gnome-software crashed with SIGSEGV in g_ptr_array_add()

[Anders Pamdal]

...

ProblemType: Crash
DistroRelease: Ubuntu 18.04
Package: gnome-software 3.27.92-0ubuntu2
ProcVersionSignature: Ubuntu 4.15.0-10.11-generic 4.15.3
Uname: Linux 4.15.0-10-generic x86_64
NonfreeKernelModules: wl nvidia_modeset nvidia
ApportVersion: 2.20.8-0ubuntu10
Architecture: amd64
CrashCounter: 1
CurrentDesktop: ubuntu:GNOME
Date: Sun Mar 11 23:22:06 2018
ExecutablePath: /usr/bin/gnome-software
InstallationDate: Installed on 2018-03-03 (8 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Release amd64 (20171018)
InstalledPlugins:
 gnome-software-plugin-flatpak N/A
 gnome-software-plugin-limba N/A
 gnome-software-plugin-snap 3.27.92-0ubuntu2
ProcCmdline: /usr/bin/gnome-software --gapplication-service
ProcEnviron:
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=sv_SE.UTF-8
 SHELL=/bin/bash
SegvAnalysis:
 Segfault happened at: 0x7f497b574e07 <g_ptr_array_add+39>: mov %rbp,(%rdx,%rax,8)
 PC (0x7f497b574e07) ok
 source "%rbp" ok
 destination "(%rdx,%rax,8)" (0x00000000) not located in a known VMA region (needed writable region)!
 Stack memory exhausted (SP below stack segment)
SegvReason: writing NULL VMA
Signal: 11
SourcePackage: gnome-software
StacktraceTop:
 g_ptr_array_add () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
 ?? () from /usr/lib/x86_64-linux-gnu/gs-plugins-11/libgs_plugin_snap.so
 gs_plugin_refine_app () from /usr/lib/x86_64-linux-gnu/gs-plugins-11/libgs_plugin_snap.so
 ?? ()
 ?? ()
Title: gnome-software crashed with SIGSEGV in g_ptr_array_add()
UpgradeStatus: Upgraded to bionic on 2018-03-03 (8 days ago)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo

[Apport retracing service (apport)]

StacktraceTop:
 g_ptr_array_add (array=0x5630d5ce80e0, data=0x5630d5df1030) at ../../../../glib/garray.c:1402
 gs_app_add_channel (app=app@entry=0x7f4930015110, channel=channel@entry=0x5630d5df1030) at ../lib/gs-app.c:4102
 add_channel (app=0x7f4930015110, name=0x7f4930055e10 "stable", version=<optimized out>, tracking_channel=0x7f4955309702 "stable") at ../plugins/snap/gs-plugin-snap.c:753
 refine_channels (tracking_channel=0x7f4955309702 "stable", snap=0x7f4938037bc0, app=0x7f4930015110) at ../plugins/snap/gs-plugin-snap.c:798
 gs_plugin_refine_app (plugin=plugin@entry=0x5630d3beddc0, app=app@entry=0x7f4930015110, flags=flags@entry=2097184, cancellable=cancellable@entry=0x5630d3c16250, error=error@entry=0x7f494bffe878) at ../plugins/snap/gs-plugin-snap.c:862

[Sebastien Bacher (seb128)]

Robert, that's a segfault in the snap/channel code, could you have a look?

[Robert Ancell (robert-ancell)]

The stack trace shows both threads 1 and 6 calling gs_plugin_refine_app in the snap plugin at the same time.

[Robert Ancell (robert-ancell)]

I'm pretty sure this is due to the installed / featured / editor's picks being loaded at the same time and all loading the channel information. The channel code was copied off the screenshot code and has no thread protection.

The solution is to only load the screenshot and channel information when explicitly requested by GNOME software - this is done when you select and individual app. There is possibly other bugs like this and this could also be triggered if other code paths in GNOME Software attempt to load screenshots and channels from different threads.

[Launchpad Janitor (janitor)]

This bug was fixed in the package gnome-software - 3.28.0-0ubuntu3

---------------
gnome-software (3.28.0-0ubuntu3) bionic; urgency=medium

  * debian/patches/0001-snap-Only-refine-screenshots-when-requested.patch:
  * debian/patches/0011-Support-snap-channels.patch:
    - Avoid crash populating snap screenshots and channels (LP: #1755198)

 -- Robert Ancell <email address hidden> Wed, 14 Mar 2018 16:43:28 +1300