libreoffice draw / impress crash if user service publishing is disabled in avahi

[Alec Warner]

[Impact]

 * Impress and Draw will not work (Crash) with Avahi enabled, but user/all publishing disabled.
 * The fix is basically some check before free, and return earlier if failing.

[Test Case]

 * Restart avahi daemon with either disable-user-service-publishing=yes or disable-publishing=yes. This will cause the crash.
 * Patch was also tested with avahi on, making sure it publishes and with avahi just to make sure a new bug was not introduced.

[Regression Potential]

 * If a regression occurs it would be avahi specific and should only affect Impress and Draw. It will be less likely to manifest in an outright crash now.
 * I was unable to test actually using a remote control. (but the avahi service was published which is the only part my fix touches.

[Other Info]
Avahi is NOT enabled in Upstream LibreOffice builds (so don't try to test them for this bug) although pushing to have source fix included in 4.2.x and 4.3.x anyways
Master Upstream fix (TB4.4): http://cgit.freedesktop.org/libreoffice/core/commit/?id=3c57701cf0a169bd8d1893d1b2271d48b8072147
Proposed 4.3: https://gerrit.libreoffice.org/#/c/10816/
Proposed 4.2: http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-4-2&id=8de2e9b4bc53e6c097897142bad223c100d36292

Both loimpress and lodraw fail to start with an error message related to avahi:

$ loimpress
avahi_entry_group_new() failed: Not permitted
soffice.bin: client.c:626: avahi_client_free: Assertion `client' failed.

$ ps ax | grep avahi
 7617 pts/0 S+ 0:00 grep --color=auto avahi
21356 ? S 0:07 avahi-daemon: running [hostname.local]
21380 ? S 0:00 avahi-daemon: chroot helper

This is the backtrace of the crash:

$ cat gdbtrace.log
warning: Currently logging to gdbtrace.log. Turn the logging off and on to make the new setting effective.
warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available.

Program received signal SIGABRT, Aborted.
0x00007ffff41f2f79 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
#0 0x00007ffff41f2f79 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007ffff41f6388 in __GI_abort () at abort.c:89
#2 0x00007ffff41ebe36 in __assert_fail_base (fmt=0x7ffff433d718 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7fffe95b6919 "client", file=file@entry=0x7fffe95b6910 "client.c", line=line@entry=626, function=function@entry=0x7fffe95b6fe0 "avahi_client_free") at assert.c:92
#3 0x00007ffff41ebee2 in __GI___assert_fail (assertion=0x7fffe95b6919 "client", file=0x7fffe95b6910 "client.c", line=626, function=0x7fffe95b6fe0 "avahi_client_free") at assert.c:101
#4 0x00007fffe95af06b in avahi_client_free () from /usr/lib/x86_64-linux-gnu/libavahi-client.so.3
#5 0x00007fffbac7c40c in ?? () from /usr/lib/libreoffice/program/../program/libsdlo.so
#6 0x00007fffbac7c678 in ?? () from /usr/lib/libreoffice/program/../program/libsdlo.so
#7 0x00007fffe95aec2c in ?? () from /usr/lib/x86_64-linux-gnu/libavahi-client.so.3
#8 0x00007fffe95af3aa in avahi_client_new () from /usr/lib/x86_64-linux-gnu/libavahi-client.so.3
#9 0x00007fffbac7c8a5 in ?? () from /usr/lib/libreoffice/program/../program/libsdlo.so
#10 0x00007fffbac7d195 in ?? () from /usr/lib/libreoffice/program/../program/libsdlo.so
#11 0x00007fffbac7d30b in ?? () from /usr/lib/libreoffice/program/../program/libsdlo.so
#12 0x00007fffbac74756 in ?? () from /usr/lib/libreoffice/program/../program/libsdlo.so
#13 0x00007fffbaa12b9b in ?? () from /usr/lib/libreoffice/program/../program/libsdlo.so
#14 0x00007fffbab83bc0 in sd_component_getFactory () from /usr/lib/libreoffice/program/../program/libsdlo.so

This is on trusty.

libreoffice-impress 1:4.2.3~rc3-0ubuntu

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Margarita Manterola (marga-9)]

Hi, I found another bug with the same error message related to avahi:
  https://bugs.launchpad.net/ubuntu/+source/ekiga/+bug/50708

I commented out the line that says "disable-user-service-publishing=yes" in /etc/avahi/avahi-daemon.conf, and loimpress opens without problems.

