After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 787897 - segfault in manager_recheck_permissions() when unlocking
segfault in manager_recheck_permissions() when unlocking
Status: RESOLVED FIXED
Product: NetworkManager
Classification: Platform
Component: general
git master
Other Linux
: Normal normal
: ---
Assigned To: NetworkManager maintainer(s)
NetworkManager maintainer(s)
: 788063 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2017-09-19 14:59 UTC by Sebastien Bacher
Modified: 2017-09-26 12:19 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
manager: Disconnect from signals on the proxy in dispose (1.74 KB, patch)
2017-09-20 15:14 UTC, Iain Lane
reviewed Details | Review
manager: Disconnect from signals on the proxy when we're disposed (1.02 KB, patch)
2017-09-22 10:03 UTC, Iain Lane
none Details | Review

Description Sebastien Bacher 2017-09-19 14:59:08 UTC
the bug has been reported on https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/1704618

Using GNOME 3.26 on Ubuntu g-c-c segfaults when unlocking the user panel

"#0  manager_recheck_permissions (proxy=<optimized out>, user_data=0x557a4b8a8bc0) at libnm/nm-manager.c:372
        self = 0x557a4b8a8bc0
        priv = 0x0
  • #1 ffi_call_unix64
    at ../src/x86/unix64.S line 76
  • #2 ffi_call
    at ../src/x86/ffi64.c line 525
  • #3 g_cclosure_marshal_generic
    at ../../../../gobject/gclosure.c line 1490
  • #4 g_closure_invoke
    at ../../../../gobject/gclosure.c line 804
  • #5 signal_emit_unlocked_R
    at ../../../../gobject/gsignal.c line 3635
  • #6 g_signal_emitv
    at ../../../../gobject/gsignal.c line 3129
  • #7 nmdbus_manager_proxy_g_signal
    at introspection/org.freedesktop.NetworkManager.c line 5343
  • #8 ffi_call_unix64
    at ../src/x86/unix64.S line 76
  • #9 ffi_call
    at ../src/x86/ffi64.c line 525
  • #10 g_cclosure_marshal_generic
    at ../../../../gobject/gclosure.c line 1490

Comment 1 Sebastien Bacher 2017-09-19 15:02:11 UTC
valgrind is logging that error

==32010== Invalid read of size 8
==32010==    at 0x9C6D499: manager_recheck_permissions (nm-manager.c:372)
==32010==    by 0x1D6BEE17: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
==32010==    by 0x1D6BE879: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
==32010==    by 0xC194798: g_cclosure_marshal_generic (gclosure.c:1490)
==32010==    by 0xC193F9C: g_closure_invoke (gclosure.c:804)
==32010==    by 0xC1A6D2D: signal_emit_unlocked_R (gsignal.c:3635)
==32010==    by 0xC1AEA6F: g_signal_emitv (gsignal.c:3129)
==32010==    by 0x9CC962C: nmdbus_manager_proxy_g_signal (org.freedesktop.NetworkManager.c:5343)
==32010==    by 0x1D6BEE17: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
==32010==    by 0x1D6BE879: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4)
==32010==    by 0xC194798: g_cclosure_marshal_generic (gclosure.c:1490)
==32010==    by 0xC193F9C: g_closure_invoke (gclosure.c:804)
==32010==    by 0xC1A67A7: signal_emit_unlocked_R (gsignal.c:3673)
==32010==    by 0xC1AF504: g_signal_emit_valist (gsignal.c:3391)
==32010==    by 0xC1B03F7: g_signal_emit_by_name (gsignal.c:3487)
==32010==    by 0xBEC1EDC: signal_cb (gdbusobjectmanagerclient.c:1072)
==32010==    by 0xBEA2693: emit_signal_instance_in_idle_cb (gdbusconnection.c:3720)
==32010==    by 0xC422DD4: g_main_dispatch (gmain.c:3148)
==32010==    by 0xC422DD4: g_main_context_dispatch (gmain.c:3813)
==32010==    by 0xC42319F: g_main_context_iterate.isra.30 (gmain.c:3886)
==32010==    by 0xC42322B: g_main_context_iteration (gmain.c:3947)
==32010==    by 0xBE8AA6C: g_application_run (gapplication.c:2401)
==32010==    by 0x15C391: main (in /tmp/gnome-control-center/shell/gnome-control-center)
==32010==  Address 0x58 is not stack'd, malloc'd or (recently) free'd
==32010==
Comment 2 Sebastien Bacher 2017-09-19 15:02:34 UTC
could it be the same issue than https://bugzilla.gnome.org/show_bug.cgi?id=787893 ?
Comment 3 Iain Lane 2017-09-20 15:14:08 UTC
Created attachment 360136 [details] [review]
manager: Disconnect from signals on the proxy in dispose

We're calling a callback on a proxy after it has been disposed. We
should make sure to disconnect from it.

--

Is this one

  https://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/libnm/nm-manager.c#n1202

(wireless_enabled_cb) leaked too?
Comment 4 Iain Lane 2017-09-20 15:16:54 UTC
(In reply to Sebastien Bacher from comment #2)
> could it be the same issue than
> https://bugzilla.gnome.org/show_bug.cgi?id=787893 ?

same problem (leaked signal handler) in a different location it seems
Comment 5 Rui Matos 2017-09-20 15:18:47 UTC
Review of attachment 360136 [details] [review]:

if we only disconnect on _dispose() I'd use g_signal_connect_object()
Comment 6 Iain Lane 2017-09-21 14:56:46 UTC
(In reply to Rui Matos from comment #5)
> Review of attachment 360136 [details] [review] [review]:
> 
> if we only disconnect on _dispose() I'd use g_signal_connect_object()

I can trivially change it, but I'll wait for a review from the maintainer.
Comment 7 Beniamino Galvani 2017-09-22 09:26:48 UTC
(In reply to Iain Lane from comment #6)
> (In reply to Rui Matos from comment #5)
> > Review of attachment 360136 [details] [review] [review] [review]:
> > 
> > if we only disconnect on _dispose() I'd use g_signal_connect_object()
> 
> I can trivially change it, but I'll wait for a review from the maintainer.

The patch, with the g_signal_connect_object() suggestion, looks good to me, thanks.
Comment 8 Iain Lane 2017-09-22 10:03:07 UTC
Created attachment 360248 [details] [review]
manager: Disconnect from signals on the proxy when we're disposed

We're calling a callback on a proxy after it has been disposed. We
should make sure to disconnect from it when we go away.
Comment 9 Beniamino Galvani 2017-09-22 12:23:15 UTC
(In reply to Iain Lane from comment #8)
> Created attachment 360248 [details] [review] [review]
> manager: Disconnect from signals on the proxy when we're disposed
> 
> We're calling a callback on a proxy after it has been disposed. We
> should make sure to disconnect from it when we go away.

Applied to master:

https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=91fa202379b417f146c9b14be7b9b08d2dc83a78

and nm-1-8, thanks.
Comment 10 Rui Matos 2017-09-26 12:19:56 UTC
*** Bug 788063 has been marked as a duplicate of this bug. ***