cupsd 2.2.0-2 crashed with SIGABRT in __malloc_assert()

[Manuel Carro]

I am unable to print after a smooth upgrade from 16.04 to 16.10, as the cupsd service would not start. The installed version of cups-daemon is 2.2.0-2. I am using Ubuntu release 16.10.

Syslog shows:

Oct 22 18:36:46 mcarro-ThinkPad-X1-Carbon-3rd cupsd[20036]: cupsd: malloc.c:2880: mremap_chunk: Assertion `((size + offset) & (GLRO (dl_pagesize) - 1)) == 0' failed.

ProblemType: Crash
DistroRelease: Ubuntu 16.10
Package: cups-daemon 2.2.0-2
ProcVersionSignature: Ubuntu 4.8.0-27.29-generic 4.8.1
Uname: Linux 4.8.0-27-generic x86_64
ApportVersion: 2.20.3-0ubuntu8
Architecture: amd64
CrashCounter: 1
Date: Sat Oct 22 09:35:50 2016
ExecutablePath: /usr/sbin/cupsd
InstallationDate: Installed on 2015-06-15 (495 days ago)
InstallationMedia: Ubuntu 15.04 "Vivid Vervet" - Release amd64 (20150422)
Lpstat: Error: command ['lpstat', '-v'] failed with exit code 1: lpstat: Bad file descriptor
MachineType: LENOVO 20BSCTO1WW
Papersize: a4
ProcAttrCurrent: /usr/sbin/cupsd (enforce)
ProcCmdline: BOOT_IMAGE=/boot/vmlinuz-4.8.0-27-generic.efi.signed root=UUID=b5bda038-97c0-40f3-b9ba-67c06b05ae03 ro quiet splash vt.handoff=7
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.8.0-27-generic.efi.signed root=UUID=b5bda038-97c0-40f3-b9ba-67c06b05ae03 ro quiet splash vt.handoff=7
Signal: 6
SourcePackage: cups
StacktraceTop:
 __malloc_assert (assertion=assertion@entry=0x7f62b27fa308 "((size + offset) & (GLRO (dl_pagesize) - 1)) == 0", file=file@entry=0x7f62b27f6e2e "malloc.c", line=line@entry=2880, function=function@entry=0x7f62b27fae28 <__func__.11331> "mremap_chunk") at malloc.c:301
 mremap_chunk (p=p@entry=0x5653d935dab0, new_size=new_size@entry=8288) at malloc.c:2880
 __GI___libc_realloc (oldmem=0x5653d935dac0, bytes=8275) at malloc.c:3060
 cupsFilePrintf () from /usr/lib/x86_64-linux-gnu/libcups.so.2
 ?? ()
Title: cupsd crashed with SIGABRT in __malloc_assert()
UpgradeStatus: Upgraded to yakkety on 2016-10-14 (7 days ago)
UserGroups:

dmi.bios.date: 05/08/2015
dmi.bios.vendor: LENOVO
dmi.bios.version: N14ET29W (1.07 )
dmi.board.asset.tag: Not Available
dmi.board.name: 20BSCTO1WW
dmi.board.vendor: LENOVO
dmi.board.version: SDK0E50512 STD
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.modalias: dmi:bvnLENOVO:bvrN14ET29W(1.07):bd05/08/2015:svnLENOVO:pn20BSCTO1WW:pvrThinkPadX1Carbon3rd:rvnLENOVO:rn20BSCTO1WW:rvrSDK0E50512STD:cvnLENOVO:ct10:cvrNone:
dmi.product.name: 20BSCTO1WW
dmi.product.version: ThinkPad X1 Carbon 3rd
dmi.sys.vendor: LENOVO

[Manuel Carro (mcarro)]

I have (apparently) solved the problem. In several printer definitions printers.conf had a long (some 4000 chars?) configuration line (see at the end of this message). There were recurring errors in cups/error_log stating "Unknown configuration directive" which I had not noticed. I removed the (offending?) printer entries by hand and it seemed to work (tested in my home printer). The rest of the printers (even the ones I removed by hand) seem to be available now. I can see them in the printing dialogs and in the system printer configuration. But the entries I removed (or very similar ones) are back in printers.conf, and now I can stop and re what start cupsd.

One of the entries that cups/error_log complained about is:

Info HP Designjet T520 36in \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\...

[Till Kamppeter (till-kamppeter)]

The backslashes were caused by a bug in cups-browsed (package cups-filters) which I have already fixed before release of 16.10. So after once removing these entries manually, they should not show up again and show the crash should not occur again.

But in general, CUPS has no sufficien protection against too long info/description strings. This should get reported as upstream bug on http://www.cups.org/.

[Manuel Carro (mcarro)]

I have just reported the bug. Thanks.

[Brian Murray (brian-murray)]

StacktraceTop:
 __malloc_assert (assertion=assertion@entry=0x7f62b27fa308 "((size + offset) & (GLRO (dl_pagesize) - 1)) == 0", file=file@entry=0x7f62b27f6e2e "malloc.c", line=line@entry=2880, function=function@entry=0x7f62b27fae28 <__func__.11331> "mremap_chunk") at malloc.c:301
 mremap_chunk (p=p@entry=0x5653d935dab0, new_size=new_size@entry=8288) at malloc.c:2880
 __GI___libc_realloc (oldmem=0x5653d935dac0, bytes=bytes@entry=8275) at malloc.c:3060
 cupsFilePrintf (fp=0x5653d9355f50, format=format@entry=0x5653d847ba2b "%c %s %s\n") at file.c:1343
 cupsdWriteErrorLog (level=<optimized out>, message=0x5653d9738eb0 "Unknown configuration directive ", '\\' <repeats 168 times>...) at log.c:1435

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.