cupsd crashed with SIGSEGV in __strnlen_avx2_rtm()

[Matthias Klose]

trying to print with jammy 20220316, to a network printer

ProblemType: Crash
DistroRelease: Ubuntu 22.04
Package: cups-daemon 2.4.1op1-1ubuntu2
ProcVersionSignature: Ubuntu 5.15.0-22.22-generic 5.15.19
Uname: Linux 5.15.0-22-generic x86_64
ApportVersion: 2.20.11-0ubuntu79
Architecture: amd64
CasperMD5CheckResult: pass
Date: Wed Mar 16 11:00:00 2022
ExecutablePath: /usr/sbin/cupsd
InstallationDate: Installed on 2022-02-28 (15 days ago)
InstallationMedia: Ubuntu 22.04 LTS "Jammy Jellyfish" - Alpha amd64 (20220226)
Lpstat: Error: command ['lpstat', '-v'] failed with exit code 1: lpstat: No destinations added.
MachineType: LENOVO 20Y5CTO1WW
Papersize: a4
ProcAttrCurrent: /usr/sbin/cupsd (enforce)
ProcCmdline: BOOT_IMAGE=/boot/vmlinuz-5.15.0-22-generic root=UUID=229d75cc-2aa3-4f8f-b5bd-d310f6218a3f ro quiet splash vt.handoff=7
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-5.15.0-22-generic root=UUID=229d75cc-2aa3-4f8f-b5bd-d310f6218a3f ro quiet splash vt.handoff=7
RebootRequiredPkgs: Error: path contained symlinks.
SegvAnalysis:
 Segfault happened at: 0x7fdde6d9698c <__strcmp_evex+44>: vpcmpeqb (%rsi),%ymm17,%k1{%k2}
 PC (0x7fdde6d9698c) ok
 source "(%rsi)" (0x00000000) not located in a known VMA region (needed readable region)!
 destination "%ymm17" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: cups
StacktraceTop:
 __strcmp_evex () at ../sysdeps/x86_64/multiarch/strcmp-evex.S:139
 ?? ()
 ?? ()
 ?? ()
 __libc_start_call_main (main=main@entry=0x55ea813993a0, argc=argc@entry=2, argv=argv@entry=0x7fffb71a6eb8) at ../sysdeps/nptl/libc_start_call_main.h:58
Title: cupsd crashed with SIGSEGV in __strcmp_evex()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: N/A
dmi.bios.date: 10/14/2021
dmi.bios.release: 1.11
dmi.bios.vendor: LENOVO
dmi.bios.version: N40ET29W (1.11 )
dmi.board.asset.tag: Not Available
dmi.board.name: 20Y5CTO1WW
dmi.board.vendor: LENOVO
dmi.board.version: SDK0T08861 WIN
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.ec.firmware.release: 1.11
dmi.modalias: dmi:bvnLENOVO:bvrN40ET29W(1.11):bd10/14/2021:br1.11:efr1.11:svnLENOVO:pn20Y5CTO1WW:pvrThinkPadX1ExtremeGen4i:rvnLENOVO:rn20Y5CTO1WW:rvrSDK0T08861WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_20Y5_BU_Think_FM_ThinkPadX1ExtremeGen4i:
dmi.product.family: ThinkPad X1 Extreme Gen 4i
dmi.product.name: 20Y5CTO1WW
dmi.product.sku: LENOVO_MT_20Y5_BU_Think_FM_ThinkPad X1 Extreme Gen 4i
dmi.product.version: ThinkPad X1 Extreme Gen 4i
dmi.sys.vendor: LENOVO
separator:

[Apport retracing service (apport)]

StacktraceTop:
 __strcmp_evex () at ../sysdeps/x86_64/multiarch/strcmp-evex.S:139
 create_local_printer (con=0x55ea82141090) at /build/cups-y1LIcO/cups-2.4.1op1/scheduler/ipp.c:5539
 cupsdProcessIPPRequest (con=0x55ea82141090) at /build/cups-y1LIcO/cups-2.4.1op1/scheduler/ipp.c:604
 cupsdReadClient (con=0x55ea82141090) at /build/cups-y1LIcO/cups-2.4.1op1/scheduler/client.c:1814
 cupsdDoSelect (timeout=<optimized out>) at /build/cups-y1LIcO/cups-2.4.1op1/scheduler/select.c:480

[Till Kamppeter (till-kamppeter)]

Could you run the following commands:

driverless

driverless --std-ipp-uris

lpstat -v

and post the output here.

