Bug 1483205 - race condition between gdbus signal callback and g_bus_unwatch_name - can access freed memory
Summary: race condition between gdbus signal callback and g_bus_unwatch_name - can acc...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: glib2
Version: 26
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Matthias Clasen
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:71fe61df9a1c7e353c369a35bd4...
: 1486678 1491050 1493227 1493951 1495002 1497554 1499024 1499105 1499220 1505441 1505535 1507956 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-08-19 03:33 UTC by Daniel Snider
Modified: 2017-12-19 03:22 UTC (History)
34 users (show)

Fixed In Version: glib2-2.52.3-2.fc26
Clone Of:
Environment:
Last Closed: 2017-11-15 20:14:39 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: backtrace (40.41 KB, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: cgroup (235 bytes, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: core_backtrace (18.61 KB, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: cpuinfo (1.05 KB, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: dso_list (17.01 KB, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: environ (1.23 KB, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: exploitable (82 bytes, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: limits (1.29 KB, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: maps (78.25 KB, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: open_fds (803 bytes, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: proc_pid_status (1.28 KB, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
File: var_log_messages (28 bytes, text/plain)
2017-08-19 03:33 UTC, Daniel Snider
no flags Details
backtrace (10.44 KB, text/plain)
2017-10-05 16:41 UTC, Milan Crha
no flags Details
proposed patch (941 bytes, patch)
2017-10-05 17:03 UTC, Milan Crha
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
GNOME Bugzilla 777307 0 None None None 2017-10-18 16:55:23 UTC

Description Daniel Snider 2017-08-19 03:33:16 UTC
Description of problem:
After logging out of a "Gnome on Xorg" session, I logged back in as the same user choosing "Gnome Classic" on the greeter settings. The abrt was prompted twice immediately after the desktop loaded after that login.

Version-Release number of selected component:
evolution-data-server-3.24.5-1.fc26

Additional info:
reporter:       libreport-2.9.1
backtrace_rating: 4
cmdline:        /usr/libexec/evolution-addressbook-factory-subprocess --factory local --bus-name org.gnome.evolution.dataserver.Subprocess.Backend.AddressBookx7983x2 --own-path /org/gnome/evolution/dataserver/Subprocess/Backend/AddressBook/7983/2
crash_function: strlen
executable:     /usr/libexec/evolution-addressbook-factory-subprocess
journald_cursor: s=cff41d712355442a99e8cc83e9e19a8b;i=3d7a;b=bf98b4a6a857403c8c661abac67313fe;m=b7b809108;t=557129a84ed26;x=6acbd33727d0b093
kernel:         4.12.5-300.fc26.x86_64
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 strlen at ../sysdeps/x86_64/strlen.S:106
 #1 g_strdup at gstrfuncs.c:362
 #2 schedule_call_in_idle at gdbusnamewatching.c:195
 #3 do_call at gdbusnamewatching.c:217
 #4 ffi_call_unix64 at ../src/x86/unix64.S:76
 #5 ffi_call at ../src/x86/ffi64.c:525
 #6 g_cclosure_marshal_generic at gclosure.c:1490
 #11 emit_closed_in_idle at gdbusconnection.c:1358
 #16 g_main_context_iteration at gmain.c:4033
 #17 dconf_gdbus_worker_thread at dconf-gdbus-thread.c:82

Potential duplicate: bug 1220320

Comment 1 Daniel Snider 2017-08-19 03:33:20 UTC
Created attachment 1315614 [details]
File: backtrace

Comment 2 Daniel Snider 2017-08-19 03:33:21 UTC
Created attachment 1315615 [details]
File: cgroup

Comment 3 Daniel Snider 2017-08-19 03:33:22 UTC
Created attachment 1315616 [details]
File: core_backtrace

Comment 4 Daniel Snider 2017-08-19 03:33:22 UTC
Created attachment 1315617 [details]
File: cpuinfo

Comment 5 Daniel Snider 2017-08-19 03:33:23 UTC
Created attachment 1315618 [details]
File: dso_list

Comment 6 Daniel Snider 2017-08-19 03:33:24 UTC
Created attachment 1315619 [details]
File: environ

