gnome-control-center crashed with SIGSEGV in g_signal_emit_valist()

[Julian Andres Klode]

While analysing bug 2078060 after toggling off fractional scaling and the shell crashing (bug 2078722), following a new login, gnome-control-center now crashes reliably when selecting built-in display.

ProblemType: Crash
DistroRelease: Ubuntu 24.10
Package: gnome-control-center 1:47~beta-2ubuntu2
ProcVersionSignature: Ubuntu 6.8.0-31.31-generic 6.8.1
Uname: Linux 6.8.0-31-generic x86_64
NonfreeKernelModules: zfs
ApportVersion: 2.30.0-0ubuntu1
Architecture: amd64
CasperMD5CheckResult: pass
CrashCounter: 1
CurrentDesktop: GNOME
Date: Mon Sep 2 18:43:40 2024
ExecutablePath: /usr/bin/gnome-control-center
InstallationDate: Installed on 2022-11-26 (646 days ago)
InstallationMedia: Ubuntu 23.04 "Lunar Lobster" - Alpha amd64 (20221126)
ProcCmdline: /usr/bin/gnome-control-center
SegvAnalysis:
 Segfault happened at: 0x5e684488469e: mov (%rax),%rax
 PC (0x5e684488469e) ok
 source "(%rax)" (0x00000000) not located in a known VMA region (needed readable region)!
 destination "%rax" ok
SegvReason: reading NULL VMA
Signal: 11
SignalName: SIGSEGV
SourcePackage: gnome-control-center
StacktraceTop:
 ?? ()
 ?? ()
 ?? ()
 ?? () from /lib/x86_64-linux-gnu/libgobject-2.0.so.0
 g_signal_emit_valist () from /lib/x86_64-linux-gnu/libgobject-2.0.so.0
Title: gnome-control-center crashed with SIGSEGV in g_signal_emit_valist()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin lxd plugdev sudo
separator:

[Apport retracing service (apport)]

Thank you for your report!

However, processing it in order to get sufficient information for the
developers failed as the report has a core dump which is invalid. The
corruption may have happened on the system which the crash occurred or during
transit.

Thank you for your understanding, and sorry for the inconvenience!

[Julian Andres Klode (juliank)]

It seems to trash the stack heavily but this is fully reproducible

[Julian Andres Klode (juliank)]

Here is a full back trace, the call to cc_display_mode_get_resolution() has self=0x0