On which print queue are you printing?

Are you running cups-browsed?

Then switch CUPS into debug mode:

cupsctl --debug-logging

Print a job as you did when the crash happened. When it fails again, take the /var/log/cups/error_log file and attach it to this bug report. DO NOT compress or package it.

Could you also tell me how you printed the job? Which application? GTK print dialog? Any other print dialog?

[Till Kamppeter (till-kamppeter)]

Can you also attach your /etc/cups/cupsd.conf file?

And please also post the output of the command

cupsctl

[Matthias Klose (doko)]

doko@xe1:~$ driverless
ipp://HP%20LaserJet%20500%20colorMFP%20M570dw%20(6C84AD)._ipp._tcp.local/
doko@xe1:~$ driverless --std-ipp-uris
ipp://NPI6C84AD.local:631/ipp/printer
doko@xe1:~$ lpstat -v
lpstat: No destinations added.

$ ps aux | grep cups-browsed
root 94786 0.0 0.0 172744 11908 ? Ssl 11:00 0:00 /usr/sbin/cups-browsed
doko 110175 0.0 0.0 9560 2428 pts/4 S+ 17:21 0:00 grep --color=auto cups-browsed

Trying to print a png image with eog

[Matthias Klose (doko)]

$ cupsctl
_debug_logging=1
_remote_admin=0
_remote_any=0
_share_printers=0
_user_cancel_any=0
BrowseLocalProtocols=dnssd
DefaultAuthType=Basic
ErrorPolicy=retry-job
IdleExitTimeout=60
JobPrivateAccess=default
JobPrivateValues=default
MaxLogSize=0
PageLogFormat=
SubscriptionPrivateAccess=default
SubscriptionPrivateValues=default
WebInterface=Yes

[Till Kamppeter (till-kamppeter)]

Thanks for all the info, it is as I expected, your cupsd.conf has "Browsing No" because you do not use printer sharing. Then the DNS-SD host name is not set in the daemon's internal variable DNSSDHostName and this variable I compared with the host name of the URI of the potential new queue to see whether I have to change it to "localhost" for the case that the printer is a local service (IPP-over-USB, Printer Application, ...). This caused the crash. Now I have added a fallback to the internal variable ServerName if DNSSDHostName is NULL.

I could reproduce the bug by doing the command

cupsctl --no-share-printers

(I had printer sharing on for my OpenPrinting work) and re-trying to access an IPP printer through GTK's print dialog which caused the crash then for me.

I have the fix now ready and with it the crash goes away.

I will update the Pull Request on CUPS upstream (https://github.com/OpenPrinting/cups/pull/353) and also the patch on the Ubuntu package.

Thanks for the bug report.

[Till Kamppeter (till-kamppeter)]

I have uploaded cups 2.4.1op1-1ubuntu3 with the updated patch now, and also updated the upstream pull request:

https://github.com/OpenPrinting/cups/pull/353

Please test as soon as the update arrives.

[Apport retracing service (apport)]

StacktraceTop:
 __strnlen_avx2_rtm () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:256
 create_local_printer (con=0x55ea82141090) at /build/cups-y1LIcO/cups-2.4.1op1/scheduler/ipp.c:5539
 cupsdProcessIPPRequest (con=0x55ea82141090) at /build/cups-y1LIcO/cups-2.4.1op1/scheduler/ipp.c:604
 cupsdReadClient (con=0x55ea82141090) at /build/cups-y1LIcO/cups-2.4.1op1/scheduler/client.c:1814
 cupsdDoSelect (timeout=<optimized out>) at /build/cups-y1LIcO/cups-2.4.1op1/scheduler/select.c:480

[Launchpad Janitor (janitor)]

This bug was fixed in the package cups - 2.4.1op1-1ubuntu3

---------------
cups (2.4.1op1-1ubuntu3) jammy; urgency=low

  * Fixed crasher in the patch for temporary queues for local services
    in the previous release. Updated the patch and the upstream pull
    request (LP: #1965112, Upstream pull request #353).

 -- Till Kamppeter <email address hidden> Wed, 16 Mar 2022 18:24:08 +0100