I know that disabling user service publishing is not the default behavior, but it shouldn't crash libre office if it's set.

[penalvch (penalvch)]

Alec Warner, thank you for reporting this and helping make Ubuntu better. However, your crash report is missing. Please follow these instructions to have apport report a new bug about your crash that can be dealt with by the automatic retracer. First, execute at a terminal:
cd /var/crash && sudo rm * ; sudo apt-get update && sudo apt-get -y upgrade && sudo apt-get -y install libreoffice-dbg uno-libs3-dbg ure-dbg && sudo service apport start force_start=1

If you are running the Ubuntu Stable Release you might need to enable apport in /etc/default/apport and restart.

Now reproduce the crash, then open your file manager, navigate to your /var/crash directory and open the crash report you wish to submit.
If this fails you will have to open a terminal and file your report with 'ubuntu-bug /var/crash/_my_crash_report.crash' where _my_crash_report.crash is the crash you would like to report. If you get an error that you aren't allowed to access this report you will have to file it with 'sudo ubuntu-bug /var/crash/_my_crash_report.crash'. If you run the command against the crash report and a window pops up asking you to report this, but then never opens a new report, you would be affected by https://bugs.launchpad.net/ubuntu/+source/apport/+bug/994921 . In order to WORKAROUND this, one would need to open the following file via a command line:
gksudo gedit /etc/apport/crashdb.conf

and comment out the line:
'problem_types': ['Bug', 'Package'],

by changing it to:
# 'problem_types': ['Bug', 'Package'],

Save, close, and try to file the crash report again via:
ubuntu-bug /var/crash/_my_crash_report.crash

Please follow https://wiki.ubuntu.com/LibreOfficeBugWrangling when you file this crash report so the necessary information is provided.

I'm closing this bug report since the process outlined above will automatically open a new bug report which can then dealt with more efficiently.

Thank you for your understanding.

Helpful bug reporting tips:
https://wiki.ubuntu.com/ReportingBugs

[Alec Warner (antarus)]

Security policy prevents me from submitting crash reports which is why I stuck with the gdb backtrace.

-A

[penalvch (penalvch)]

Alec Warner, would running Ubuntu in a live environment allow one to adhere to security policy, and submit the crash?

[Alec Warner (antarus)]

On Sat, May 17, 2014 at 10:48 AM, Christopher M. Penalver <
<email address hidden>> wrote:

> Alec Warner, would running Ubuntu in a live environment allow one to
> adhere to security policy, and submit the crash?
>

Yeah i'll do that next week.

