gnome-software crashed with SIGSEGV in g_ptr_array_add()

Bug #1755198 reported by Anders Pamdal on 2018-03-12
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
gnome-software (Ubuntu)
High
Robert Ancell

Bug Description

...

ProblemType: Crash
DistroRelease: Ubuntu 18.04
Package: gnome-software 3.27.92-0ubuntu2
ProcVersionSignature: Ubuntu 4.15.0-10.11-generic 4.15.3
Uname: Linux 4.15.0-10-generic x86_64
NonfreeKernelModules: wl nvidia_modeset nvidia
ApportVersion: 2.20.8-0ubuntu10
Architecture: amd64
CrashCounter: 1
CurrentDesktop: ubuntu:GNOME
Date: Sun Mar 11 23:22:06 2018
ExecutablePath: /usr/bin/gnome-software
InstallationDate: Installed on 2018-03-03 (8 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Release amd64 (20171018)
InstalledPlugins:
 gnome-software-plugin-flatpak N/A
 gnome-software-plugin-limba N/A
 gnome-software-plugin-snap 3.27.92-0ubuntu2
ProcCmdline: /usr/bin/gnome-software --gapplication-service
ProcEnviron:
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=sv_SE.UTF-8
 SHELL=/bin/bash
SegvAnalysis:
 Segfault happened at: 0x7f497b574e07 <g_ptr_array_add+39>: mov %rbp,(%rdx,%rax,8)
 PC (0x7f497b574e07) ok
 source "%rbp" ok
 destination "(%rdx,%rax,8)" (0x00000000) not located in a known VMA region (needed writable region)!
 Stack memory exhausted (SP below stack segment)
SegvReason: writing NULL VMA
Signal: 11
SourcePackage: gnome-software
StacktraceTop:
 g_ptr_array_add () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
 ?? () from /usr/lib/x86_64-linux-gnu/gs-plugins-11/libgs_plugin_snap.so
 gs_plugin_refine_app () from /usr/lib/x86_64-linux-gnu/gs-plugins-11/libgs_plugin_snap.so
 ?? ()
 ?? ()
Title: gnome-software crashed with SIGSEGV in g_ptr_array_add()
UpgradeStatus: Upgraded to bionic on 2018-03-03 (8 days ago)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo

Anders Pamdal (anders-pamdal) wrote :
tags: removed: need-amd64-retrace
tags: added: need-amd64-retrace

StacktraceTop:
 g_ptr_array_add (array=0x5630d5ce80e0, data=0x5630d5df1030) at ../../../../glib/garray.c:1402
 gs_app_add_channel (app=app@entry=0x7f4930015110, channel=channel@entry=0x5630d5df1030) at ../lib/gs-app.c:4102
 add_channel (app=0x7f4930015110, name=0x7f4930055e10 "stable", version=<optimized out>, tracking_channel=0x7f4955309702 "stable") at ../plugins/snap/gs-plugin-snap.c:753
 refine_channels (tracking_channel=0x7f4955309702 "stable", snap=0x7f4938037bc0, app=0x7f4930015110) at ../plugins/snap/gs-plugin-snap.c:798
 gs_plugin_refine_app (plugin=plugin@entry=0x5630d3beddc0, app=app@entry=0x7f4930015110, flags=flags@entry=2097184, cancellable=cancellable@entry=0x5630d3c16250, error=error@entry=0x7f494bffe878) at ../plugins/snap/gs-plugin-snap.c:862

Changed in gnome-software (Ubuntu):
importance: Undecided → Medium
tags: removed: need-amd64-retrace
Sebastien Bacher (seb128) wrote :

Robert, that's a segfault in the snap/channel code, could you have a look?

information type: Private → Public
Changed in gnome-software (Ubuntu):
assignee: nobody → Robert Ancell (robert-ancell)
importance: Medium → High
Robert Ancell (robert-ancell) wrote :

The stack trace shows both threads 1 and 6 calling gs_plugin_refine_app in the snap plugin at the same time.

Robert Ancell (robert-ancell) wrote :

I'm pretty sure this is due to the installed / featured / editor's picks being loaded at the same time and all loading the channel information. The channel code was copied off the screenshot code and has no thread protection.

The solution is to only load the screenshot and channel information when explicitly requested by GNOME software - this is done when you select and individual app. There is possibly other bugs like this and this could also be triggered if other code paths in GNOME Software attempt to load screenshots and channels from different threads.

Changed in gnome-software (Ubuntu):
status: New → Fix Committed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gnome-software - 3.28.0-0ubuntu3

---------------
gnome-software (3.28.0-0ubuntu3) bionic; urgency=medium

  * debian/patches/0001-snap-Only-refine-screenshots-when-requested.patch:
  * debian/patches/0011-Support-snap-channels.patch:
    - Avoid crash populating snap screenshots and channels (LP: #1755198)

 -- Robert Ancell <email address hidden> Wed, 14 Mar 2018 16:43:28 +1300

Changed in gnome-software (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers