Bug 2178615
| Summary: | [abrt] Possible use-after-free under gtk_widget_get_settings() | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Saravanan <saravanan.2407> | ||||||||||||||||||||||||||||
| Component: | gtk4 | Assignee: | Kalev Lember <klember> | ||||||||||||||||||||||||||||
| Status: | CLOSED UPSTREAM | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||||||||||||||||||||||
| Severity: | unspecified | Docs Contact: | |||||||||||||||||||||||||||||
| Priority: | unspecified | ||||||||||||||||||||||||||||||
| Version: | 38 | CC: | gnome-sig, klember, mclasen, mcrha, rhughes, schuyler.cavender, thatsfwright | ||||||||||||||||||||||||||||
| Target Milestone: | --- | ||||||||||||||||||||||||||||||
| Target Release: | --- | ||||||||||||||||||||||||||||||
| Hardware: | x86_64 | ||||||||||||||||||||||||||||||
| OS: | Unspecified | ||||||||||||||||||||||||||||||
| URL: | https://retrace.fedoraproject.org/faf/reports/bthash/c45dd25e2c48885359511b88148d7dbb4bbf42a | ||||||||||||||||||||||||||||||
| Whiteboard: | abrt_hash:cd8187258bc80254b4b0e22c443b1d4cc8a925a1;VARIANT_ID=workstation; | ||||||||||||||||||||||||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||||||||||||||||||||||||
| Doc Text: | Story Points: | --- | |||||||||||||||||||||||||||||
| Clone Of: | Environment: | ||||||||||||||||||||||||||||||
| Last Closed: | 2023-03-21 06:32:03 UTC | Type: | --- | ||||||||||||||||||||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||||||||||||||||||||
| Documentation: | --- | CRM: | |||||||||||||||||||||||||||||
| Verified Versions: | Category: | --- | |||||||||||||||||||||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||||||||||||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||||||||||||||||||||
| Embargoed: | |||||||||||||||||||||||||||||||
| Attachments: |
|
||||||||||||||||||||||||||||||
|
Description
Saravanan
2023-03-15 12:35:08 UTC
Created attachment 1950967 [details]
File: proc_pid_status
Created attachment 1950968 [details]
File: maps
Created attachment 1950969 [details]
File: limits
Created attachment 1950970 [details]
File: environ
Created attachment 1950971 [details]
File: open_fds
Created attachment 1950972 [details]
File: mountinfo
Created attachment 1950973 [details]
File: os_info
Created attachment 1950974 [details]
File: cpuinfo
Created attachment 1950975 [details]
File: core_backtrace
Created attachment 1950976 [details]
File: exploitable
Created attachment 1950977 [details]
File: dso_list
Created attachment 1950978 [details]
File: var_log_messages
Created attachment 1950979 [details]
File: backtrace
Thanks for a bug report. I see this is crashing in a gtk4 code, but I'm not sure from the backtrace whether it's a gtk4 bug or not. Can you reproduce it anyhow, please? It seems there had been a change in the GSettings (key `overlay-scrolling` of a path not shown in the backtrace), which gtk+ tried to propagate further. I guess some preceding action in the gnome-software left things in a bad state, which had been discovered only after this code had been executed, but it's only a wild guess. I tried to reproduce this under rawhide with gnome-software-44~rc-1.fc39.x86_64 gtk4-4.10.0-4.fc39.x86_64 libadwaita-1.3~rc-1.fc39.x86_64 and when I open Menu->About and then closing the about dialog and runnign from a second terminal: gsettings set org.gnome.desktop.interface overlay-scrolling false gsettings set org.gnome.desktop.interface overlay-scrolling true then the gnome-software terminal shows: 13:51:07:260 Gtk gtk_widget_get_settings: assertion 'GTK_IS_WIDGET (widget)' failed 13:51:07:260 GLib-GObject g_object_get: assertion 'G_IS_OBJECT (object)' failed When I open Menu->Software Repositories and close them, then immediately after closing the window I see on the terminal: 13:53:28:844 Gtk gtk_widget_dispose_template: assertion 'template != NULL' failed 13:53:28:845 Gtk Finalizing GsReposSection 0x55c44c49d940, but it still has children left: 13:53:28:845 Gtk - GtkBox 0x55c44ddd28c0 13:53:28:845 Gtk gtk_widget_dispose_template: assertion 'template != NULL' failed 13:53:28:845 Gtk Finalizing GsReposSection 0x55c44d8453a0, but it still has children left: 13:53:28:845 Gtk - GtkBox 0x55c44dbad8e0 13:53:28:845 Gtk gtk_widget_dispose_template: assertion 'template != NULL' failed 13:53:28:845 Gtk Finalizing GsReposSection 0x55c44b603160, but it still has children left: 13:53:28:845 Gtk - GtkBox 0x55c44dca6300 13:53:28:845 Gtk gtk_widget_dispose_template: assertion 'template != NULL' failed 13:53:28:845 Gtk Finalizing GsReposSection 0x55c44d809140, but it still has children left: 13:53:28:845 Gtk - GtkBox 0x55c44d809ae0 which is something I do not see with gtk4-4.8.2-2.fc37.x86_64. I move this to the gtk4 for further investigation. *** Bug 2180240 has been marked as a duplicate of this bug. *** I moved this upstream for better visibility: https://gitlab.gnome.org/GNOME/gtk/-/issues/5684 Please see it for any further updates. Appologies for not responding. I can try to reproduce if it's still needed. It will have to waiting until later in the evening CST. *** Bug 2181669 has been marked as a duplicate of this bug. *** *** Bug 2181760 has been marked as a duplicate of this bug. *** I installed Wineglass rpm app. reporter: libreport-2.17.9 type: CCpp reason: gnome-software killed by SIGSEGV journald_cursor: s=9e72d5632b574a7384472e6604e0d57c;i=f358b;b=8bb5dc15625448b4b65a30852b5190ed;m=36f3b6083;t=5f85bd7deabe0;x=b20eb147c92644ef executable: /usr/bin/gnome-software cmdline: /usr/bin/gnome-software --gapplication-service cgroup: 0::/user.slice/user-1000.slice/user/app.slice/app-gnome-org.gnome.Software-2397.scope rootdir: / uid: 1000 kernel: 6.2.9-300.fc38.x86_64 package: gnome-software-44.0-3.fc38 runlevel: N 5 dso_list: /usr/bin/gnome-software gnome-software-44.0-3.fc38.x86_64 (Fedora Project) 1680010285 backtrace_rating: 4 crash_function: gtk_widget_get_settings comment: I installed Wineglass rpm app. |