Bug 2393593 - Crashes in prefer_sve_ifuncs/__uname on SVE enabled machine due to seccomp filter
Summary: Crashes in prefer_sve_ifuncs/__uname on SVE enabled machine due to seccomp fi...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: glycin
Version: 43
Hardware: aarch64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Fabio Valentini
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: ARMTracker BetaFreezeException, F43BetaFreezeException F43FinalBlocker, FinalBlocker
TreeView+ depends on / blocked
 
Reported: 2025-09-05 22:34 UTC by Jeremy Linton
Modified: 2025-09-19 01:18 UTC (History)
25 users (show)

Fixed In Version: glycin-2.0.0-1.fc43
Clone Of:
Environment:
Last Closed: 2025-09-19 01:18:55 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
Blue screen, missing icons (1.08 MB, image/png)
2025-09-05 22:37 UTC, Jeremy Linton
no flags Details
journalctl dump (437.53 KB, text/plain)
2025-09-05 22:42 UTC, Jeremy Linton
no flags Details

Description Jeremy Linton 2025-09-05 22:34:03 UTC
Fedora workstation .iso nightly 20250905.n.0 aarch64. Although anaconda seems to be having issues on the Server .iso as well.

Booting the live image, I'm presented with the 'install fedora' dialog but all the iconography and background images are blank. 

This goes away if I boot with arm64.nosve on the kernel command line.

The HW in question is an radxa orion o6, but I'm guessing from the backtraces I should be able to duplicate it on other SVE enabled machines.

This is of course glibc-2.42 and since the crash is happening in /usr/lib/ld-linux-aarch64.so.1 i'm going to assign it there for the time being.



Reproducible: Always

Steps to Reproduce:
1. Acquire arm v9.x machine with SVE
2. Acquire latest nightly workstation iso (or for a similar bug try server)
3. Boot machine
4. Notice blue screen and random screen issues.
Actual Results:
See attached image and logs.

root@localhost-live:~# coredumpctl info
           PID: 3958 (glycin-svg)
           UID: 1000 (liveuser)
           GID: 1000 (liveuser)
        Signal: 31 (SYS)
     Timestamp: Fri 2025-09-05 22:13:37 UTC (26min ago)
  Command Line: /usr/libexec/glycin-loaders/2+/glycin-svg --dbus-fd 58
    Executable: /usr/libexec/glycin-loaders/2+/glycin-svg
 Control Group: /user.slice/user-1000.slice/user/session.slice/org.gnome.Shell
          Unit: user
     User Unit: org.gnome.Shell
         Slice: user-1000.slice
     Owner UID: 1000 (liveuser)
       Boot ID: db49df2efe4144fe9adaa6ff642a6b5d
    Machine ID: 5fb1b15856144cedbf7065337931177b
      Hostname: localhost-live
       Storage: /var/lib/systemd/coredump/core.glycin-svg.1000.db49df2efe4144fe9adaa6ff642a6b5d.3958.1757110417000000.zst (present)
  Size on Disk: 16.4K
       Package: glycin/2.0~beta.3-1.fc43
      build-id: f477ee34520f07eb07714a2ce366b5c03e7a6bb2
       Message: Process 3958 (glycin-svg) of user 1000 dumped core.
                
                Module /usr/libexec/glycin-loaders/2+/glycin-svg from rpm glycin-2.0~beta.3-1.fc43.aarch64
                Stack trace of thread 2:
                #0  0x0000ffff91c7b6cc __uname (/usr/lib/ld-linux-aarch64.so.1 + 0x1d6cc)
                #1  0x0000ffff91c74dc4 prefer_sve_ifuncs (/usr/lib/ld-linux-aarch64.so.1 + 0x16dc4)
                #2  0x0000ffff91c750c8 init_cpu_features (/usr/lib/ld-linux-aarch64.so.1 + 0x170c8)
                #3  0x0000ffff91c764cc _dl_start_final (/usr/lib/ld-linux-aarch64.so.1 + 0x184cc)
                #4  0x0000ffff91c7a454 _start (/usr/lib/ld-linux-aarch64.so.1 + 0x1c454)
                ELF object binary architecture: AARCH64

