nautilus segfaults in compare_by_display_name()

[[e-mail]]

[ Description ]

If a samba share has an empty name, nautilus will crash when you browse to the listing of shares.

[ QA ]

- Be on a setup (or create one) where you tickle https://bugzilla.samba.org/show_bug.cgi?id=10896
- Open nautilus, hit ctrl-l, browse to smb://workgroups
- Nautilus crashes (or doesn't crash with the fix)

[ Fix ]

Fix nautilus_file_peek_display_name () to not return NULL ever, as some of its
callers weren't prepared to handle this.

[ Regression potential ]

Should only change crashes to non-crashes, but maybe a caller I missed handled NULL properly and now will behave weirdly. I grepped the source and didn't find one, though.

[ Original release ]

samba, Ubuntu 14.04 (alpha)

ProblemType: Crash
DistroRelease: Ubuntu 14.04
Package: nautilus 1:3.10.1-0ubuntu4
ProcVersionSignature: Ubuntu 3.13.0-8.28-generic 3.13.2
Uname: Linux 3.13.0-8-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.13.2-0ubuntu4
Architecture: amd64
CurrentDesktop: Unity
Date: Sun Feb 16 22:44:08 2014
ExecutablePath: /usr/bin/nautilus
GsettingsChanges: b'org.gnome.nautilus.list-view' b'default-column-order' b"['name', 'size', 'type', 'date_modified', 'date_accessed', 'owner', 'group', 'permissions', 'mime_type', 'where']"
InstallationDate: Installed on 2014-02-15 (1 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Alpha amd64 (20140214)
ProcCmdline: nautilus -n
SegvAnalysis:
 Segfault happened at: 0x4bef0a: movzbl (%r12),%ecx
 PC (0x004bef0a) ok
 source "(%r12)" (0x00000000) not located in a known VMA region (needed readable region)!
 destination "%ecx" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: nautilus
StacktraceTop:
 ?? ()
 ?? ()
 ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
 ?? ()
 ?? ()
Title: nautilus crashed with SIGSEGV
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo

[Apport retracing service (apport)]

StacktraceTop:
 compare_by_display_name (file_1=0x26ddfa0, file_2=0x28c1490) at nautilus-file.c:2907
 nautilus_file_compare_for_sort (file_1=0x26ddfa0, file_2=0x28c1490, sort_type=<optimized out>, directories_first=<optimized out>, reversed=0) at nautilus-file.c:3184
 g_list_sort_merge (user_data=0x25fa9f0, compare_func=0x4621b0 <compare_files_cover>, l2=0x21c2540, l1=0x2198360) at /build/buildd/glib2.0-2.39.4/./glib/glist.c:1125
 g_list_sort_real (list=list@entry=0x2198360, compare_func=compare_func@entry=0x4621b0 <compare_files_cover>, user_data=user_data@entry=0x25fa9f0) at /build/buildd/glib2.0-2.39.4/./glib/glist.c:1171
 g_list_sort_with_data (list=list@entry=0x2198360, compare_func=compare_func@entry=0x4621b0 <compare_files_cover>, user_data=user_data@entry=0x25fa9f0) at /build/buildd/glib2.0-2.39.4/./glib/glist.c:1241

[Doug Brown (macg3)]

I'm also running into a segfault in compare_by_display_name(). A little more info on a use case that can cause the issue:

I'm trying to browse the Windows network in nautilus. I go to Places->Network and go into the Windows Network directory. All the workgroups on the local network appear, and I try to enter one of them. At this point nautilus hangs for a while and/or crashes in compare_by_display_name().

If I run smbtree -N in the terminal, I see a bunch of servers and clients in the offending workgroup. Normal Ubuntu clients (not set up for serving) tend to appear as well. If one of the Ubuntu clients has a hostname that is too long to be automatically converted to a NetBIOS name, it shows up in the smbtree -N output with a blank NetBIOS name. Example:

\\ really-long-name-of-computer server (Samba, Ubuntu)

This blank name is what causes this bug in nautilus. If I go into the offending machines and give them a custom short NetBIOS name in /etc/samba/smb.conf, and restart nmbd on them, the problem goes away and I can browse the Windows network just fine. Perhaps compare_by_display_name() is not handling a NULL or empty string correctly? Either way, it looks like nmbd is auto-generating an empty name, so I would argue that it has a bug that is indirectly causing this bug at the same time.

[Sebastien Bacher (seb128)]

@Doug, thanks, that's an useful comment. That function indeed seems to not handle null cases correctly, the upstream GNOME bug seems to indicator a similar case

[Sebastien Bacher (seb128)]

The empty name seems to be a samba bug resolve upstream, see https://bugzilla.samba.org/show_bug.cgi?id=10896

[Iain Lane (laney)]

I uploaded this to wily and trusty, please test when asked - we had some trouble reproducing reliably.

[Chris J Arges (arges)]

Hello <email address hidden>, or anyone else affected,

Accepted nautilus into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/nautilus/1:3.10.1-0ubuntu9.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Ubuntu Foundations Team Bug Bot (crichton)]

As a part of the Stable Release Updates quality process a search for Launchpad bug reports using the version of nautilus from wily-proposed was performed and bug 1512117 was found. Please investigate this bug report to ensure that a regression will not be created by this SRU. In the event that this is not a regression remove the "verification-failed" tag from this bug report and add the tag "bot-stop-nagging" to bug 1512117 (not this bug). Thanks!

[Iain Lane (laney)]

That bug is not caused by this

[Iain Lane (laney)]

I didn't reproduce this again since I made the fix, but I checked e.u.c and there don't appear to be any regressions caused by this bug. I want to clear the way for another SRU, so v-done.

[Launchpad Janitor (janitor)]

This bug was fixed in the package nautilus - 1:3.10.1-0ubuntu9.10

---------------
nautilus (1:3.10.1-0ubuntu9.10) trusty; urgency=medium

  * debian/patches/0001-Respect-gtk-dialogs-use-header-for-all-dialogs.patch:
    Fix a function to not return NULL, as its callers didn't always handle
    this and sometimes would crash. For example there was a case where samba
    would give us empty display names if a share name overflowed the maximum
    length allowed, and this tripped us up and crashed nautilus. (LP:
    #1280867)

 -- Iain Lane <email address hidden> Thu, 22 Oct 2015 11:23:04 +0100

[Chris J Arges (arges)]

The verification of the Stable Release Update for nautilus has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package nautilus - 1:3.14.2-0ubuntu13

---------------
nautilus (1:3.14.2-0ubuntu13) wily; urgency=medium

  * debian/patches/0001-Respect-gtk-dialogs-use-header-for-all-dialogs.patch:
    Fix a function to not return NULL, as its callers didn't always handle
    this and sometimes would crash. For example there was a case where samba
    would give us empty display names if a share name overflowed the maximum
    length allowed, and this tripped us up and crashed nautilus. (LP:
    #1280867)

 -- Iain Lane <email address hidden> Thu, 22 Oct 2015 11:03:27 +0100

[Chris J Arges (arges)]

Is there a fix for Vivid available/necessary as well?

[Launchpad Janitor (janitor)]

This bug was fixed in the package nautilus - 1:3.14.2-0ubuntu14

---------------
nautilus (1:3.14.2-0ubuntu14) xenial; urgency=medium

  * debian/patches/ubuntu_revert_no_wallpaper.patch:
    - update to listen to scale factor changes (lp: #1480217)

 -- Lars Uebernickel <email address hidden> Mon, 02 Nov 2015 14:22:11 +0000