Bug 2028427

backtrace
[New LWP 1083084]
[New LWP 1083086]
[New LWP 1083085]
[New LWP 1086966]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/sbin/NetworkManager --no-daemon'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50	  return ret;
[Current thread is 1 (Thread 0x7f9b03ae5480 (LWP 1083084))]

Thread 1 (Thread 0x7f9b03ae5480 (LWP 1083084)):
#0  0x00007f9b01158a4f in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {0, 94141726140156, 94141726140316, 140303715150695, 0, 140303718456352, 0, 32, 2048, 129, 2048, 140303718456256, 2064, 140303715161937, 2096, 7}}
        pid = <optimized out>
        tid = <optimized out>
#1  0x00007f9b0112bdb5 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x7f9b01bac6d0, sa_sigaction = 0x7f9b01bac6d0}, sa_mask = {__val = {140728898420737, 0, 136, 94141727745696, 9933472681721129984, 94141725862528, 140303725676240, 140303725696682, 140302086045696, 94141727745696, 9933472681721129984, 0, 94141727745696, 137, 140303728258592, 140729066682048}}, sa_flags = -349780192, sa_restorer = 0x1f}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007f9b01b27123 in g_assertion_message (domain=<optimized out>, file=<optimized out>, line=<optimized out>, func=0x7f9aeb26c720 <__func__.42579> "dispose", message=<optimized out>) at gtestutils.c:2533
        lstr = "2855\000\177\000\000\000\354\b4\306\310\332\211\340t\a\n\376\177\000\000(\301&\353\232\177\000"
        s = 0x559f143da6a0 ""
#3  0x00007f9b01b8020e in g_assertion_message_expr (domain=domain@entry=0x7f9aeb26a98e "nm", file=file@entry=0x7f9aeb26a960 "src/core/devices/bluetooth/nm-bluez-manager.c", line=line@entry=2855, func=func@entry=0x7f9aeb26c720 <__func__.42579> "dispose", expr=expr@entry=0x7f9aeb26c128 "c_list_is_empty(&priv->network_server_lst_head)") at gtestutils.c:2556
        s = 0x559f143b1c50 "assertion failed: (c_list_is_empty(&priv->network_server_lst_head))"
#4  0x00007f9aeb262a36 in dispose (object=0x559f14230990 [NMBluezManager]) at src/core/devices/bluetooth/nm-bluez-manager.c:2855
        self = 0x559f14230990 [NMBluezManager]
        priv = 0x559f142309a8
        __func__ = "dispose"
#5  0x00007f9b0203d828 in g_object_unref (_object=<optimized out>) at gobject.c:3303
        weak_locations = 0x0
        old_ref = <optimized out>
        __func__ = "g_object_unref"
        object = 0x559f14230990 [NMBluezManager]
        __func__ = "g_object_unref"
#6  0x00007f9b0203d828 in g_object_unref (_object=0x559f14230990) at gobject.c:3232
        object = 0x559f14230990 [NMBluezManager]
        __func__ = "g_object_unref"
#7  0x00007f9b01b77915 in g_slist_foreach (list=<optimized out>, list@entry=0x559f14272210 = {...}, func=0x7f9b0203d6f0 <g_object_unref>, user_data=user_data@entry=0x0) at gslist.c:862
        next = 0x0
#8  0x00007f9b01b7793f in g_slist_free_full (list=0x559f14272210 = {...}, free_func=<optimized out>) at gslist.c:177
#9  0x00007f9b01b4669f in g_hash_table_remove_all_nodes (hash_table=hash_table@entry=0x559f14285cc0<error reading variable: Cannot access memory at address 0x4>, notify=notify@entry=1, destruction=destruction@entry=1) at ghash.c:553
        i = 12
        key = <optimized out>
        value = <optimized out>
        old_size = <optimized out>
        old_keys = 0x559f142a3eb0
        old_values = 0x559f142a7f00
        old_hashes = 0x559f142a7d00
#10 0x00007f9b01b46fa2 in g_hash_table_remove_all_nodes (destruction=1, notify=1, hash_table=0x559f14285cc0<error reading variable: Cannot access memory at address 0x4>) at ghash.c:1104
        __func__ = "g_hash_table_unref"
#11 0x00007f9b01b46fa2 in g_hash_table_unref (hash_table=0x559f14285cc0<error reading variable: Cannot access memory at address 0x4>) at ghash.c:1104
        __func__ = "g_hash_table_unref"
#12 0x00007f9b038f3dd6 in _dl_fini () at dl-fini.c:138
        array = 0x559f12553900
        i = <optimized out>
        l = 0x7f9b03b0c1d0
        maps = 0x7ffe0a077830
        i = <optimized out>
        l = <optimized out>
        nmaps = <optimized out>
        nloaded = <optimized out>
        ns = 0
        do_audit = <optimized out>
        __PRETTY_FUNCTION__ = "_dl_fini"
#13 0x00007f9b0115b1ec in __run_exit_handlers (status=status@entry=0, listp=0x7f9b014c9758 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:108
        atfct = <optimized out>
        onfct = <optimized out>
        cxafct = <optimized out>
        f = <optimized out>
        new_exitfn_called = 3
        cur = 0x7f9b014cad20 <initial>
#14 0x00007f9b0115b320 in __GI_exit (status=status@entry=0) at exit.c:139
#15 0x0000559f11ee076e in main (argc=<optimized out>, argv=<optimized out>) at src/core/main.c:548
        success = 1
        manager = <optimized out>
        config = <optimized out>
        error = 0x0
        wrote_pidfile = 0
        bad_domains = 0x0
        config_cli = 0x0
        sd_id = <optimized out>
        error_invalid_logging_config = 0x0
        warnings = <optimized out>
        errsv = <optimized out>
        __func__ = "main"