Comment 1 Jeremy Linton 2025-09-05 22:37:29 UTC
Created attachment 2105787 [details]
Blue screen, missing icons

Comment 2 Jeremy Linton 2025-09-05 22:42:40 UTC
Created attachment 2105788 [details]
journalctl dump

Comment 3 Jeremy Linton 2025-09-05 22:49:58 UTC
abrt itself fails to start, otherwise I would attach all the abrt info it dies like:

                                                       #0  0x0000ffff9fca053c __pthread_kill_implementation (libc.so.6 + 0x9053c)
                                                       #1  0x0000ffff9fc4bc7c raise (libc.so.6 + 0x3bc7c)
                                                       #2  0x0000ffff9fc35d48 abort (libc.so.6 + 0x25d48)
                                                       #3  0x0000ffff915ddf50 g_assertion_message (libglib-2.0.so.0 + 0x8df50)
                                                       #4  0x0000ffff915dfbc0 g_assertion_message_error (libglib-2.0.so.0 + 0x8fbc0)
                                                       #5  0x0000ffff779a6ef4 ensure_surface_for_gicon (libgtk-3.so.0 + 0x1c6ef4)
                                                       #6  0x0000ffff779a7374 gtk_icon_helper_load_surface (libgtk-3.so.0 + 0x1c7374)
                                                       #7  0x0000ffff779a7698 _gtk_icon_helper_get_size (libgtk-3.so.0 + 0x1c7698)
                                                       #8  0x0000ffff779bb168 gtk_image_get_content_size (libgtk-3.so.0 + 0x1db168)
                                                       #9  0x0000ffff778f9274 gtk_css_gadget_get_preferred_size (libgtk-3.so.0 + 0x119274)
                                                       #10 0x0000ffff77a92178 gtk_widget_query_size_for_orientation (libgtk-3.so.0 + 0x2b2178)
                                                       #11 0x0000ffff77a93304 _gtk_widget_get_preferred_size_for_size (libgtk-3.so.0 + 0x2b3304)
                                                       #12 0x0000ffff778f9274 gtk_css_gadget_get_preferred_size (libgtk-3.so.0 + 0x119274)
                                                       #13 0x0000ffff77a92178 gtk_widget_query_size_for_orientation (libgtk-3.so.0 + 0x2b2178)
                                                       #14 0x0000ffff77898b70 gtk_box_get_content_size (libgtk-3.so.0 + 0xb8b70)
                                                       #15 0x0000ffff778f9274 gtk_css_gadget_get_preferred_size (libgtk-3.so.0 + 0x119274)
                                                       #16 0x0000ffff77a92178 gtk_widget_query_size_for_orientation (libgtk-3.so.0 + 0x2b2178)
                                                       #17 0x0000ffff779a3af0 gtk_header_bar_get_content_size (libgtk-3.so.0 + 0x1c3af0)
                                                       #18 0x0000ffff778f9274 gtk_css_gadget_get_preferred_size (libgtk-3.so.0 + 0x119274)
                                                       #19 0x0000ffff77a92178 gtk_widget_query_size_for_orientation (libgtk-3.so.0 + 0x2b2178)
                                                       #20 0x0000ffff77b752c0 gtk_window_get_preferred_width.lto_priv.0 (libgtk-3.so.0 + 0x3952c0)
                                                       #21 0x0000ffff77889bec gtk_application_window_real_get_preferred_width (libgtk-3.so.0 + 0xa9bec)
                                                       #22 0x0000ffff77a92178 gtk_widget_query_size_for_orientation (libgtk-3.so.0 + 0x2b2178)
                                                       #23 0x0000ffff77a93070 _gtk_widget_get_preferred_size_and_baseline.constprop.0 (libgtk-3.so.0 + 0x2b3070)
                                                       #24 0x0000ffff77b71a7c gtk_window_compute_configure_request (libgtk-3.so.0 + 0x391a7c)
                                                       #25 0x0000ffff77b74e60 gtk_window_realize.lto_priv.0 (libgtk-3.so.0 + 0x394e60)
                                                       #26 0x0000ffff77889e34 gtk_application_window_real_realize (libgtk-3.so.0 + 0xa9e34)
                                                       #27 0x0000ffff91490a54 g_closure_invoke (libgobject-2.0.so.0 + 0x10a54)
                                                       #28 0x0000ffff914b0624 signal_emit_unlocked_R.isra.0 (libgobject-2.0.so.0 + 0x30624)
                                                       #29 0x0000ffff914b25e8 signal_emit_valist_unlocked (libgobject-2.0.so.0 + 0x325e8)
