Use after free in gdbus leads to eds segfaults

[errors.ubuntu.com bug bridge]

[ Description ]

The Ubuntu Error Tracker has been receiving reports about a problem regarding evolution-data-server. This problem was most recently seen with package version 3.34.1-1, the problem page at https://errors.ubuntu.com/problem/b1f62616406e36e521fd1fb1d2be4ac2fe9a2cda contains more details, including versions of packages affected, stacktrace or traceback, and individual crash reports.
If you do not have access to the Ubuntu Error Tracker and are a software developer, you can request it at http://forms.canonical.com/reports/.

[ Fix ]

This bug was fixed upstream in 2.62.2 (see the links below). That update is being issues to eoan.

[ QA ]

Under https://wiki.ubuntu.com/StableReleaseUpdates/GNOME, we don't need to explicitly test that this bug is fixed. Nevertheless, to verify this bug please give the desktop a good workout. Ideally install the SRU and use your machine as you would normally for a variety of tasks. Make sure there are no regressions.

[ Regression potential ]

1) The changes involve mutexes and stuff, which is error prone.

2) It's GLib, a core library, so any bad regressions will be really serious for the desktop as a whole.

[Sebastien Bacher (seb128)]

Upstream https://gitlab.gnome.org/GNOME/glib/issues/1896

[Sebastien Bacher (seb128)]

glib 2.62 backport pending https://gitlab.gnome.org/GNOME/glib/merge_requests/1162

[Łukasz Zemczak (sil2100)]

Hello errors.ubuntu.com, or anyone else affected,

Accepted glib2.0 into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/glib2.0/2.62.2-2~ubuntu19.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Gunnar Hjalmarsson (gunnarhj)]

Bug #1844853 was explicitly verified (comment #15). Didn't observe any unexpected behavior due to the glib2.0 upgrade.

[Launchpad Janitor (janitor)]

This bug was fixed in the package glib2.0 - 2.63.1-2

---------------
glib2.0 (2.63.1-2) experimental; urgency=medium

  * d/p/Revert-glocalfileinfo-Only-return-file-mode-not-type-as-U.patch:
    Revert "glocalfileinfo: Only return file mode, not type, as UNIX_MODE
    attribute" This reverts commit bfdc5fc4fc84ef8518d2d1a328c8482cf5a38e98.
    This commit changes the semantics of the `unix::mode` attribute, which
    some things (the one we've noticed is ostree) rely on.
  * d/p/test_copy_preserve_mode-Adjust-for-revert-semantics.patch:
    test_copy_preserve_mode: Adjust for revert semantics. Now we're returning
    the file type again, we need to mask it out to compare with the mode.

 -- Iain Lane <email address hidden> Mon, 18 Nov 2019 13:59:35 +0000

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted glib2.0 (2.62.2-2~ubuntu19.10.1) for eoan have finished running.
The following regressions have been reported in tests triggered by the package:

indicator-session/17.3.20+19.10.20190921-0ubuntu1 (arm64)
sbd/1.4.0-18-g5e3283c-1ubuntu1 (i386)
cairo/unknown (armhf)
netplan.io/0.98-0ubuntu1 (ppc64el)
apport/2.20.11-0ubuntu8.2 (amd64)
snapd-glib/unknown (armhf)
firefox/70.0.1+build1-0ubuntu0.19.10.1 (armhf)
bumblebee/unknown (armhf)
glib2.0/2.62.2-2~ubuntu19.10.1 (i386)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/eoan/update_excuses.html#glib2.0

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Łukasz Zemczak (sil2100)]

Hello errors.ubuntu.com, or anyone else affected,

Accepted glib2.0 into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/glib2.0/2.62.3-2~ubuntu19.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted glib2.0 (2.62.3-2~ubuntu19.10.1) for eoan have finished running.
The following regressions have been reported in tests triggered by the package:

automake-1.16/1:1.16.1-4ubuntu3 (s390x)
libreoffice/1:6.3.4-0ubuntu0.19.10.1 (ppc64el)
umockdev/0.13.2-1 (armhf, i386)
asterisk/1:16.2.1~dfsg-2build2 (arm64)
tracker/2.3.0-1 (armhf)
glib2.0/2.62.3-2~ubuntu19.10.1 (i386)
cmake-extras/1.3+17.04.20170310-5 (armhf)
netplan.io/0.98-0ubuntu1 (ppc64el, i386)
dbus-test-runner/15.04.0+19.04.20190115-0ubuntu1 (armhf, i386)
sbd/1.4.0-18-g5e3283c-1ubuntu1 (amd64, i386)
ocaml-cairo2/unknown (armhf)
netplan.io/unknown (armhf)
gvfs/1.42.1-1ubuntu1 (arm64)
openssh/1:8.0p1-6build1 (amd64, armhf, arm64, s390x, i386, ppc64el)
snapd-glib/1.49-0ubuntu1.19.10.0 (armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/eoan/update_excuses.html#glib2.0

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Steve Langasek (vorlon)]