Thread 2 (Thread 0x7f9afa751700 (LWP 1083086)):
#0  0x00007f9b0122eab1 in __GI___poll (fds=0x559f1424fc50, nfds=3, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
        resultvar = 18446744073709551100
        sc_cancel_oldtype = 0
#1  0x00007f9b01b58c86 in g_main_context_poll (priority=<optimized out>, n_fds=3, fds=0x559f1424fc50, timeout=<optimized out>, context=0x559f1424e050) at gmain.c:4247
        ret = <optimized out>
        errsv = <optimized out>
        poll_func = 0x7f9b01b685e0 <g_poll>
        max_priority = 2147483647
        timeout = -1
        some_ready = <optimized out>
        nfds = 3
        allocated_nfds = 3
        fds = 0x559f1424fc50
#2  0x00007f9b01b58c86 in g_main_context_iterate (context=0x559f1424e050, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3941
        max_priority = 2147483647
        timeout = -1
        some_ready = <optimized out>
        nfds = 3
        allocated_nfds = 3
        fds = 0x559f1424fc50
#3  0x00007f9b01b59042 in g_main_loop_run (loop=0x559f1424e190) at gmain.c:4142
        __func__ = "g_main_loop_run"
#4  0x00007f9b023525da in gdbus_shared_thread_func (user_data=0x559f1424e020) at gdbusprivate.c:275
        data = 0x559f1424e020
#5  0x00007f9b01b80fca in g_thread_proxy (data=0x559f14238ca0) at gthread.c:784
        thread = 0x559f14238ca0
        __func__ = "g_thread_proxy"
#6  0x00007f9b014d717a in start_thread (arg=<optimized out>) at pthread_create.c:479
        ret = <optimized out>
        pd = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140303603668736, -3911071242817573552, 140729066682574, 140729066682575, 140729066682704, 140303603663488, 3930764545447750992, 3931387352742554960}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
#7  0x00007f9b01143d83 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 3 (Thread 0x7f9afaf52700 (LWP 1083085)):
#0  0x00007f9b0122eab1 in __GI___poll (fds=0x559f14238a10, nfds=2, timeout=1949) at ../sysdeps/unix/sysv/linux/poll.c:29
        resultvar = 18446744073709551100
        sc_cancel_oldtype = 0
#1  0x00007f9b01b58c86 in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x559f14238a10, timeout=<optimized out>, context=0x559f14238b10) at gmain.c:4247
        ret = <optimized out>
        errsv = <optimized out>
        poll_func = 0x7f9b01b685e0 <g_poll>
        max_priority = 2147483647
        timeout = 1949
        some_ready = <optimized out>
        nfds = 2
        allocated_nfds = 2
        fds = 0x559f14238a10
#2  0x00007f9b01b58c86 in g_main_context_iterate (context=context@entry=0x559f14238b10, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3941
        max_priority = 2147483647
        timeout = 1949
        some_ready = <optimized out>
        nfds = 2
        allocated_nfds = 2
        fds = 0x559f14238a10
#3  0x00007f9b01b58db0 in g_main_context_iteration (context=0x559f14238b10, may_block=may_block@entry=1) at gmain.c:4007
        retval = <optimized out>
