1181981 – totem crashes while calling NULL callback in eject_wrapper_callback()

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1181981 - totem crashes while calling NULL callback in eject_wrapper_callback()

Summary: totem crashes while calling NULL callback in eject_wrapper_callback()

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	gvfs
Sub Component:
Version:	7.0
Hardware:	x86_64
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Ondrej Holy
QA Contact:	Desktop QE
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2015-01-14 08:59 UTC by Siteshwar Vashisht
Modified:	2019-02-15 14:01 UTC (History)
CC List:	4 users (show)
Fixed In Version:	gvfs-1.22.4-1.el7
Doc Type:	Bug Fix
Doc Text:	Cause: Gvfs volume monitor didn't verify whether optional callback function was provided when ejecting drive and used invalid pointer. Consequence: It caused client applications (e.g. Totem) crashes, when drives were being ejected. Fix: Currently, gvfs volume monitor verifies whether the callback function is provided. Result: Client applications doesn't crash anymore if eject operation is executed without callback function.
Clone Of:
Environment:
Last Closed:	2015-11-19 09:27:31 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)
bz1181981.patch (845 bytes, patch) 2015-01-14 09:13 UTC, Siteshwar Vashisht	no flags	Details \| Diff
View All

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2015:2106	0	normal	SHIPPED_LIVE	desktop core libraries bug fix and enhancement update	2015-11-19 09:34:35 UTC

Description Siteshwar Vashisht 2015-01-14 08:59:11 UTC

Description of problem:

User is running media from a detachable disk :

totem /run/media/chiefj/RIP_60_WEEK_3


This is the backtrace of the crash :

(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007f8747deddae in eject_wrapper_callback (source_object=<optimized out>, res=<optimized out>, user_data=0x2104dd0) at gproxymount.c:389
#2  0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f8748014d50) at gsimpleasyncresult.c:777
#3  0x00007f8747deafce in eject_cb (proxy=<optimized out>, res=<optimized out>, user_data=0x1ed09b0) at gproxydrive.c:599
#4  0x00007f8762451947 in g_simple_async_result_complete (simple=0x2670f10) at gsimpleasyncresult.c:777
#5  0x00007f87624ac8d1 in reply_cb (connection=<optimized out>, res=<optimized out>, user_data=0x2670f10) at gdbusproxy.c:2632
#6  0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f8748014ae0) at gsimpleasyncresult.c:777
#7  0x00007f87624a1c5a in g_dbus_connection_call_done (source=<optimized out>, result=<optimized out>, user_data=0x2813c00) at gdbusconnection.c:5339
#8  0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f874801a5f0) at gsimpleasyncresult.c:777
#9  0x00007f87624519a9 in complete_in_idle_cb (data=<optimized out>) at gsimpleasyncresult.c:789
#10 0x00007f8761c82ac6 in g_main_dispatch (context=0x66d4d0) at gmain.c:3058
#11 g_main_context_dispatch (context=context@entry=0x66d4d0) at gmain.c:3634
#12 0x00007f8761c82e48 in g_main_context_iterate (context=context@entry=0x66d4d0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3705
#13 0x00007f8761c82efc in g_main_context_iteration (context=0x66d4d0, context@entry=0x0, may_block=may_block@entry=1) at gmain.c:3766
#14 0x00007f876247db84 in g_application_run (application=0x66a100, argc=argc@entry=2, argv=argv@entry=0x7fff4ed59f68) at gapplication.c:1623
#15 0x000000000040271a in main (argc=2, argv=0x7fff4ed59f68) at totem.c:273

Application crashed at line 389 :

(gdb) frame 1
#1  0x00007f8747deddae in eject_wrapper_callback (source_object=<optimized out>, res=<optimized out>, user_data=0x2104dd0) at gproxymount.c:389
389       data->callback (data->object, res, data->user_data);
(gdb) l
384     eject_wrapper_callback (GObject *source_object,
385                             GAsyncResult *res,
386                             gpointer user_data)
387     {
388       EjectWrapperOp *data  = user_data;
389       data->callback (data->object, res, data->user_data);
390       g_object_unref (data->object);
391       g_free (data);
392     }
393

data->callback is NULL, that caused a crash :

(gdb) p data
$1 = (EjectWrapperOp *) 0x2104dd0
(gdb) p *data
$2 = {object = 0x1e9a2e0, callback = 0x0, user_data = 0x0}

Version-Release number of selected component (if applicable):
totem-3.8.2-5.el7

Comment 1 Siteshwar Vashisht 2015-01-14 09:13:35 UTC

Created attachment 979900 [details]
bz1181981.patch

Adding patch to avoid calling NULL callbacks

Comment 2 Ondrej Holy 2015-01-16 10:54:18 UTC

The patch looks good, I've just pushed it upstream.

Comment 7 Ondrej Holy 2015-05-06 12:53:06 UTC

The patch from the Comment 1 is already included in the rebased gvfs (Bug 1174716).

Comment 14 errata-xmlrpc 2015-11-19 09:27:31 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2106.html

Note You need to log in before you can comment on or make changes to this bug.