mission-control-5 segfaults in tp_debug_sender_add_message_vprintf()

[Peter S]

* Impact: the telepathy service segfaults on migration sometimes

* Test Case:
- install precise, set up the accounts, save the user's home directory in a tarball or something, discard the rest of the OS, install 13.10, replace the 13.10 user's home directory with the one you saved.

- or watch https://errors.ubuntu.com/problem/1fce374e084a1f5ee6fa39de0b2d1a01aa33d7de and see if the reports stop

* Regression potential: limited, that's fixed the format strings in debug logs code

[Apport retracing service (apport)]

StacktraceTop:
 _IO_vfprintf_internal (s=s@entry=0x7fff0444f9d0, format=<optimized out>, format@entry=0x448aa8 "%s: Migrated %s to new location: deleting old copy", ap=ap@entry=0x7fff0444fb88) at vfprintf.c:1655
 __GI___vasprintf_chk (result_ptr=result_ptr@entry=0x7fff0444fb18, flags=flags@entry=1, format=0x448aa8 "%s: Migrated %s to new location: deleting old copy", args=0x7fff0444fb88) at vasprintf_chk.c:66
 vasprintf (__ap=<optimized out>, __fmt=<optimized out>, __ptr=0x7fff0444fb18) at /usr/include/x86_64-linux-gnu/bits/stdio2.h:210
 g_vasprintf (string=string@entry=0x7fff0444fb18, format=<optimized out>, args=args@entry=0x7fff0444fb88) at /build/buildd/glib2.0-2.37.6/./glib/gprintf.c:314
 g_strdup_vprintf (format=<optimized out>, args=args@entry=0x7fff0444fb88) at /build/buildd/glib2.0-2.37.6/./glib/gstrfuncs.c:517

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Sebastien Bacher (seb128)]

That's an issue frequently reported in Ubuntu 13.10 (using 5.14.1)

Stacktrace

"#0 0x00007f2b3ca15f90 in _IO_vfprintf_internal (s=s@entry=0x7fff0444f9d0, format=<optimized out>, format@entry=0x448aa8 "%s: Migrated %s to new location: deleting old copy", ap=ap@entry=0x7fff0444fb88) at vfprintf.c:1655
        len = <optimized out>
        string_malloced = <optimized out>
        step0_jumps = {0, -11263, -4214, -4124, -4027, -3937, -3826, -3532, -3116, -2815, -2692, -1937, -2239, -2139, -1766, -16687, 265, 280, 47, 2130, -15904, -28, 883, -5283, -5210, -17380, 567, -2039, -2139, -3638}
        space = 0
        is_short = 0
        use_outdigits = 0
        step1_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, -2815, -2692, -1937, -2239, -2139, -1766, -16687, 265, 280, 47, 2130, -15904, -28, 883, -5283, -5210, -17380, 567, -2039, -2139, 0}
        group = 0
        prec = -1
        step2_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -2692, -1937, -2239, -2139, -1766, -16687, 265, 280, 47, 2130, -15904, -28, 883, -5283, -5210, -17380, 567, -2039, -2139, 0}
        string = <optimized out>
        left = 0
        is_long_double = 0
        width = 0
        step3a_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -2037, 0, 0, 0, -1766, -16687, 265, 280, 47, 0, 0, 0, 0, -5283, 0, 0, 0, 0, 0, 0}
        alt = 0
        showsign = 0
        is_long = 0
        is_char = 0
        pad = 32 ' '
        step3b_jumps = {0 <repeats 11 times>, -2239, 0, 0, -1766, -16687, 265, 280, 47, 2130, -15904, -28, 883, -5283, -5210, -17380, 567, 0, 0, 0}
        step4_jumps = {0 <repeats 14 times>, -1766, -16687, 265, 280, 47, 2130, -15904, -28, 883, -5283, -5210, -17380, 567, 0, 0, 0}
        is_negative = <optimized out>
        number = <optimized out>
        base = <optimized out>
        the_arg = {pa_wchar = 0 L'\000', pa_int = 0, pa_long_int = 0, pa_long_long_int = 0, pa_u_int = 0, pa_u_long_int = 0, pa_u_long_long_int = 0, pa_double = 0, pa_long_double = 0, pa_string = 0x0, pa_wstring = 0x0, pa_pointer = 0x0, pa_user = 0x0}
        spec = 115 's'
        _buffer = {__routine = 0x0, __arg = 0x0, __canceltype = 0, __prev = 0x0}
        _avail = <optimized out>
        thousands_sep = 0x0
        grouping = 0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>
        done = 16
        f = 0x448ab6 "s to new location: deleting old copy"
        lead_str_end = 0x448aa8 "%s: Migrated %s to new location: deleting old copy"
        end_of_spec = <optimized out>
        work_buffer = '\000' <repeats 568 times>"\246, \265\230>+\177\000\000\000\000\000\000\000\000\000\000\006\000\000\000\000\000\000\000\220\371D\004\377\177\000\000\246\265\230>+\177\000\000\236\203\323\220\000\000\000\000\n\000\000\000\000\000\000\000\260\371D\004\377\177\000\000@\227\330<+\177\000\000-\000\000\000\000\000\000\000\270\371D\004\377\177\000\000,\000\000\000\000\000\000\000,\000\000\000\000\000\000\000-\000\000\000\000\000\000\000\270\371D\004\377\177\000\000,\000\000\000\000\000\000\000\260'\b\002\000\000\000\000;\000\000\000\000\000\000\000\f\237\255<+\177\000\000\000\200\255\373+\177\000\000\260'\b\002\000\000\000\000\260'\b\002\000\000\000\000\260'\b\002\000\000\000\000\260'\b\002\000\000\000\000\33...