#4  0x00007f9b01b58e01 in glib_worker_main (data=<optimized out>) at gmain.c:5817
#5  0x00007f9b01b80fca in g_thread_proxy (data=0x559f14238c00) at gthread.c:784
        thread = 0x559f14238c00
        __func__ = "g_thread_proxy"
#6  0x00007f9b014d717a in start_thread (arg=<optimized out>) at pthread_create.c:479
        ret = <optimized out>
        pd = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140303612061440, -3911071242817573552, 140729066682270, 140729066682271, 140729066682400, 140303612056192, 3930763445399252304, 3931387352742554960}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
#7  0x00007f9b01143d83 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 4 (Thread 0x7f9af9f50700 (LWP 1086966)):
#0  0x00007f9b011438cd in syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1  0x00007f9b01b9fe3e in g_cond_wait_until (cond=cond@entry=0x559f1423aec8, mutex=mutex@entry=0x559f1423aec0, end_time=end_time@entry=17177564851) at gthread-posix.c:1449
        now = {tv_sec = 17162, tv_nsec = 564851385}
        span = {tv_sec = 14, tv_nsec = 999999615}
        sampled = 0
        res = <optimized out>
#2  0x00007f9b01b2b191 in g_async_queue_pop_intern_unlocked (queue=queue@entry=0x559f1423aec0, wait=wait@entry=1, end_time=end_time@entry=17177564851) at gasyncqueue.c:422
        retval = <optimized out>
        __func__ = "g_async_queue_pop_intern_unlocked"
#3  0x00007f9b01b2b780 in g_async_queue_timeout_pop (queue=0x559f1423aec0, timeout=timeout@entry=15000000) at gasyncqueue.c:543
        end_time = 17177564851
        retval = <optimized out>
#4  0x00007f9b01b81a71 in g_thread_pool_wait_for_new_pool () at gthreadpool.c:167
        pool = <optimized out>
        local_max_idle_time = 15000
        local_wakeup_thread_serial = <optimized out>
        last_wakeup_thread_serial = 0
        have_relayed_thread_marker = <optimized out>
        free_pool = <optimized out>
        task = <optimized out>
        pool = <optimized out>
#5  0x00007f9b01b81a71 in g_thread_pool_thread_proxy (data=<optimized out>) at gthreadpool.c:364
        free_pool = <optimized out>
        task = <optimized out>
        pool = <optimized out>
#6  0x00007f9b01b80fca in g_thread_proxy (data=0x559f143a0800) at gthread.c:784
        thread = 0x559f143a0800
        __func__ = "g_thread_proxy"
#7  0x00007f9b014d717a in start_thread (arg=<optimized out>) at pthread_create.c:479
        ret = <optimized out>
        pd = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140303595276032, -3911071242817573552, 140729066679054, 140729066679055, 140729066679184, 140303595270784, 3930770032805342544, 3931387352742554960}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>

It looks again to be gsm_sim_create_default_connection

fixed by https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/d5f917e702dfa9fada6c8ac19a09a3bacd7dbbb6

this

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (NetworkManager bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2022:1985