
>0x00007f06894bbfb0  0x00007f06894d74a2  No          /usr/lib64/gio/modules/libgvfsdbus.so
>0x00007f068947fef0  0x00007f068949785d  No          /usr/lib64/gvfs/libgvfscommon.so
>0x00007f068ae341d0  0x00007f068ae34485  Yes         /usr/lib64/imsettings/libimsettings-xfce.so
>0x00007f0689422d90  0x00007f068942df9a  Yes         /lib64/libxfconf-0.so.3
>0x00007f0689416090  0x00007f06894161d2  Yes         /lib64/libgthread-2.0.so.0
>$1 = 0x0
>$2 = 0x0
>rax            0x1                 1
>rbx            0x555d49dbb0e0      93859159453920
>rcx            0x555d49d74568      93859159164264
>rdx            0x555d49dbcea0      93859159461536
>rsi            0x555d49dbb0e0      93859159453920
>rdi            0x40                64
>rbp            0x555d49dbcea0      0x555d49dbcea0
>rsp            0x7ffedce00358      0x7ffedce00358
>r8             0x555d49d79a08      93859159185928
>r9             0x555d49d79740      93859159185216
>r10            0x555d49d79778      93859159185272
>r11            0x555d49d79a10      93859159185936
>r12            0x555d49dbb0e0      93859159453920
>r13            0x555d49dab110      93859159388432
>r14            0x0                 0
>r15            0x40                64
>rip            0x7f068ab55ed9      0x7f068ab55ed9 <g_mutex_lock+9>
>eflags         0x10246             [ PF ZF IF RF ]
>cs             0x33                51
>ss             0x2b                43
>ds             0x0                 0
>es             0x0                 0
>fs             0x0                 0
>gs             0x0                 0
>Dump of assembler code for function g_mutex_lock:
>   0x00007f068ab55ed0 <+0>:	endbr64 
>   0x00007f068ab55ed4 <+4>:	mov    $0x1,%eax
>=> 0x00007f068ab55ed9 <+9>:	lock xadd %eax,(%rdi)
>   0x00007f068ab55edd <+13>:	test   %eax,%eax
>   0x00007f068ab55edf <+15>:	je     0x7f068ab55ef0 <g_mutex_lock+32>
>   0x00007f068ab55ee1 <+17>:	jmpq   0x7f068ab555b0 <g_mutex_lock_slowpath>
>   0x00007f068ab55ee6 <+22>:	nopw   %cs:0x0(%rax,%rax,1)
>   0x00007f068ab55ef0 <+32>:	retq   
>End of assembler dump.
>== EXPLOITABLE ==

Actions: View

Attachments on bug 1695035: 1550977 | 1550978 | 1550979 | 1550980 | 1550981 | 1550982 | 1550983 | 1550984 | 1550985 | 1550986 | 1550987 | 1550988