cupsd crashed with SIGSEGV in malloc_consolidate()

[Cliff Carson]

Crash occurred during apt-get upgrade of 12.10

ProblemType: Crash
DistroRelease: Ubuntu 12.10
Package: cups 1.6.1-0ubuntu5
ProcVersionSignature: Ubuntu 3.5.0-11.11-generic 3.5.2
Uname: Linux 3.5.0-11-generic x86_64
ApportVersion: 2.5.1-0ubuntu7
Architecture: amd64
CrashCounter: 1
Date: Sat Sep 8 11:15:46 2012
ExecutablePath: /usr/sbin/cupsd
InstallationMedia: Ubuntu 12.10 "Quantal Quetzal" - Alpha amd64 (20120822)
Lpstat: device for HP_Photosmart_1210: hp:/usb/Photosmart_C4100_series?serial=MY73EH528Q04J7
MachineType: Si G41M-P33
Papersize: letter
PpdFiles: HP_Photosmart_1210: HP Photosmart c4100 Series, hpcups 3.12.6
ProcAttrCurrent: /usr/sbin/cupsd (enforce)
ProcCmdline: BOOT_IMAGE=/boot/vmlinuz-3.5.0-11-generic root=UUID=9a19df88-bb2b-4aac-b377-e5e6a2b54bd2 ro quiet splash vt.handoff=7
ProcEnviron:
 PATH=(custom, no user)
 TERM=linux
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.5.0-11-generic root=UUID=9a19df88-bb2b-4aac-b377-e5e6a2b54bd2 ro quiet splash vt.handoff=7
SegvAnalysis:
 Segfault happened at: 0x7f0b778c1778: mov 0x8(%r12),%r15
 PC (0x7f0b778c1778) ok
 source "0x8(%r12)" (0xfe16f2079f60) not located in a known VMA region (needed readable region)!
 destination "%r15" ok
SegvReason: reading unknown VMA
Signal: 11
SourcePackage: cups
StacktraceTop:
 ?? () from /lib/x86_64-linux-gnu/libc.so.6
 ?? () from /lib/x86_64-linux-gnu/libc.so.6
 calloc () from /lib/x86_64-linux-gnu/libc.so.6
 cupsFileOpenFd () from /usr/lib/x86_64-linux-gnu/libcups.so.2
 cupsFileOpen () from /usr/lib/x86_64-linux-gnu/libcups.so.2
Title: cupsd crashed with SIGSEGV in calloc()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

dmi.bios.date: 01/05/2010
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: V7.7
dmi.board.asset.tag: To Be Filled By O.E.M.
dmi.board.name: G41M-P33 (MS-7592)
dmi.board.vendor: MSI
dmi.board.version: 3.0
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: MSI
dmi.chassis.version: 3.0
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrV7.7:bd01/05/2010:svnSi:pnG41M-P33:pvr3.0:rvnMSI:rnG41M-P33(MS-7592):rvr3.0:cvnMSI:ct3:cvr3.0:
dmi.product.name: G41M-P33
dmi.product.version: 3.0
dmi.sys.vendor: Si
mtime.conffile..etc.cups.cupsd.conf: 2012-08-23T19:06:22.474571

[Apport retracing service (apport)]

StacktraceTop:
 malloc_consolidate (av=0x7f0b77bf9740) at malloc.c:4240
 malloc_consolidate (av=0x7f0b77bf9740) at malloc.c:4215
 _int_malloc (av=0x7f0b77bf9740, bytes=8368) at malloc.c:3532
 __libc_calloc (n=<optimized out>, n@entry=1, elem_size=<optimized out>, elem_size@entry=8368) at malloc.c:3274
 cupsFileOpenFd (fd=4, mode=mode@entry=0x7f0b7973a33f "r") at file.c:1220

[Till Kamppeter (till-kamppeter)]

cupsd crashed when re-loading the cupsd.conf file for a configuration change (probably on SIGHUP), simply on

fp = calloc(1, sizeof(cups_file_t))

where cups_file_t is a data structure with a size of ~8000 bytes.

This call should work when there is enough memory available and return NULL otherwise. Looks like a possible bug in libc.

[Till Kamppeter (till-kamppeter)]

Looks like the same bug as bug 868462.