Comment 7 Daniel Snider 2017-08-19 03:33:25 UTC
Created attachment 1315620 [details]
File: exploitable

Comment 8 Daniel Snider 2017-08-19 03:33:26 UTC
Created attachment 1315621 [details]
File: limits

Comment 9 Daniel Snider 2017-08-19 03:33:27 UTC
Created attachment 1315622 [details]
File: maps

Comment 10 Daniel Snider 2017-08-19 03:33:28 UTC
Created attachment 1315623 [details]
File: open_fds

Comment 11 Daniel Snider 2017-08-19 03:33:29 UTC
Created attachment 1315624 [details]
File: proc_pid_status

Comment 12 Daniel Snider 2017-08-19 03:33:30 UTC
Created attachment 1315625 [details]
File: var_log_messages

Comment 13 Milan Crha 2017-08-22 07:30:40 UTC
Thanks for a bug report. I guess this is related to bug #1340203, the crash even didn't happen in the evolution-data-server code.

Comment 14 Constantin 2017-08-30 10:56:14 UTC
*** Bug 1486678 has been marked as a duplicate of this bug. ***

Comment 15 xzj8b3 2017-09-12 22:35:01 UTC
*** Bug 1491050 has been marked as a duplicate of this bug. ***

Comment 16 Don Swaner 2017-09-19 16:15:18 UTC
*** Bug 1493227 has been marked as a duplicate of this bug. ***

Comment 17 Eugene Mah 2017-09-22 20:24:19 UTC
Similar problem has been detected:

logged into my computer after a fresh boot and received a crash notification

reporter:       libreport-2.9.1
backtrace_rating: 4
cmdline:        /usr/libexec/evolution-calendar-factory-subprocess --factory local --bus-name org.gnome.evolution.dataserver.Subprocess.Backend.Calendarx1872x3 --own-path /org/gnome/evolution/dataserver/Subprocess/Backend/Calendar/1872/3
crash_function: strlen
executable:     /usr/libexec/evolution-calendar-factory-subprocess
journald_cursor: s=62f2f79697604d0ebd7dc519de8ed33d;i=4990;b=e59dafdd79bc4df593fea87889f22020;m=2a5fe063;t=559ccd9d564ef;x=9b15e35b8e32088a
kernel:         4.12.14-300.fc26.x86_64
package:        evolution-data-server-3.24.6-1.fc26
reason:         evolution-calendar-factory-subprocess killed by SIGSEGV
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            1000

Comment 18 Erick Omar Delgado 2017-09-24 18:46:14 UTC
*** Bug 1495002 has been marked as a duplicate of this bug. ***

Comment 19 Milan Crha 2017-09-25 08:23:09 UTC
*** Bug 1493951 has been marked as a duplicate of this bug. ***

Comment 20 Pierre Ossman 2017-09-25 08:46:25 UTC
Similar problem has been detected:

It died whilst the machine was idle over the weekend.

reporter:       libreport-2.9.1
backtrace_rating: 4
cmdline:        /usr/libexec/evolution-addressbook-factory-subprocess --factory local --bus-name org.gnome.evolution.dataserver.Subprocess.Backend.AddressBookx14378x2 --own-path /org/gnome/evolution/dataserver/Subprocess/Backend/AddressBook/14378/2
crash_function: g_type_check_instance
executable:     /usr/libexec/evolution-addressbook-factory-subprocess
journald_cursor: s=32b55581e41f4362a0537a0648a8be00;i=2102c3;b=972a186726a04d2481207d030d5fe549;m=28b4c41451;t=559c6ca890326;x=3b080946af3af291
kernel:         4.12.13-300.fc26.x86_64
package:        evolution-data-server-3.24.6-1.fc26
reason:         evolution-addressbook-factory-subprocess killed by signal 11
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            500

Comment 21 Colin Barker 2017-10-01 08:23:55 UTC
Similar problem has been detected:

