cupsd crashed with SIGSEGV in main() straight after boot and then periodically.

[j0e]

After boot Cupsd crashes. There seems to be a watch dog that starts it again, after a couple minutes it crashes again. There is no printer at all attached to the computer.

ProblemType: Crash
DistroRelease: Ubuntu 11.10
Package: cups 1.5.0-7
ProcVersionSignature: Ubuntu 3.0.0-11.18-generic 3.0.4
Uname: Linux 3.0.0-11-generic i686
ApportVersion: 1.23-0ubuntu1
Architecture: i386
Date: Tue Sep 27 23:43:56 2011
ExecutablePath: /usr/sbin/cupsd
Lpstat: Error: command ['lpstat', '-v'] failed with exit code 1: lpstat: No destinations added.
MachineType: TOSHIBA Satellite M50
Papersize: a4
PccardctlIdent:
 Socket 0:
   no product info available
PccardctlStatus:
 Socket 0:
   no card
ProcAttrCurrent: /usr/sbin/cupsd (enforce)
ProcCmdline: /usr/sbin/cupsd -F
ProcEnviron: PATH=(custom, no user)
ProcKernelCmdLine: root=UUID=ab11c613-666e-4ac0-a871-2b64754c6df5 ro quiet splash
SegvAnalysis:
 Segfault happened at: 0xd869e3: call *%edx
 PC (0x00d869e3) ok
 source "*%edx" (0x632d7365) not located in a known VMA region (needed readable region)!
 destination "(%esp)" (0xbfeb2480) ok
SegvReason: reading unknown VMA
Signal: 11
SourcePackage: cups
Stacktrace:
 #0 0x00d869e3 in ?? ()
 No symbol table info available.
 #1 0x00d49446 in main ()
 No symbol table info available.
StacktraceTop:
 ?? ()
 main ()
Title: cupsd crashed with SIGSEGV in main()
UpgradeStatus: Upgraded to oneiric on 2011-09-27 (0 days ago)
UserGroups:

dmi.bios.date: 07/04/2005
dmi.bios.vendor: TOSHIBA
dmi.bios.version: V1.30
dmi.board.name: ECU00
dmi.board.vendor: TOSHIBA
dmi.board.version: Null
dmi.chassis.asset.tag: *
dmi.chassis.type: 10
dmi.chassis.vendor: TOSHIBA
dmi.chassis.version: N/A
dmi.modalias: dmi:bvnTOSHIBA:bvrV1.30:bd07/04/2005:svnTOSHIBA:pnSatelliteM50:pvrPSM51A-01L00K:rvnTOSHIBA:rnECU00:rvrNull:cvnTOSHIBA:ct10:cvrN/A:
dmi.product.name: Satellite M50
dmi.product.version: PSM51A-01L00K
dmi.sys.vendor: TOSHIBA

[Apport retracing service (apport)]

StacktraceTop:
 cupsdRunTimeout (timeout=0x226d2bd0) at timeout.c:157
 main (argc=2, argv=0xbfeb2664) at main.c:900

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Till Kamppeter (till-kamppeter)]

Here is another problem with an Avahi code call via timeout.

[Tim Waugh (twaugh)]

Very clearly a memory scribble. The called address is 0x632d7365, which is ASCII.

$ printf %b '\x63\x2d\x73\x65\n'
c-se

[Tim Waugh (twaugh)]

My best guess is that this is another instance of cupsArrayRemove() causing problems, as in http://www.cups.org/str.php?L3951.

[Tim Waugh (twaugh)]

Please take a look at commit 2ed292ab433f6fa51f2dd8639ca445390ae25fac. It changes the Timeouts array into an unsorted array, which makes cupsArrayRemove() a lot more predictable.

[Tim Waugh (twaugh)]

I've pushed another, simpler, fix: compare_timeouts() now uses the address of the cupsd_timeout_t object in the case of a tie.

[Till Kamppeter (till-kamppeter)]

Thanks for your patches. I am testing now with the sum of your patches from 2ed292ab4 to now, which results in a nice small patch for in-freeze or SRU upload ...

[Till Kamppeter (till-kamppeter)]

Tim, I have tested your patch now and CUPS is stable for me (but I did not have the crash before).

[Martin Pitt (pitti)]

Hello j0e, or anyone else affected,

Accepted cups into oneiric-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[j0e (joe-james)]

I can confirm that this is no longer an issue for me in package: cups 1.5.0-8

Thanks.

[Launchpad Janitor (janitor)]

This bug was fixed in the package cups - 1.5.0-8ubuntu1

---------------
cups (1.5.0-8ubuntu1) oneiric-proposed; urgency=low

  [ Till Kamppeter ]
  * debian/patches/cups-avahi.patch: Updated patch from upstream (Red Hat)
    to fix crashes of the CUPS daemon when using the timeout function call
    functionality (LP: #860691, LP: #860498).

  [ Martin Pitt ]
  * debian/local/apparmor-profile: Also allow cups to map libraries under
    /usr/local/. (LP: #860765)
 -- Till Kamppeter <email address hidden> Fri, 7 Oct 2011 17:01:43 +0200