gnome-settings-daemon crashed with SIGSEGV in g_unix_mount_get_mount_path()

Bug #419354 reported by ~TraydenT~
46
This bug affects 6 people
Affects Status Importance Assigned to Milestone
gnome-settings-daemon (Ubuntu)
Fix Released
Medium
Chris Coulson
Karmic
Fix Released
Medium
Chris Coulson

Bug Description

Binary package hint: gnome-settings-daemon

Just after update to karmic.
Discovered a SMART error on System HD. System on LVM.

ProblemType: Crash
Architecture: amd64
Date: Wed Aug 26 19:30:38 2009
DistroRelease: Ubuntu 9.10
ExecutablePath: /usr/lib/gnome-settings-daemon/gnome-settings-daemon
LiveMediaBuild: Ubuntu 9.04 "Jaunty Jackalope" - Release amd64 (20090420.1)
Package: gnome-settings-daemon 2.27.90-0ubuntu1
ProcCmdline: /usr/lib/gnome-settings-daemon/gnome-settings-daemon
ProcEnviron:
 LANG=fr_FR.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-7.27-generic
SegvAnalysis:
 Segfault happened at: 0x7f8fff15e749 <g_unix_mount_get_mount_path+9>: mov (%rdi),%rax
 PC (0x7f8fff15e749) ok
 source "(%rdi)" (0xab00000132) not located in a known VMA region (needed readable region)!
 destination "%rax" ok
SegvReason: reading unknown VMA
Signal: 11
SourcePackage: gnome-settings-daemon
StacktraceTop:
 g_unix_mount_get_mount_path ()
 ?? ()
 ?? () from /usr/lib/libglib-2.0.so.0
 g_main_context_dispatch ()
 ?? () from /usr/lib/libglib-2.0.so.0
Title: gnome-settings-daemon crashed with SIGSEGV in g_unix_mount_get_mount_path()
Uname: Linux 2.6.31-7-generic x86_64
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

*** SRU stuff ***

The patch is located here: http://launchpadlibrarian.net/35063102/gnome-settings-daemon_2.28.1-0ubuntu2.debdiff

[Impact of bug]
gnome-settings-daemon will crash if you the volume is unmouned whilst a warning is displayed on screen, and then you click the "Examine" button.

[Description of change]
The change makes a copy of the path string returned from g_unix_mount_get_mount_path() before calling gtk_dialog_run(). The saved string is used when gtk_dialog_run() returns, rather than calling g_unix_mount_get_mount_path() on a GUnixMountEntry which might have been free'd if the volume was unmounted whilst in the main loop.

Care is taken to make sure that the copy of the string is not leaked

This will mean that baobab will open to an empty mount path if the user presses "Examine" on a volume that was just unmounted. Ideally, the low-disk space warning dialog will just disappear if the volume is unmounted whilst the warning is on screen, but a patch to implement this would be much more intrusive (and is something I will pursue separately upstream, but would not really be suitable for a SRU). This patch just stops gnome-settings-daemon from crashing.

[Test case]
To test, you need to trigger the low-disk space warning on a mount that is listed in /etc/fstab, and can be unmounted without affecting the rest of the system. To artificially trigger the low disk-space warning, adjust the thresholds in /apps/gnome_settings_daemon/housekeeping.

Test 2.28.1-0ubuntu1 and 2.28.1-0ubuntu2 in turn.

When the low disk-space warning for the particular mount is displayed on screen:
1) Unmount the volume
2) Press the "Examine" button.

With the old version, gnome-settings-daemon will crash at step 2. With the new version of gnome-settings-daemon, baobab will open successfully (albeit, pointing to a now empty folder)

[Regression potential]
None - the code change is fairly minimal and self-contained.

Revision history for this message
~TraydenT~ (traydent) wrote :
Revision history for this message
Apport retracing service (apport) wrote : Stacktrace.txt (retraced)

StacktraceTop:IA__g_unix_mount_get_mount_path (mount_entry=0xab00000132)
ldsm_check_all_mounts (data=<value optimized out>)
g_timeout_dispatch (source=0x700b50, callback=0x2,
IA__g_main_context_dispatch (context=0x658420)
g_main_context_iterate (context=0x658420,

Revision history for this message
Apport retracing service (apport) wrote : ThreadStacktrace.txt (retraced)
Changed in gnome-settings-daemon (Ubuntu):
importance: Undecided → Medium
tags: removed: need-amd64-retrace
visibility: private → public
Revision history for this message
Chris Coulson (chrisccoulson) wrote :

Hmmm, how did you trigger this? Did you get a warning about low disk space, and unmount the drive whilst the warning was there?

Changed in gnome-settings-daemon (Ubuntu):
status: New → Incomplete
Revision history for this message
Chris Coulson (chrisccoulson) wrote :

Ok, I can see how this crash can happen if a warning is displayed, then you unmount the volume, and then click the "Examine" button after unmounting it.

Changed in gnome-settings-daemon (Ubuntu):
status: Incomplete → Confirmed
Revision history for this message
~TraydenT~ (traydent) wrote :

I don't remember exactly, but the apport crash notice showed up at startup, without doing anything …

Changed in gnome-settings-daemon (Ubuntu):
assignee: nobody → Chris Coulson (chrisccoulson)
status: Confirmed → In Progress
Revision history for this message
watkin5 (robert-watkin5) wrote :

After an update I got a warning due to being low on disk space.
I clicked the examine button, and then got this crash.

Revision history for this message
MarkJBobak (mark-bobak) wrote :

Same here.

description: updated
Changed in gnome-settings-daemon (Ubuntu):
status: In Progress → Fix Committed
Changed in gnome-settings-daemon (Ubuntu Karmic):
assignee: nobody → Chris Coulson (chrisccoulson)
importance: Undecided → Medium
status: New → Fix Committed
Revision history for this message
Martin Pitt (pitti) wrote : Please test proposed package

Accepted gnome-settings-daemon into karmic-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

tags: added: verification-needed
Revision history for this message
Martin Pitt (pitti) wrote :

I went through the test case with the -proposed version and confirm that it does not crash any more.

tags: added: verification-done
removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gnome-settings-daemon - 2.28.1-0ubuntu2

---------------
gnome-settings-daemon (2.28.1-0ubuntu2) karmic-proposed; urgency=low

  * debian/patches/71_fix_ldsm_notification_crash.patch:
    - Don't access free'd memory if a volume is unmounted whilst the
      dialog is displayed (LP: #419354)
  * debian/patches/91_gsd_locate_pointer_path_fix.patch:
    - Upstream GIT change to honour libexecdir when spawning
      gsd-locate-pointer (LP: #441642)

 -- Chris Coulson <email address hidden> Wed, 04 Nov 2009 00:13:34 +0000

Changed in gnome-settings-daemon (Ubuntu Karmic):
status: Fix Committed → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote :

Copied to lucid.

Changed in gnome-settings-daemon (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.