Occured on gnome session startup following reboot prior to any user post-login action.
Evolution had been shut down normally during a previous session

reporter:       libreport-2.9.1
backtrace_rating: 4
cmdline:        /usr/libexec/evolution-addressbook-factory-subprocess --factory local --bus-name org.gnome.evolution.dataserver.Subprocess.Backend.AddressBookx2644x2 --own-path /org/gnome/evolution/dataserver/Subprocess/Backend/AddressBook/2644/2
crash_function: strlen
executable:     /usr/libexec/evolution-addressbook-factory-subprocess
journald_cursor: s=2371d044360d4afb805caf3bbd2b8363;i=8c2f9;b=7c055e7d68004cae8c6ea43e126f83c4;m=5de59ebaa;t=55a7059fa9208;x=90817510e1b3eee
kernel:         4.12.14-300.fc26.x86_64
package:        evolution-data-server-3.24.6-1.fc26
reason:         evolution-addressbook-factory-subprocess killed by SIGSEGV
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            502

Comment 22 bjnaga 2017-10-01 18:47:10 UTC
*** Bug 1497554 has been marked as a duplicate of this bug. ***

Comment 23 Colin Barker 2017-10-01 21:39:13 UTC
Evolution continues to be usable, however the issue is repeats on gnome session startup following reboot. There appears not to be any SELinux error report.

(In reply to Colin Barker from comment #21)
> Similar problem has been detected:
> 
> Occured on gnome session startup following reboot prior to any user
> post-login action.
> Evolution had been shut down normally during a previous session
> 
> reporter:       libreport-2.9.1
> backtrace_rating: 4
> cmdline:        /usr/libexec/evolution-addressbook-factory-subprocess
> --factory local --bus-name
> org.gnome.evolution.dataserver.Subprocess.Backend.AddressBookx2644x2
> --own-path
> /org/gnome/evolution/dataserver/Subprocess/Backend/AddressBook/2644/2
> crash_function: strlen
> executable:     /usr/libexec/evolution-addressbook-factory-subprocess
> journald_cursor:
> s=2371d044360d4afb805caf3bbd2b8363;i=8c2f9;
> b=7c055e7d68004cae8c6ea43e126f83c4;m=5de59ebaa;t=55a7059fa9208;
> x=90817510e1b3eee
> kernel:         4.12.14-300.fc26.x86_64
> package:        evolution-data-server-3.24.6-1.fc26
> reason:         evolution-addressbook-factory-subprocess killed by SIGSEGV
> rootdir:        /
> runlevel:       N 5
> type:           CCpp
> uid:            502

Comment 24 Milan Crha 2017-10-02 06:50:30 UTC
I tried to reproduce this last Friday, without success. It might be my setup is different or something, I do not know.

(In reply to Colin Barker from comment #23)
> ... repeats on gnome session startup following reboot.

I'm sorry, I'm unsure of the above sentence. Does it mean that you reboot the machine and log into the GNOME (on Wayland) session and the evolution-addressbook-factory crashes straight away?

The report shows that it's a local address book, thus On This Computer/Personal (or any other address book created under On This Computer). Do you have them filled with contacts? The only reason to have it opened after start, I can think of, is that the address book is marked to be used in the Birthdays & Anniversaries calendar and you have that calendar checked for inclusion for Reminders. Then after log in, the evolution-alarm-notify process is auto-started, it opens the Birthdays & Anniversaries calendar and this opens the address book. You can have eventually opened some other application accessing address books after start, but I would guess you do not have.

Comment 25 Colin Barker 2017-10-03 21:03:45 UTC
Hello, 
I will try to clarify for you.

(In reply to Milan Crha from comment #24)
> I tried to reproduce this last Friday, without success. It might be my setup
> is different or something, I do not know.
> 
> (In reply to Colin Barker from comment #23)
> > ... repeats on gnome session startup following reboot.
> 
> I'm sorry, I'm unsure of the above sentence. Does it mean that you reboot
> the machine and log into the GNOME (on Wayland) session and the
> evolution-addressbook-factory crashes straight away?
Yes I receive a pop-up alert that it has crashed at the same moment the session displays the desktop. The alert allowed me to report the issue to bugzilla.

