Bug 2037786 - [abrt] xdg-desktop-portal-gnome: strchr(): xdg-desktop-portal-gnome killed by SIGSEGV
Summary: [abrt] xdg-desktop-portal-gnome: strchr(): xdg-desktop-portal-gnome killed by...
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: xdg-desktop-portal-gnome
Version: 35
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: David King
QA Contact:
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:ccf8846d327911b73dd1793bcd2...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-01-06 15:09 UTC by Eugene Kanter
Modified: 2022-12-13 16:15 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-12-13 16:15:59 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: backtrace (75.84 KB, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details
File: core_backtrace (34.66 KB, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details
File: cpuinfo (2.42 KB, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details
File: environ (1.48 KB, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details
File: exploitable (82 bytes, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details
File: limits (1.29 KB, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details
File: maps (3.97 KB, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details
File: mountinfo (3.98 KB, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details
File: open_fds (11.79 KB, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details
File: proc_pid_status (1.40 KB, text/plain)
2022-01-06 15:09 UTC, Eugene Kanter
no flags Details

Description Eugene Kanter 2022-01-06 15:09:13 UTC
Description of problem:
at random or almost every time after login

Version-Release number of selected component:
xdg-desktop-portal-gnome-41.1-1.fc35

Additional info:
reporter:       libreport-2.15.2
backtrace_rating: 4
cgroup:         0::/user.slice/user-500.slice/user/app.slice/xdg-desktop-portal-gnome.service
cmdline:        /usr/libexec/xdg-desktop-portal-gnome
crash_function: strchr
dso_list:       /usr/libexec/xdg-desktop-portal-gnome xdg-desktop-portal-gnome-41.1-1.fc35.x86_64 (Fedora Project) 1636167867
executable:     /usr/libexec/xdg-desktop-portal-gnome
journald_cursor: s=77c918ac425c46a5bb6ad30eccf7bab8;i=1adb7e;b=aa69b546c24447dbb5003b757c886a85;m=20a2a7348;t=5d4da74771d9f;x=a73dd582435d5f36
kernel:         5.15.12-200.fc35.x86_64
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            500

Comment 1 Eugene Kanter 2022-01-06 15:09:16 UTC
Created attachment 1849274 [details]
File: backtrace

Comment 2 Eugene Kanter 2022-01-06 15:09:17 UTC
Created attachment 1849275 [details]
File: core_backtrace

Comment 3 Eugene Kanter 2022-01-06 15:09:18 UTC
Created attachment 1849276 [details]
File: cpuinfo

Comment 4 Eugene Kanter 2022-01-06 15:09:19 UTC
Created attachment 1849277 [details]
File: environ

Comment 5 Eugene Kanter 2022-01-06 15:09:20 UTC
Created attachment 1849278 [details]
File: exploitable

Comment 6 Eugene Kanter 2022-01-06 15:09:21 UTC
Created attachment 1849279 [details]
File: limits

Comment 7 Eugene Kanter 2022-01-06 15:09:22 UTC
Created attachment 1849280 [details]
File: maps

Comment 8 Eugene Kanter 2022-01-06 15:09:23 UTC
Created attachment 1849281 [details]
File: mountinfo

Comment 9 Eugene Kanter 2022-01-06 15:09:24 UTC
Created attachment 1849282 [details]
File: open_fds

Comment 10 Eugene Kanter 2022-01-06 15:09:25 UTC
Created attachment 1849283 [details]
File: proc_pid_status

Comment 11 Dr. David Alan Gilbert 2022-03-13 12:56:40 UTC
I'm also seeing this; just for the last couple of days on F35 under xfce.

