Bug 1836190
| Summary: | abrt-applet 2.14.2-1.fc33 segmentation fault in g_steal_pointer | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Matt Fagnani <matt.fagnani> | ||||
| Component: | abrt | Assignee: | ekulik | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | rawhide | CC: | abrt-devel-list, ekulik, jakub, jmilan, mhabrnal, michal.toman, mkutlak, mmarusak | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | abrt-2.14.2-2.fc32 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2020-05-25 02:46:53 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Matt Fagnani
2020-05-15 11:32:59 UTC
Thanks for the report and investigation. I have a couple of ideas as to what the cause might be. Created attachment 1688905 [details]
abrt-applet segmentation fault gdb full trace of all threads
I got an abrt-applet full core file after I selected Sleep then resumed the system. The crash has been more common when sleeping/resuming than when booting. The relevant coredumpctl gdb output showed the segmentation fault in g_steal_pointer at /usr/include/glib-2.0/glib/gmem.h:206 with the invalid pointers pp=0x30 and ptr=0x30.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000055fe23dc5f9b in g_steal_pointer (pp=0x30) at /usr/include/glib-2.0/glib/gmem.h:206
206 ref = *ptr;
[Current thread is 1 (Thread 0x7fe5e85e1ac0 (LWP 1697))]
(gdb) bt full
#0 0x000055fe23dc5f9b in g_steal_pointer (pp=0x30) at /usr/include/glib-2.0/glib/gmem.h:206
ptr = 0x30
ref = <optimized out>
self = 0x0
problems = 0x0
#1 process_deferred_queue (user_data=user_data@entry=0x0) at abrt-applet-application.c:87
self = 0x0
problems = 0x0
#2 0x00007fe5e865447b in g_idle_dispatch
(source=source@entry=0x55fe251d3d30, callback=0x55fe23dc5f90 <process_deferred_queue>, user_data=0x0) at ../glib/gmain.c:5755
again = <optimized out>
#3 0x00007fe5e86587af in g_main_dispatch (context=0x55fe251ab9f0) at ../glib/gmain.c:3309
dispatch = <optimized out>
prev_source = 0x0
was_in_call = <optimized out>
user_data = 0x0
callback = 0x55fe23dc5f90 <process_deferred_queue>
cb_funcs = 0x7fe5e872f280 <g_source_callback_funcs>
cb_data = 0x55fe251ee650
need_destroy = <optimized out>
source = 0x55fe251d3d30
current = 0x55fe251a4990
i = 0
--Type <RET> for more, q to quit, c to continue without paging--c
__func__ = "g_main_dispatch"
#4 g_main_context_dispatch (context=0x55fe251ab9f0) at ../glib/gmain.c:3974
#5 0x00007fe5e8658b38 in g_main_context_iterate (context=context@entry=0x55fe251ab9f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4047
max_priority = 200
timeout = 0
some_ready = 1
nfds = <optimized out>
allocated_nfds = <optimized out>
fds = 0x55fe25193880
#6 0x00007fe5e8658c03 in g_main_context_iteration (context=context@entry=0x55fe251ab9f0, may_block=may_block@entry=1) at ../glib/gmain.c:4108
retval = <optimized out>
#7 0x00007fe5e887b74d in g_application_run (application=0x55fe2522d090 [AbrtAppletApplication], argc=-105053068, argv=<optimized out>) at ../gio/gapplication.c:2559
arguments = 0x55fe25193880
status = 0
context = 0x55fe251ab9f0
acquired_context = <optimized out>
__func__ = "g_application_run"
#8 0x000055fe23dc445d in main (argc=2, argv=0x7ffcf9bd05d8) at abrt-applet-main.c:24
application = 0x55fe2522d090
The g_steal_pointer function is passed pp=0x30 I guess by process_deferred_queue at abrt-applet-application.c:87 which it assigns to *ptr. The segmentation fault happened at line 206 where ref is assigned *ptr.
(gdb) l
201 g_steal_pointer (gpointer pp)
202 {
203 gpointer *ptr = (gpointer *) pp;
204 gpointer ref;
205
206 ref = *ptr;
207 *ptr = NULL;
208
209 return ref;
210 }
I'm attaching the full trace of all threads.
https://github.com/abrt/abrt/pull/1489 Seems that I forgot to pass the instance pointer to one of the signal handlers… Specifically, the crashes will happen during connectivity changes. FEDORA-2020-81b7399a06 has been submitted as an update to Fedora 32. https://bodhi.fedoraproject.org/updates/FEDORA-2020-81b7399a06 FEDORA-2020-81b7399a06 has been pushed to the Fedora 32 testing repository. In short time you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-81b7399a06` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-81b7399a06 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2020-81b7399a06 has been pushed to the Fedora 32 stable repository. If problem still persists, please make note of it in this bug report. |