> 
> The report shows that it's a local address book, thus On This
> Computer/Personal (or any other address book created under On This
> Computer). Do you have them filled with contacts? The only reason to have it
> opened after start, I can think of, is that the address book is marked to be
> used in the Birthdays & Anniversaries calendar and you have that calendar
> checked for inclusion for Reminders. Then after log in, the
> evolution-alarm-notify process is auto-started, it opens the Birthdays &
> Anniversaries calendar and this opens the address book. You can have
> eventually opened some other application accessing address books after
> start, but I would guess you do not have.
Yes I do have contacts in my local address book (about 75 in all including two distribution lists one with 35 and the other with only 4 names) and I have a very few calendar reminders set up. One 'All Day' reminder on 28th September, but none on the 30th Sept nor 1st Oct. I do not believe that I am running any other apps to access the address book.

I will update here whether this issue is still occuring.

Comment 26 Colin Barker 2017-10-03 21:28:19 UTC
Hello 

(In reply to Colin Barker from comment #25)
> I will update here whether this issue is still occuring.

The last couple of restarts the issue has not recurred.
I have now today also updated to the latest rpm versions and see no recurrence afterwards. I will update again if it recurrs.
Thank you for your help, Milan.

Comment 27 Milan Crha 2017-10-04 06:18:40 UTC
I'm afraid it's just matter of luck that it didn't strike yet/again.

Do any of your contacts have set either Birthday or Anniversary dates?

When you open the book Properties (in the context menu, when you select and then right-click the book name on the left side of the Contact view), does it have checked "Use in Birthdays & Anniversaries calendar"?

When you look into Edit->Preferences->Calendar and Tasks->Reminders tab, is the Contacts/Birthdays & Anniversaries calendar checked at the list of available calendars to be used for Reminders?

These things influence whether the book is opened after login (by evolution-alarm-notify). The Birthdays &  Anniversaries calendar can be also opened by GNOME Shell, by its calendar server, which fills events in the clock popup.

Comment 28 Don Swaner 2017-10-04 12:56:23 UTC
I'm getting this abrt every night when I close evolution and log out.  I use evolution only for email, and have no tasks, contacts, calendar, or memo entries.

Comment 29 Colin Barker 2017-10-04 22:24:48 UTC
You were right of course and it has struck again today.

(In reply to Milan Crha from comment #27)
> I'm afraid it's just matter of luck that it didn't strike yet/again.
> 
> Do any of your contacts have set either Birthday or Anniversary dates?
> 
> When you open the book Properties (in the context menu, when you select and
> then right-click the book name on the left side of the Contact view), does
> it have checked "Use in Birthdays & Anniversaries calendar"?
Yes for one book. No for the others.

> 
> When you look into Edit->Preferences->Calendar and Tasks->Reminders tab, is
> the Contacts/Birthdays & Anniversaries calendar checked at the list of
> available calendars to be used for Reminders?
Yes it is.

> 
> These things influence whether the book is opened after login (by
> evolution-alarm-notify). The Birthdays &  Anniversaries calendar can be also
> opened by GNOME Shell, by its calendar server, which fills events in the
> clock popup.

I will turn this off in both places and wait and see if this issue still recurs over a longer period this time.

Comment 30 Milan Crha 2017-10-05 13:27:03 UTC
I somehow managed to reproduce this semi-consistently. From what I see I believe the problem is in glib2, some use-after-free in gdbusnamewatching.c, probably on the GDBusConnection object. I'm investigating this further and I'll let you know when I know more.

Comment 31 Milan Crha 2017-10-05 16:41:44 UTC
Created attachment 1334916 [details]
backtrace

Okay, so from what I see there is a race condition in on_connection_disconnected(). This function is always called in a dedicated thread. When the factory subprocess closes, it calls g_bus_unown_name(), which also freed the 'client' structure, but that's still used inside the other thread.

The attached backtrace proves it. See Thread 1 there, the client_unref() is called with the same address as is user_data of on_connection_disconnected() being in the call of Thread 8.

Comment 32 Milan Crha 2017-10-05 17:03:08 UTC
Created attachment 1334921 [details]
proposed patch

This change helped me. I'm not able to reproduce the crash with it, but I also didn't notice the conditions which precede to the crash.