#0  __strchr_avx2 () at ../sysdeps/x86_64/multiarch/strchr-avx2.S:65
#1  0x00007fad56c72eb2 in gdk_x11_clipboard_formats_from_atoms
    (n_atoms=<optimized out>, atoms=<optimized out>, display=0x55f551381060) at ../gdk/x11/gdkclipboard-x11.c:227
        name = 0x0
        builder = 0x55f551668580
        i = <optimized out>
        j = <optimized out>
        stream = 0x55f55144b960
        cb = 0x55f5514481a0
        display = 0x55f551381060
        formats = <optimized out>
        bytes = 0x55f551668550
        error = 0x0

226	      name = gdk_x11_get_xatom_name_for_display (display , atoms[i]);
227	      if (strchr (name, '/'))

to me it feels as if gdk should be checking that return first if nothing else.

#2  gdk_x11_clipboard_request_targets_finish
    (source_object=0x55f55144b960, res=<optimized out>, user_data=user_data@entry=0x55f5514481a0)
    at ../gdk/x11/gdkclipboard-x11.c:293
        stream = 0x55f55144b960
        cb = 0x55f5514481a0
        display = 0x55f551381060
        formats = <optimized out>
        bytes = 0x55f551668550
        error = 0x0
#3  0x00007fad5711a19a in g_task_return_now (task=0x55f551448d60) at ../gio/gtask.c:1219
#4  0x00007fad5711a39b in g_task_return (type=<optimized out>, task=0x55f551448d60) at ../gio/gtask.c:1289
        source = 0x55f5515ce7a0
        source_name = <optimized out>
#5  g_task_return (task=0x55f551448d60, type=<optimized out>) at ../gio/gtask.c:1245
#6  0x00007fad570e9466 in read_bytes_callback
    (stream=0x55f55144b960, result=0x55f551448a60, user_data=0x55f551448d60) at ../gio/ginputstream.c:905
        task = 0x55f551448d60
        buf = 0x55f5515ced40 "\037"
        error = 0x0
        nread = <optimized out>
        bytes = <optimized out>

Comment 12 Dr. David Alan Gilbert 2022-03-13 13:15:52 UTC
I wonder if this is a race somewhere; it seems to have started up later and is running - so is it only during session startup?

Note, I think the set of atoms is:

(gdb) p *bytes
$9 = {data = 0x55f5515ced40, size = 16, ref_count = 1, free_func = 0x7fad57299cd0 <g_free>, 
  user_data = 0x55f5515ced40}

(gdb) p ((char *)bytes->data)[0] @ 16
$7 = "\037", '\000' <repeats 14 times>

so is that a string and ... hmm

Comment 13 Dr. David Alan Gilbert 2022-03-27 16:11:34 UTC
Still on F36.
One observation:

317	  formats = gdk_x11_clipboard_formats_from_atoms (display,
318	                                                  g_bytes_get_data (bytes, NULL),
319	                                                  g_bytes_get_size (bytes) / sizeof (Atom));

now we have 16 bytes, and sizeof(Atom) seems to be 8, so we're passing two Atoms down
yet that bytes array is very empty, so one of those Atoms is all \0

Also, I think this is happening when I start Firefox, sometime after logging into the session.

Comment 14 Dr. David Alan Gilbert 2022-03-31 16:04:41 UTC
Hmm this stopped happening for me today, and I can't tell why.
However, I filed:

https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/4607

to nail the actual seg.

Comment 15 Dr. David Alan Gilbert 2022-04-01 01:31:10 UTC
that fix just got merged; so if you want the seg to go away that's fine, but it probably still needs some looking at as why it gets a dodgy atom.

Comment 16 Ben Cotton 2022-11-29 17:36:39 UTC
This message is a reminder that Fedora Linux 35 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 35 on 2022-12-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '35'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 35 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.

Comment 17 Ben Cotton 2022-12-13 16:15:59 UTC
Fedora Linux 35 entered end-of-life (EOL) status on 2022-12-13.

Fedora Linux 35 is no longer maintained, which means that it
will not receive any further security or bug fix updates. As a result we
are closing this bug.

If you can reproduce this bug against a currently maintained version of Fedora Linux
please feel free to reopen this bug against that version. Note that the version
field may be hidden. Click the "Show advanced fields" button if you do not see
the version field.

If you are unable to reopen this bug, please file a new report against an
active release.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.