network manager crashes constantly. FIX IS UPSTREAM

Bug #1547575 reported by Michael Leibowitz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
network-manager (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

# cat /etc/os-release
NAME="Ubuntu"
VERSION="15.10 (Wily Werewolf)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 15.10"
VERSION_ID="15.10"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"

$ dpkg -l network-manager
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===============================================-============================-============================-===================================================================================================
ii network-manager 1.0.4-0ubuntu5.2 amd64 network management framework (daemon and userspace tools)

from: _usr_sbin_NetworkManager.0.crash
SegvReason: reading NULL VMA
SourcePackage: network-manager
Stacktrace:
 #0 0x0000000000497b07 in on_bss_proxy_acquired (proxy=0xeefbb0 [GDBusProxy], result=0x17dfb40, user_data=<optimized out>) at supplicant-manager/nm-supplicant-interface.c:157
         self = 0xf5e0b0 [NMSupplicantInterface]
         error = 0x0
         properties = 0x0
         props = 0x0
         builder = {x = {0, 15699024, 15699025, 0, 0, 18446744073709551615, 17780224, 8, 0, 3, 1033660112, 0, 0, 0, 0, 0}}
         iter = <optimized out>
         __func__ = "on_bss_proxy_acquired"
 #1 0x00007fab9c9b85f3 in g_task_return_now (task=0x17dfb40 [GTask]) at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gio/gtask.c:1104
 #2 0x00007fab9c9b8c7e in g_task_return (task=0x17dfb40 [GTask], type=<optimized out>) at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gio/gtask.c:1162
         source = 0x7fab8e54a140
 #3 0x00007fab9ca10efd in init_second_async_cb (source_object=<optimized out>, res=<optimized out>, user_data=0x17dfb40) at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gio/gdbusproxy.c:1805
         task = 0x17dfb40 [GTask]
         error = 0x0
 #4 0x00007fab9c9b85f3 in g_task_return_now (task=0x17dc8f0 [GTask]) at /build/glib2.0-ajuDY6/glib2.0-2.46.1/./gio/gtask.c:1104

NetworkManager$ git show 33527341b1e35034a4f1736df4bc98f8ac8418ab
commit 33527341b1e35034a4f1736df4bc98f8ac8418ab
Author: Jiří Klimeš <email address hidden>
Date: Thu May 7 11:27:26 2015 +0200

    wifi: fix a crash in on_bss_proxy_acquired()

    g_dbus_proxy_get_cached_property_names() function can return NULL.

     Program received signal SIGSEGV, Segmentation fault.
     on_bss_proxy_acquired (proxy=0x7fffe4003880 [GDBusProxy], result=0x895490, user_data=<optimized out>) at supplicant-manager/nm-supplicant-interface.c:159
     159 while (*iter) {
     (gdb) bt
     #0 0x000000000048fac7 in on_bss_proxy_acquired (proxy=0x7fffe4003880 [GDBusProxy], result=0x895490, user_data=<optimized out>)
         at supplicant-manager/nm-supplicant-interface.c:159
     #1 0x0000003bf84728b7 in g_simple_async_result_complete (simple=0x895490 [GSimpleAsyncResult]) at gsimpleasyncresult.c:763
     #2 0x0000003bf8472919 in complete_in_idle_cb (data=<optimized out>) at gsimpleasyncresult.c:775
     #3 0x0000003bf5c497fb in g_main_context_dispatch (context=0x7d6420) at gmain.c:3111
     #4 0x0000003bf5c497fb in g_main_context_dispatch (context=context@entry=0x7d6420) at gmain.c:3710
     #5 0x0000003bf5c49b98 in g_main_context_iterate (context=0x7d6420, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3781
     #6 0x0000003bf5c49ec2 in g_main_loop_run (loop=0x7d64e0) at gmain.c:3975
     #7 0x00000000004349d6 in main (argc=1, argv=0x7fffffffe598) at main.c:486

diff --git a/src/supplicant-manager/nm-supplicant-interface.c b/src/supplicant-manager/nm-supplicant-interface.c
index 4731ad7..19795bf 100644
--- a/src/supplicant-manager/nm-supplicant-interface.c
+++ b/src/supplicant-manager/nm-supplicant-interface.c
@@ -156,7 +156,7 @@ on_bss_proxy_acquired (GDBusProxy *proxy, GAsyncResult *result, gpointer user_da
        g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{sv}"));

        iter = properties = g_dbus_proxy_get_cached_property_names (proxy);
- while (*iter) {
+ while (iter && *iter) {
                GVariant *copy = g_dbus_proxy_get_cached_property (proxy, *iter);

                g_variant_builder_add (&builder, "{sv}", *iter++, copy);

Aron Xu (happyaron)
Changed in network-manager (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.