I created a test build with it included [1], thus you can try whether it'll help also in your environments. The patch still needs a review from glib2 folks, I do not know all the internals involved, this is only a change, which helped me when I've been trying to figure out what's going wrong there.

[1] https://koji.fedoraproject.org/koji/taskinfo?taskID=22269615

Comment 33 Milan Crha 2017-10-06 06:03:22 UTC
*** Bug 1499024 has been marked as a duplicate of this bug. ***

Comment 34 Milan Crha 2017-10-06 06:05:12 UTC
*** Bug 1499105 has been marked as a duplicate of this bug. ***

Comment 35 Milan Crha 2017-10-09 08:05:12 UTC
*** Bug 1499220 has been marked as a duplicate of this bug. ***

Comment 36 Milan Crha 2017-10-18 16:55:24 UTC
I just found out [1], which contains an upstream fix for this, which is included in glib2-2.54.0. It would be good to add it into the Fedora 26 as well, because there are too many crashes due to it.

[1] https://bugzilla.gnome.org/show_bug.cgi?id=777307

Comment 37 Milan Crha 2017-10-23 16:11:19 UTC
*** Bug 1505441 has been marked as a duplicate of this bug. ***

Comment 38 Milan Crha 2017-10-24 06:24:57 UTC
*** Bug 1505535 has been marked as a duplicate of this bug. ***

Comment 39 padx 2017-10-26 18:34:13 UTC
Similar problem has been detected:

directly after gnome login the problem popped up

reporter:       libreport-2.9.1
backtrace_rating: 4
cmdline:        /usr/libexec/evolution-calendar-factory-subprocess --factory local --bus-name org.gnome.evolution.dataserver.Subprocess.Backend.Calendarx6028x3 --own-path /org/gnome/evolution/dataserver/Subprocess/Backend/Calendar/6028/3
crash_function: g_type_check_instance
executable:     /usr/libexec/evolution-calendar-factory-subprocess
journald_cursor: s=f2c7ab90c9cc451785fec610a94e75b1;i=9ee6;b=01ee367809dc4c42bc899112e5519ed3;m=b0c3977f;t=55c7738215cf9;x=7e06cbdbfb10038b
kernel:         4.13.9-200.fc26.x86_64
package:        evolution-data-server-3.24.7-1.fc26
reason:         evolution-calendar-factory-subprocess killed by SIGSEGV
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            1000

Comment 40 Milan Crha 2017-11-01 07:22:16 UTC
*** Bug 1507956 has been marked as a duplicate of this bug. ***

Comment 41 Fedora Update System 2017-11-01 17:15:07 UTC
glib2-2.52.3-2.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-9d797ffb4b

Comment 42 Fedora Update System 2017-11-03 14:23:13 UTC
glib2-2.52.3-2.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-9d797ffb4b

Comment 43 Colin Barker 2017-11-11 00:00:52 UTC
Similar problem has been detected:

After logging out of the gnome desktop session I logged straight back in (as I had logged out by mistake). The alert came up straightaway.

reporter:       libreport-2.9.1
backtrace_rating: 4
cmdline:        /usr/libexec/evolution-calendar-factory-subprocess --factory local --bus-name org.gnome.evolution.dataserver.Subprocess.Backend.Calendarx5809x2 --own-path /org/gnome/evolution/dataserver/Subprocess/Backend/Calendar/5809/2
crash_function: g_type_check_instance
executable:     /usr/libexec/evolution-calendar-factory-subprocess
journald_cursor: s=1431966bf9c04aa9aa16c21ffe161c56;i=37c44;b=f3833387009d4bf99160dfd45e40293f;m=1d5eb3455;t=55da963506c26;x=845b5681113eaa3d
kernel:         4.13.11-200.fc26.x86_64
package:        evolution-data-server-3.24.7-1.fc26
reason:         evolution-calendar-factory-subprocess killed by SIGSEGV
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            502

Comment 44 Fedora Update System 2017-11-15 20:14:39 UTC
glib2-2.52.3-2.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.