                                                       #30 0x0000ffff914b292c g_signal_emit_valist (libgobject-2.0.so.0 + 0x3292c)
                                                       #31 0x0000ffff914b29d8 g_signal_emit (libgobject-2.0.so.0 + 0x329d8)
                                                       #32 0x0000ffff77b50d48 gtk_widget_realize (libgtk-3.so.0 + 0x370d48)
                                                       #33 0x0000ffff77b765dc gtk_window_show.lto_priv.0 (libgtk-3.so.0 + 0x3965dc)
                                                       #34 0x0000ffff91490a54 g_closure_invoke (libgobject-2.0.so.0 + 0x10a54)
                                                       #35 0x0000ffff914b0624 signal_emit_unlocked_R.isra.0 (libgobject-2.0.so.0 + 0x30624)
                                                       #36 0x0000ffff914b25e8 signal_emit_valist_unlocked (libgobject-2.0.so.0 + 0x325e8)
                                                       #37 0x0000ffff914b292c g_signal_emit_valist (libgobject-2.0.so.0 + 0x3292c)
                                                       #38 0x0000ffff914b29d8 g_signal_emit (libgobject-2.0.so.0 + 0x329d8)
                                                       #39 0x0000ffff77b5192c gtk_widget_show (libgtk-3.so.0 + 0x37192c)
                                                       #40 0x0000ffff9144c064 ffi_call_SYSV (libffi.so.8 + 0xc064)
                                                       #41 0x0000ffff914468cc ffi_call_int (libffi.so.8 + 0x68cc)
                                                       #42 0x0000ffff917070f0 pygi_invoke_c_callable (_gi.cpython-314-aarch64-linux-gnu.so + 0x370f0)
                                                       #43 0x0000ffff91704ff4 pygi_callable_info_invoke (_gi.cpython-314-aarch64-linux-gnu.so + 0x34ff4)
                                                       #44 0x0000ffff9fedf044 PyObject_Vectorcall (libpython3.14.so.1.0 + 0xff044)
                                                       #45 0x0000ffff9fefaa1c _PyEval_EvalFrameDefault (libpython3.14.so.1.0 + 0x11aa1c)
                                                       #46 0x0000ffff9ff3d588 _PyFunction_Vectorcall (libpython3.14.so.1.0 + 0x15d588)
                                                       #47 0x0000ffff916fb700 _pygi_closure_handle (_gi.cpython-314-aarch64-linux-gnu.so + 0x2b700)
                                                       #48 0x0000ffff9144941c ffi_closure_SYSV_inner (libffi.so.8 + 0x941c)
                                                       #49 0x0000ffff9144c30c ffi_closure_SYSV (libffi.so.8 + 0xc30c)
                                                       #50 0x0000ffff9148ddf4 g_type_class_meta_marshalv (libgobject-2.0.so.0 + 0xddf4)
                                                       #51 0x0000ffff914b27ac signal_emit_valist_unlocked (libgobject-2.0.so.0 + 0x327ac)
                                                       #52 0x0000ffff914b292c g_signal_emit_valist (libgobject-2.0.so.0 + 0x3292c)
                                                       #53 0x0000ffff914b29d8 g_signal_emit (libgobject-2.0.so.0 + 0x329d8)
                                                       #54 0x0000ffff8f9eb0a0 g_application_activate (libgio-2.0.so.0 + 0xeb0a0)
                                                       #55 0x0000ffff9144c064 ffi_call_SYSV (libffi.so.8 + 0xc064)
                                                       #56 0x0000ffff914468cc ffi_call_int (libffi.so.8 + 0x68cc)
                                                       #57 0x0000ffff917070f0 pygi_invoke_c_callable (_gi.cpython-314-aarch64-linux-gnu.so + 0x370f0)
                                                       #58 0x0000ffff91704ff4 pygi_callable_info_invoke (_gi.cpython-314-aarch64-linux-gnu.so + 0x34ff4)
                                                       #59 0x0000ffff9fedf044 PyObject_Vectorcall (libpython3.14.so.1.0 + 0xff044)
                                                       #60 0x0000ffff9fefaa1c _PyEval_EvalFrameDefault (libpython3.14.so.1.0 + 0x11aa1c)
                                                       #61 0x0000ffff9ff3d588 _PyFunction_Vectorcall (libpython3.14.so.1.0 + 0x15d588)
                                                       #62 0x0000ffff916fb700 _pygi_closure_handle (_gi.cpython-314-aarch64-linux-gnu.so + 0x2b700)
                                                       #63 0x0000ffff9144941c ffi_closure_SYSV_inner (libffi.so.8 + 0x941c)