#0 cc_display_mode_get_resolution (self=0x0, w=0x7ffcbe98b988, h=0x7ffcbe98b984) at ../panels/display/cc-display-config.c:105
#1 cc_display_settings_rebuild_ui (self=self@entry=0x5eedbc90a5c0) at ../panels/display/cc-display-settings.c:445
#2 0x00005eedb9d2d18d in cc_display_settings_set_selected_output (self=0x5eedbc90a5c0, output=0x5eedbca19d70) at ../panels/display/cc-display-settings.c:1134
#3 set_current_output (self=self@entry=0x5eedbc751a90, output=0x5eedbca19d70, force=force@entry=0) at ../panels/display/cc-display-panel.c:644
#4 0x00005eedb9d2ecdc in on_monitor_row_activated_cb (self=0x5eedbc751a90, row=<optimized out>) at ../panels/display/cc-display-panel.c:661
#5 0x00007a8a2c48ef10 in _g_closure_invoke_va (closure=0x5eedbca4bf10, return_value=0x0, instance=0x5eedbcc94440, args=0x7ffcbe98bc70, n_params=<optimized out>, param_types=0x0) at ../../../gobject/gclosure.c:896
#6 signal_emit_valist_unlocked (instance=instance@entry=0x5eedbcc94440, signal_id=signal_id@entry=324, detail=detail@entry=0, var_args=var_args@entry=0x7ffcbe98bc70) at ../../../gobject/gsignal.c:3423
#7 0x00007a8a2c48f001 in g_signal_emit_valist (instance=0x5eedbcc94440, signal_id=324, detail=0, var_args=var_args@entry=0x7ffcbe98bc70) at ../../../gobject/gsignal.c:3262
#8 0x00007a8a2c48f0c3 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3582
#9 0x00007a8a2c46e45a in g_closure_invoke (closure=0x5eedbc833f60, return_value=0x0, n_param_values=2, param_values=0x7ffcbe98bf30, invocation_hint=0x7ffcbe98be80) at ../../../gobject/gclosure.c:833
#10 0x00007a8a2c49e223 in signal_emit_unlocked_R.isra.0 (node=node@entry=0x7ffcbe98c020, detail=detail@entry=0, instance=instance@entry=0x5eedbc7827a0, emission_return=emission_return@entry=0x0,
    instance_and_params=instance_and_params@entry=0x7ffcbe98bf30) at ../../../gobject/gsignal.c:3887
#11 0x00007a8a2c48edc0 in signal_emit_valist_unlocked (instance=instance@entry=0x5eedbc7827a0, signal_id=signal_id@entry=191, detail=detail@entry=0, var_args=var_args@entry=0x7ffcbe98c190) at ../../../gobject/gsignal.c:3519
#12 0x00007a8a2c48f001 in g_signal_emit_valist (instance=0x5eedbc7827a0, signal_id=191, detail=0, var_args=var_args@entry=0x7ffcbe98c190) at ../../../gobject/gsignal.c:3262
#13 0x00007a8a2c48f0c3 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3582
#14 0x00007a8a2b7acc0f in gtk_list_box_select_and_activate_full (box=0x5eedbc7827a0, row=0x5eedbcc94440, grab_focus=1) at ../../../gtk/gtklistbox.c:1885
#15 gtk_list_box_select_and_activate_full (box=0x5eedbc7827a0, row=0x5eedbcc94440, grab_focus=1) at ../../../gtk/gtklistbox.c:1877
#16 gtk_list_box_click_gesture_released (gesture=<optimized out>, n_press=1, x=<optimized out>, y=273.78909301757812, box=0x5eedbc7827a0) at ../../../gtk/gtklistbox.c:1947
#17 0x00007a8a2b6cb77c in _gtk_marshal_VOID__INT_DOUBLE_DOUBLEv (closure=<optimized out>, return_value=<optimized out>, instance=<optimized out>, args=<optimized out>, marshal_data=<o...

[Julian Andres Klode (juliank)]

The code in question is:

      current_mode = cc_display_monitor_get_mode (self->selected_output);
      cc_display_mode_get_resolution (current_mode, &width, &height);

Which means that cc_display_monitor_get_mode() returned NULL.

[Julian Andres Klode (juliank)]

Valgrind:

==3117588== Invalid read of size 8
==3117588== at 0x1A469E: UnknownInlinedFun (cc-display-config.c:107)
==3117588== by 0x1A469E: cc_display_settings_rebuild_ui (cc-display-settings.c:445)
==3117588== by 0x1A518C: UnknownInlinedFun (cc-display-settings.c:1134)
==3117588== by 0x1A518C: set_current_output (cc-display-panel.c:644)
==3117588== by 0x1A6CDB: on_monitor_row_activated_cb (cc-display-panel.c:661)
==3117588== by 0x4A82F0F: UnknownInlinedFun (gclosure.c:896)
==3117588== by 0x4A82F0F: signal_emit_valist_unlocked (gsignal.c:3423)
==3117588== by 0x4A83000: g_signal_emit_valist (gsignal.c:3262)
==3117588== by 0x4A830C2: g_signal_emit (gsignal.c:3582)
==3117588== by 0x4A62459: g_closure_invoke (gclosure.c:833)
==3117588== by 0x4A92222: signal_emit_unlocked_R.isra.0 (gsignal.c:3887)
==3117588== by 0x4A82DBF: signal_emit_valist_unlocked (gsignal.c:3519)
==3117588== by 0x4A83000: g_signal_emit_valist (gsignal.c:3262) ...

[Sebastien Bacher (seb128)]

Any chance you would also report that upstream to GNOME?