-A

>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1319941
>
> Title:
> libreoffice draw / impress crash if user service publishing is
> disabled in avahi
>
> Status in “libreoffice” package in Ubuntu:
> Invalid
>
> Bug description:
> Both loimpress and lodraw fail to start with an error message related
> to avahi:
>
> $ loimpress
> avahi_entry_group_new() failed: Not permitted
> soffice.bin: client.c:626: avahi_client_free: Assertion `client' failed.
>
> $ ps ax | grep avahi
> 7617 pts/0 S+ 0:00 grep --color=auto avahi
> 21356 ? S 0:07 avahi-daemon: running [hostname.local]
> 21380 ? S 0:00 avahi-daemon: chroot helper
>
> This is the backtrace of the crash:
>
> $ cat gdbtrace.log
> warning: Currently logging to gdbtrace.log. Turn the logging off and on
> to make the new setting effective.
> warning: Unable to find libthread_db matching inferior's thread library,
> thread debugging will not be available.
>
> Program received signal SIGABRT, Aborted.
> 0x00007ffff41f2f79 in __GI_raise (sig=sig@entry=6) at
> ../nptl/sysdeps/unix/sysv/linux/raise.c:56
> 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
> #0 0x00007ffff41f2f79 in __GI_raise (sig=sig@entry=6) at
> ../nptl/sysdeps/unix/sysv/linux/raise.c:56
> #1 0x00007ffff41f6388 in __GI_abort () at abort.c:89
> #2 0x00007ffff41ebe36 in __assert_fail_base (fmt=0x7ffff433d718
> "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7fffe95b6919
> "client", file=file@entry=0x7fffe95b6910 "client.c", line=line@entry=626,
> function=function@entry=0x7fffe95b6fe0 "avahi_client_free") at assert.c:92
> #3 0x00007ffff41ebee2 in __GI___assert_fail (assertion=0x7fffe95b6919
> "client", file=0x7fffe95b6910 "client.c", line=626, function=0x7fffe95b6fe0
> "avahi_client_free") at assert.c:101
> #4 0x00007fffe95af06b in avahi_client_free () from
> /usr/lib/x86_64-linux-gnu/libavahi-client.so.3
> #5 0x00007fffbac7c40c in ?? () from
> /usr/lib/libreoffice/program/../program/libsdlo.so
> #6 0x00007fffbac7c678 in ?? () from
> /usr/lib/libreoffice/program/../program/libsdlo.so
> #7 0x00007fffe95aec2c in ?? () from
> /usr/lib/x86_64-linux-gnu/libavahi-client.so.3
> #8 0x00007fffe95af3aa in avahi_client_new () from
> /usr/lib/x86_64-linux-gnu/libavahi-client.so.3
> #9 0x00007fffbac7c8a5 in ?? () from
> /usr/lib/libreoffice/program/../program/libsdlo.so
> #10 0x00007fffbac7d195 in ?? () from
> /usr/lib/libreoffice/program/../program/libsdlo.so
> #11 0x00007fffbac7d30b in ?? () from
> /usr/lib/libreoffice/program/../program/libsdlo.so
> #12 0x00007fffbac74756 in ?? () from
> /usr/lib/libreoffice/program/../program/libsdlo.so
> #13 0x00007fffbaa12b9b in ?? () from
> /usr/lib/libreoffice/program/../program/libsdlo.so
> #14 0x00007fffbab83bc0 ...

[Sven Mueller (smu-u)]

So I was able to reproduce on a freshly installed Ubuntu Trusty, It seems whoopsie on said machine has trouble uploading the crash data, so re-attaching the .crash file here.

[Sven Mueller (smu-u)]

Just as a note: Procedure to reproduce:

Locate the line
#disable-user-service-publishing=no
in /etc/avahi/avahi-daemon.conf and change it to
disable-user-service-publishing=yes

restart the avahi-daemon service (It might read the config file upon change, but I didn't check)

Try to start Impress or Draw from Libreoffice -> Crash.

To be honest, I don't understand the insistence on a crash dump when the reproduction has been well described and is 100% reproducible.

[penalvch (penalvch)]

Sven Mueller, please do not manually attach crash reports. Instead, follow the instructions noted in https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/1319941/comments/3 .

[Sven Mueller (smu-u)]

Christopher M. Penalver: Please read my report:

1) reporting it like you suggested doesn't work. I can't say why except that this shows up in syslog:
Jun 11 04:54:34 ubuntu whoopsie[1323]: Sent; server replied with: No error
Jun 11 04:54:34 ubuntu whoopsie[1323]: Response code: 503
Jun 11 04:54:34 ubuntu whoopsie[1323]: Server replied with:
Jun 11 04:54:34 ubuntu whoopsie[1323]: <html><body><h1>503 Service Unavailable</h1>#012No server is available to handle this request.#012</body></html>#012
Jun 11 04:54:34 ubuntu whoopsie[1323]: online

2) Instead of insisting on a crash report, it would have taken you at most 2 minutes to reproduce the crash locally, given the reproduction descriptions shown at least twice in this bug.