Comment 4 Florian Weimer 2025-09-08 07:20:34 UTC
I don't have access to an aarch64 graphical desktop. I don't see those crashes with kernel-core-6.17.0-0.rc3.31.fc43.aarch64 and glibc-2.42-4.fc43.aarch64, after upgrading a Fedora 42 installation to Fedora 43 (on an AWS c8g instance).

However, I can confirm that the Fedora 43 Cloud AMI does not boot on c8g AWS instances, which could be related.

I don't know how to debug this further on the glibc side. Someone else needs to look into this.

Comment 5 Jeremy Linton 2025-09-08 13:03:26 UTC
Yes, as an additional data point, the same machine runs the latest kernels/etc in f42 just fine.

Comment 6 Lukas Ruzicka 2025-09-08 17:32:55 UTC
Discussed at the 2025-09-08 (blocker / freeze exception) review meeting:

This is a direct violation of the final criterion: "There must be no SELinux denial notifications or crash notifications upon booting or during installation from a release-blocking live image, or at the first login after a default installation of a release-blocking desktop."

https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2025-09-08/f43-blocker-review.2025-09-08-16.00.txt

Comment 7 Jeremy Linton 2025-09-08 19:39:51 UTC
What I didn't understand is that glycin is carrying its own secomp list for feeding into bwrap, it seems sandbox.rs needs to be updated to add "uname" to the ALLOWED_SYSCALLS list.

Comment 8 Fabio Valentini 2025-09-08 21:45:26 UTC
(In reply to Jeremy Linton from comment #7)
> What I didn't understand is that glycin is carrying its own secomp list for
> feeding into bwrap, it seems sandbox.rs needs to be updated to add "uname"
> to the ALLOWED_SYSCALLS list.

Yeah, that's what I was referring to during the meeting.
Can you file an upstream issue for this please?

https://gitlab.gnome.org/GNOME/glycin/-/issues

I can update the package (or backport a fix) as soon as it's released / merged upstream.

Comment 9 Kamil Páral 2025-09-09 07:30:31 UTC
(In reply to Lukas Ruzicka from comment #6)
> Discussed at the 2025-09-08 (blocker / freeze exception) review meeting:
> 
> This is a direct violation of the final criterion: "There must be no SELinux
> denial notifications or crash notifications upon booting or during
> installation from a release-blocking live image, or at the first login after
> a default installation of a release-blocking desktop."
> 
> https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-
> org/2025-09-08/f43-blocker-review.2025-09-08-16.00.txt

This is an error, Lukas meant to update a different bug. Reverting the fields. If you want to propose this as a blocker/FE, feel free to do so through https://qa.fedoraproject.org/blockerbugs/ .