Hello errors.ubuntu.com, or anyone else affected,

Accepted glib2.0 into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/glib2.0/2.62.4-1~ubuntu19.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted glib2.0 (2.62.3-2~ubuntu19.10.1) for eoan have finished running.
The following regressions have been reported in tests triggered by the package:

tracker/2.3.0-1 (armhf)
snapd-glib/1.49-0ubuntu1.19.10.0 (armhf)
sbd/1.4.0-18-g5e3283c-1ubuntu1 (amd64)
gvfs/1.42.1-1ubuntu1 (arm64)
glib2.0/2.62.3-2~ubuntu19.10.1 (i386)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/eoan/update_excuses.html#glib2.0

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted glib2.0 (2.62.4-1~ubuntu19.10.1) for eoan have finished running.
The following regressions have been reported in tests triggered by the package:

openssh/1:8.0p1-6build1 (i386, ppc64el, amd64, arm64, s390x, armhf)
openjdk-8/unknown (amd64, armhf)
libreoffice/unknown (i386)
dbus-python/unknown (armhf)
modemmanager-qt/unknown (amd64)
graphene/1.10.0-1 (arm64)
firefox/73.0+build3-0ubuntu0.19.10.1 (arm64)
gvfs/1.42.1-1ubuntu1 (arm64)
cmake-extras/1.3+17.04.20170310-5 (armhf)
glib2.0/2.62.4-1~ubuntu19.10.1 (i386)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/eoan/update_excuses.html#glib2.0

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Gunnar Hjalmarsson (gunnarhj)]

Bug #1844853 was explicitly verified (again, comment #31 this time). Didn't observe any unexpected behavior due to the glib2.0 upgrade.

[Launchpad Janitor (janitor)]

This bug was fixed in the package glib2.0 - 2.62.4-1~ubuntu19.10.1

---------------
glib2.0 (2.62.4-1~ubuntu19.10.1) eoan; urgency=medium

  * No-change backport from unstable to eoan (LP: #1850932).
    + Contains fix for LP: #1844853 - "IBus no longer works in Qt applications
      after upgrade"

glib2.0 (2.62.4-1) unstable; urgency=medium

  * Team upload

  [ Steve Langasek ]
  * debian/tests/build: Make cross-test friendly (Closes: #946355)

  [ Iain Lane ]
  * debian/tests/build: Style fixes

  [ Simon McVittie ]
  * New upstream release

glib2.0 (2.62.3-2) unstable; urgency=medium

  * Team upload
  * Rename pkg.glib2.0.noinsttest build profile to noinsttest.
    This is now registered on <https://wiki.debian.org/BuildProfileSpec>.

glib2.0 (2.62.3-1) unstable; urgency=medium

  * Team upload
  * New upstream release
    - Drop patches that were applied upstream
  * Don't build libglib2.0-tests under pkg.glib2.0.noinsttest build profile.
    This is a prototype of the proposed standard build profile noinsttest.
    If the build profiles include both nocheck and pkg.glib2.0.noinsttest,
    we can drop the libdbus-1-dev build-dependency without harming test
    coverage or altering the contents of binary packages.
  * d/gbp.conf: Use upstream/2.62.x branch

glib2.0 (2.62.2-3) unstable; urgency=medium

  * Team upload

  [ Iain Lane ]
  * control: Drop `debian/experimental` from Vcs-*

  [ Simon McVittie ]
  * Build-depend on libdbus-1-dev for better test coverage
  * Update to upstream commit 2.62.2-28-g3cf25070e:
    - d/p/goption-Relax-assertion-to-avoid-being-broken-by-kdeinit5.patch:
      Fix assertion failure when called from a process that overwrites its
      argv, such as kdeinit5
    - d/p/gdbus-peer-Specifically-listen-on-127.0.0.1.patch:
      Improve reliability of gdbus-peer test in some container environments
    - d/p/gdbusserver-Delete-socket-and-nonce-file-when-stopping-se.patch,
      d/p/gdbusserver-Keep-a-strong-reference-to-the-server-in-call.patch,
      d/p/gdbusauthmechanismsha1-Remove-unnecessary-g_warning-calls.patch,
      d/p/gdbusauthmechanismsha1-Create-.dbus-keyrings-directory-re.patch,
      d/p/tests-Move-main-loop-and-test-GUID-into-test-functions-in.patch,
      d/p/tests-Isolate-directories-in-gdbus-peer-test.patch,
      d/p/gdbus-peer-test-Improve-diagnostics-if-g_rmdir-fails.patch,
      d/p/gdbus-peer-test-Stop-GDBusServer-before-tearing-down-temp.patch,
      d/p/gdbus-peer-test-Use-unix-dir-address-if-exact-format-does.patch,
      d/p/gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch:
      Mark as applied upstream in 2.62.x branch
  * d/p/gdbus-server-auth-test-Include-gcredentialsprivate.h.patch:
    Apply patch from 2.63.x to fix missing coverage in test for #941018
  * d/p/Make-ld-executable-configurable.patch:
    Apply patch from 2.63.x to use cross ld where necessary
  * d/p/gdbus-server-auth-test-Create-temporary-directory-for-Uni.patch:
    Mark as applied upstream in 2.63.x branch
  * Improve patch metadata: use more URLs for bug references

glib2.0 (2.62.2-2) unstable; urgency=medium

  * Team upload
  * Update to upstream commit 2.62.2-14-gfcbb88823:
    - d/p/gdeskto...

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for glib2.0 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.