[Simon McVittie (smcv)]

I think you might need commit cc2af09f60851 (or part of) from Bug #69542.

[Simon McVittie (smcv)]

If my guess is right, then this is probably reproducible by installing MC 5.12 (e.g. Ubuntu precise), setting up Telepathy accounts for a disposable user account, and upgrading.

As a short cut: install precise, set up the accounts, save the user's home directory in a tarball or something, discard the rest of the OS, install 13.10, replace the 13.10 user's home directory with the one you saved.

The version of MC in raring appears to be from the middle of a development branch, so I'm not going to support that version: you're on your own with that one. Depending when the faulty debug message was introduced, it might need a similar patch, or not. We do not recommend using development versions in a stable OS release. If you need features from a development branch, please ask for a stable branch sometime around your freeze time.

[Sebastien Bacher (seb128)]

> I think you might need commit cc2af09f60851 (or part of) from Bug #69542.

Thanks Simon, that seems likely indeed

> The version of MC in raring appears to be from the middle of a development
> branch, so I'm not going to support that version: you're on your own with that
> one.

https://launchpad.net/ubuntu/+source/telepathy-mission-control-5 ... you mean quantal I guess? Don't worry about that one, in practice most users stick to the current stable or current LTS, quantal is current_stable-2 which probably has a very limited set of users

I'm going to upload that fix and comment again in a few days to let you know what impact it has on reports!

[Adam Conrad (adconrad)]

Hello Peter, or anyone else affected,

Accepted telepathy-mission-control-5 into saucy-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/telepathy-mission-control-5/1:5.14.1-1ubuntu6.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Launchpad Janitor (janitor)]

This bug was fixed in the package telepathy-mission-control-5 - 1:5.14.1-1ubuntu7

---------------
telepathy-mission-control-5 (1:5.14.1-1ubuntu7) trusty; urgency=low

  * debian/patches/git_migration_debug_segfault.patch:
    - backport fix for a segfault in the config migration code (lp: #1217086)
 -- Sebastien Bacher <email address hidden> Tue, 12 Nov 2013 19:48:53 +0100

[Simon McVittie (smcv)]

(In reply to comment #3)
> > The version of MC in raring appears to be from the middle of a development
> > branch
>
> you mean quantal I guess?

Sorry, yes, I meant MC 5.13 (or any future x.odd.z version).

[Sebastien Bacher (seb128)]

There has been no report with the new version, considering the issue as resolved

[Sebastien Bacher (seb128)]

We got no report on the package version which has cc2af09f60851 backport, I think you can consider that to be indeed the fix for that issue, thanks!

[Simon McVittie (smcv)]

Probably worth backporting to 5.12, could you attach the exact patch you applied please?

[Sebastien Bacher (seb128)]

Created attachment 89405
backport to stable serie

> Probably worth backporting to 5.12, could you attach the exact patch you applied please?

Sure, I guess you meant 5.14 there? That's the patch we have been using (basically the git commit, refreshed, without the hunk which applied to code not present in that serie)

[Simon McVittie (smcv)]

(In reply to comment #7)
> Sure, I guess you meant 5.14 there?

Yes. Pushed to telepathy-mission-control-5.14 branch for the benefit of anyone else still on that version. Thanks!

Regression somewhere in the 5.13/5.14 cycle, fixed in 5.14.2 in the unlikely event that that version is ever released. Also fixed in 5.15.1 and all subsequent versions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package telepathy-mission-control-5 - 1:5.14.1-1ubuntu6.1

---------------
telepathy-mission-control-5 (1:5.14.1-1ubuntu6.1) saucy; urgency=low

  * debian/patches/git_migration_debug_segfault.patch:
    - backport fix for a segfault in the config migration code (lp: #1217086)
 -- Sebastien Bacher <email address hidden> Tue, 12 Nov 2013 19:48:53 +0100

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for telepathy-mission-control-5 has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.