[Sven Mueller (smu-u)]

Anyway, to add some of the information that is requested on the libreoffice bug mangling page:

$ apt-cache policy libreoffice-impress libreoffice-draw
libreoffice-impress:
  Installed: 1:4.2.3~rc3-0ubuntu2
  Candidate: 1:4.2.3~rc3-0ubuntu2
  Version table:
 *** 1:4.2.3~rc3-0ubuntu2 0
       1001 http://de.archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages
        100 /var/lib/dpkg/status
libreoffice-draw:
  Installed: 1:4.2.3~rc3-0ubuntu2
  Candidate: 1:4.2.3~rc3-0ubuntu2
  Version table:
 *** 1:4.2.3~rc3-0ubuntu2 0
       1001 http://de.archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages
        100 /var/lib/dpkg/status

$ lsb_release -rd
Description: Ubuntu 14.04 LTS
Release: 14.04

For the record, commenting the "problem_types" line in /etc/apport/crashdb.conf as recommended in #3 only changed the whoopsie error, but didn't resolve it:
Jun 11 05:54:37 ubuntu whoopsie[17849]: Parsing /var/crash/_usr_lib_libreoffice_program_soffice.bin.1000.crash.
Jun 11 05:54:37 ubuntu whoopsie[17849]: Uploading /var/crash/_usr_lib_libreoffice_program_soffice.bin.1000.crash.
Jun 11 05:55:51 ubuntu whoopsie[17849]: Sent; server replied with: No error
Jun 11 05:55:51 ubuntu whoopsie[17849]: Response code: 502
Jun 11 05:55:51 ubuntu whoopsie[17849]: Server replied with:
Jun 11 05:55:51 ubuntu whoopsie[17849]: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">#012<html><head>#012<title>502 Proxy Error</title>#012</head><body>#012<h1>Proxy Error</h1>#012<p>The proxy server received an invalid#015#012response from an upstream server.<br />#015#012The proxy server could not handle the request <em><a href="/c1a0517bca4faad8f208eac57ffa98b56f24b5e89bb322101da7a9503c5e79f67619be5c62dbeb85c2d8cbf84fefd6e597f9268d5bc8702866ee9a957fef5131">POST&nbsp;/c1a0517bca4faad8f208eac57ffa98b56f24b5e89bb322101da7a9503c5e79f67619be5c62dbeb85c2d8cbf84fefd6e597f9268d5bc8702866ee9a957fef5131</a></em>.<p>#012Reason: <strong>Error reading from remote server</strong></p></p>#012<hr>#012<address>Apache/2.2.22 (Ubuntu) Server at daisy.ubuntu.com Port 443</address>#012</body></html>#012

[Sven Mueller (smu-u)]

For some reason, the upload finally worked. See the bug marked as a duplicate of this one for the crash report.

[Sven Mueller (smu-u)]

So the bug I uploaded the crash report as is https://bugs.launchpad.net/bugs/1328908
However, Christopher seems to think it is not a duplicate of this bug, while it is an exact reproduction of the case described here. Without explanation, he removes the "marked as duplicate" from the other bug repeatedly.

[Philipp Kern (pkern)]

The other report might have a shorter log without bug reporting meta noise, but one actually contains the repro steps. The full retrace for debugging purposes can be found in bug #1328908. Let's resurrect this one from the invalid and mark it as confirmed. Thanks.

[Kees Cook (kees)]

Any progress on this?

[Rene Engelhard (rene-debian)]

From https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=755309:

--- snip ---
I have Avahi service publishing disabled with the following setting in
/etc/avahi/avahi-daemon.conf:

  [publish]
  disable-publishing=yes

Attempting to run either LibreOffice Draw or LibreOffice Impress fails, giving
an error message like this:

  $ soffice --draw
  Adding service 'pangloss'
  Failed to add _impressremote._tcp service: Not permitted
  soffice.bin: client.c:626: avahi_client_free: Assertion `client' failed.

With service publishing enabled, these applications start up normally.

[...]