Comment 11 Fedora Blocker Bugs Application 2025-09-09 14:21:22 UTC
Proposed as a Blocker and Freeze Exception for 43-final by Fedora user jlinton using the blocker tracking app because:

 This bug violates a number of the release criteria, from the crash itself, artwork violation, to the reduction in major functionality when icons are not painted properly.

Comment 12 Adam Williamson 2025-09-09 16:57:13 UTC
Seems like it makes more sense for this to be proposed as a Beta FE than Final? I'll adjust it.

Comment 13 Fabio Valentini 2025-09-10 14:32:20 UTC
glycin is already tangled up in the pretty huge GNOME 49.rc mega-update, which *already* has an accepted freeze exception.

Honestly I would like to push that large update sooner than later, instead of pushing more and more changes into it just because they're all tangled together.

Merging the seccomp filter changes into glycin should be straightforward though, either by pulling in the next upstream release or by backporting a single-line change.

Comment 14 Adam Williamson 2025-09-10 15:21:00 UTC
The megaupdate wasn't pushed yet because it still had problems - see https://bodhi.fedoraproject.org/updates/FEDORA-2025-7e109c4976#comment-4295564 and later. The openh264 / i686 thing was only fixed late yesterday. mcatanzaro is still editing the update now to resolve more problems.

Comment 15 Fabio Valentini 2025-09-10 15:35:35 UTC
True, but I can't *un*tangle the glycin fix from the GNOME 49.rc update, either.

Comment 16 Florian Weimer 2025-09-10 17:58:31 UTC
I can change glibc not to make the problematic uname system call if that helps. At least temporarily. Maybe it's time to drop it from upstream, too, but that's a longer discussion.

Comment 17 Fabio Valentini 2025-09-10 20:51:04 UTC
I don't think this is necessary. Updating the seccomp filter list is just a one-line change and a package rebuild.

Comment 18 Adam Williamson 2025-09-12 06:18:57 UTC
The megaupdate is pushed now, so this can go as a follow-up I guess.

Comment 19 Fabio Valentini 2025-09-12 09:49:01 UTC
Yes, I'll deal with this today.

Comment 20 Fedora Update System 2025-09-12 21:44:25 UTC
FEDORA-2025-6531384ae3 (glycin-2.0~rc-4.fc43 and rust-glycin-3.0.0~rc-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-6531384ae3

Comment 21 Fedora Update System 2025-09-13 03:49:57 UTC
FEDORA-2025-6531384ae3 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-6531384ae3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-6531384ae3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 22 Lukas Ruzicka 2025-09-15 19:05:30 UTC
Discussed at the 2025-09-15 (blocker / freeze exception) review meeting:

The decision on whether this will impact enough hardware to be deemed a blocker is complex. However, in practical terms, it should be closed relatively soon once the update becomes stable, thus allowing us to avoid spending unnecessary time on it.

https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2025-09-15/f43-blocker-review.2025-09-15-16.00.txt

Comment 23 Fedora Update System 2025-09-17 01:41:36 UTC
FEDORA-2025-8762c401e0 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-8762c401e0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-8762c401e0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 24 plumlis 2025-09-18 08:28:16 UTC
It seems upstream just fixed this issue?
https://gitlab.gnome.org/GNOME/glycin/-/commit/28005a815e8e6f8869006e5481fd8d77006ec8d1

Comment 25 Fabio Valentini 2025-09-18 18:46:14 UTC
(In reply to plumlis from comment #24)
> It seems upstream just fixed this issue?
> https://gitlab.gnome.org/GNOME/glycin/-/commit/
> 28005a815e8e6f8869006e5481fd8d77006ec8d1

This is a fix for a different issue, not the one reported in this bug.

Comment 26 Fedora Update System 2025-09-19 01:18:55 UTC
FEDORA-2025-8762c401e0 (glycin-2.0.0-1.fc43, loupe-49.0-1.fc43, and 12 more) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.