Bug 688660 – [abrt] Crash on webdav contact cache update

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 688660 - [abrt] Crash on webdav contact cache update


Summary:	[abrt] Crash on webdav contact cache update


Status:	RESOLVED FIXED

Product:	evolution-data-server
Classification:	Platform
Component:	Contacts
Version:	3.6.x (obsolete)
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	evolution-addressbook-maintainers
QA Contact:	Evolution QA team

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2012-11-19 17:25 UTC by Milan Crha
Modified:	2012-11-20 15:38 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
eds patch (8.37 KB, patch) 2012-11-20 15:32 UTC, Milan Crha	committed	Details \| Review

Description Milan Crha 2012-11-19 17:25:55 UTC

Moving this from a downstream bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=878099

Version-Release number of selected component:
evolution-data-server-3.6.2-1.fc18

Additional info:
libreport version: 2.0.18
abrt_version:   2.0.18
backtrace_rating: 4
cmdline:        /usr/libexec/evolution-addressbook-factory
crash_function: e_xmlhash_remove
kernel:         3.6.6-3.fc18.x86_64

+ Trace 231194

Thread 2 (Thread 0x7fc2f9ffb700 (LWP 6681))

#0 xmlEncodeEntitiesInternal
at entities.c line 731
#1 xmlEncodeEntitiesReentrant__internal_alias
at entities.c line 772
#2 foreach_save_func
at e-xml-hash-utils.c line 114
#3 g_hash_table_foreach
at ghash.c line 1524
#4 e_xml_from_hash
at e-xml-hash-utils.c line 147
#5 e_xmlhash_write
at e-xml-hash-utils.c line 374
#6 e_file_cache_remove_object
at e-file-cache.c line 507
#7 e_book_backend_cache_remove_contact
at e-book-backend-cache.c line 154
#8 download_contacts
at e-book-backend-webdav.c line 1028
#9 book_view_thread
at e-book-backend-webdav.c line 1076
#10 g_thread_proxy
at gthread.c line 797
#11 start_thread
at pthread_create.c line 308
#12 clone
at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 114

Thread 1 (Thread 0x7fc2e7fff700 (LWP 6682))

#0 __GI_raise
at ../nptl/sysdeps/unix/sysv/linux/raise.c line 63
#1 __GI_abort
at abort.c line 90
#2 __libc_message
at ../sysdeps/unix/sysv/linux/libc_fatal.c line 197
#3 malloc_printerr
#4 _int_free
at malloc.c line 3826
#5 g_free
at gmem.c line 252
#6 e_xmlhash_remove
at e-xml-hash-utils.c line 260
#7 e_file_cache_remove_object
at e-file-cache.c line 503
#8 e_book_backend_cache_remove_contact
at e-book-backend-cache.c line 154
#9 download_contacts
at e-book-backend-webdav.c line 1028
#10 book_view_thread
at e-book-backend-webdav.c line 1076
#11 g_thread_proxy
at gthread.c line 797
#12 start_thread
at pthread_create.c line 308
#13 clone
at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 114

Comment 1 Milan Crha 2012-11-19 17:26:38 UTC

Two threads are doing the same thing, which leads to a crash - double free.

Comment 2 Milan Crha 2012-11-20 15:32:14 UTC

Created attachment 229480 [details] [review]
eds patch

for evolution-data-server;

The EBookBackendCache has no internal locking, thus it could interleave in operations, same as the webdav backend doesn't use locking during its update cache (download_contacts function), thus, like in this backtrace, two book views could do the same thing in once.

Comment 3 Milan Crha 2012-11-20 15:38:00 UTC

Created commit 4170376 in eds master (3.7.3+)
Created commit 52e4fb0 in eds gnome-3-6 (3.6.3+)