Disabling service publishing is IMHO a reasonable security measure which is
suggested in the avahi-daemon.conf man page; I use Avahi mDNS as a client for
printer discovery but don't need to broadcast services to the net. I think
LibreOffice should be able to deal with this without refusing to run.
--- snip ---

I agree...

[Z-jbf-faure (z-jbf-faure)]

Seems not been confirmed for me under Ubuntu 14.04. I modified the avahi daemon configuration and restarted the daemon using the following command:
sudo /etc/init.d/avahi-daemon restart
On LO 4.1.6 (TDF build) which is the only version I have where remote control is enabled, Impress and Draw start without problem. I tested with Bluetouth enabled and visible.
Will rebuild 4.2 branch with remote control enabled and test again.

Best regards. JBF

[Rene Engelhard (rene-debian)]

jbfaure:

- 4.1.6 didn't have any avahi stuff there so of course it works

- that's only in 4.2.x/4.3.x/.. _and_ you need NON-TDF builds, as TDF builds are not configured with --enable-avahi so that part is not even compiled in. So you of course also would not be able to reproduce this on a TDF-4.2.x. And Remote Control itself is not directly responsible for it but the avahi support for it.

[Jmadero-dev (jmadero-dev)]

@Rene - of course this should just be put to NEW as you are one of our developers who know their stuff :)

[Z-jbf-faure (z-jbf-faure)]

Reproducible with LO 4.2.7.0.0+ build with avahi support. Launching Impress from the StartCenter make LO crashing with the same error message in the terminal as in the bug description.

Same problem when starting Draw. I know that Impress and Draw share many code, but it seems to me that Draw shouldn't be subject to impress-remote connection problems.

Set importance to critical because there is a crash.

Best regards. JBF

[Z-jbf-faure (z-jbf-faure)]

*** Bug 81037 has been marked as a duplicate of this bug. ***

[dh (dcharvey)]

Hello, Any updates here or further testing required?

[Gquigs+bugs (gquigs+bugs)]

Created attachment 103851
incomplete avahi fix

I fixed the original issue by just checking if(client). However it seems like the issue goes deeper.

Current error is - soffice.bin: thread-watch.c:132: avahi_threaded_poll_start: Assertion `!p->thread_running' failed. If a return statement is added before "Finally, start the event loop thread" then we don't crash.

[Gquigs+bugs (gquigs+bugs)]

Submitted a fix in https://gerrit.libreoffice.org/#/c/10735/

My testing was run libreoffice --impress in the following scenarios:
daemon off
daemon on - just disable-publishing=yes
daemon on - just disable-user-service-publishing=yes
daemon on - publishing enabled, check to make sure it works

[Libreoffice-commits (libreoffice-commits)]

Bryan Quigley committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3c57701cf0a169bd8d1893d1b2271d48b8072147

fdo#81552 Fail nicely if avahi doesn't let libreoffice publish items

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.

[Libreoffice-commits (libreoffice-commits)]

Bryan Quigley committed a patch related to this issue.
It has been pushed to "libreoffice-4-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=d2eec11f0a6f27e13a4a834942f8acf20ae62cec&h=libreoffice-4-3

fdo#81552 Fail nicely if avahi doesn't let libreoffice publish items

It will be available in LibreOffice 4.3.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.

[Libreoffice-commits (libreoffice-commits)]

Bryan Quigley committed a patch related to this issue.
It has been pushed to "libreoffice-4-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=8de2e9b4bc53e6c097897142bad223c100d36292&h=libreoffice-4-2

fdo#81552 Fail nicely if avahi doesn't let libreoffice publish items

It will be available in LibreOffice 4.2.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.

[Beluga (beluga)]

*** Bug 81349 has been marked as a duplicate of this bug. ***

[dh (dcharvey)]

As LibreOffice and Debian have fixes confirmed, can we expect to see this patched into the ubuntu repos any time soon?

[Bryan Quigley (bryanquigley)]

This was fixed in 4.2.7 and 4.3.2 which have both landed in Trusty/Vivid respectively. I double checked and this is fixed in 14.04 with the latest updates.