hughsie/colord

colord-sane crash.

Closed this issue · 4 comments

I have started seeing this crash at boot when colord starts after updating to sane 1.0.27

coredumpctl gdb 508
PID: 508 (colord-sane)
UID: 124 (colord)
GID: 124 (colord)
Signal: 6 (ABRT)
Timestamp: Fri 2017-05-26 19:58:30 EEST (2min 57s ago)
Command Line: /usr/lib/colord/colord-sane
Executable: /usr/lib/colord/colord-sane
Control Group: /system.slice/colord.service
Unit: colord.service
Slice: system.slice
Boot ID: 6ea24718324f4587a75c0cf773f4ee50
Machine ID: efb490e643e2436d9d1138df1745a008
Hostname: hades
Storage: /var/lib/systemd/coredump/core.colord-sane.124.6ea24718324f4587a75c0cf773f4ee50.508.1495817910000000.lz4
Message: Process 508 (colord-sane) of user 124 dumped core.

            Stack trace of thread 512:
            #0  0x00007fc367e32620 raise (libc.so.6)
            #1  0x00007fc367e33c80 abort (libc.so.6)
            #2  0x00007fc3686a1a81 g_thread_abort (libglib-2.0.so.0)
            #3  0x00007fc3686a200a g_private_set (libglib-2.0.so.0)
            #4  0x00007fc36867a48d thread_memory_from_self (libglib-2.0.so.0)
            #5  0x00007fc36867b05f g_slist_delete_link (libglib-2.0.so.0)
            #6  0x00007fc36893a7e5 g_object_unref (libgobject-2.0.so.0)
            #7  0x00007fc3675aed0e on_worker_message_about_to_be_sent (libgio-2.0.so.0)
            #8  0x00007fc3675c351e _g_dbus_worker_emit_message_about_to_be_sent (libgio-2.0.so.0)
            #9  0x00007fc3675c36a9 continue_writing_in_idle_cb (libgio-2.0.so.0)
            #10 0x00007fc36865cb15 g_main_dispatch (libglib-2.0.so.0)
            #11 0x00007fc36865ced8 g_main_context_iterate (libglib-2.0.so.0)
            #12 0x00007fc36865d1f2 g_main_loop_run (libglib-2.0.so.0)
            #13 0x00007fc3675c1ee6 gdbus_shared_thread_func (libgio-2.0.so.0)
            #14 0x00007fc3686844c5 g_thread_proxy (libglib-2.0.so.0)
            #15 0x00007fc3681ab247 start_thread (libpthread.so.0)
            #16 0x00007fc367eebe2f __clone (libc.so.6)
            
            Stack trace of thread 508:
            #0  0x00007fc3692073ac n/a (n/a)
            #1  0x00007fc369207682 n/a (n/a)
            #2  0x00007fc367e35218 __run_exit_handlers (libc.so.6)
            #3  0x00007fc367e3526a exit (libc.so.6)
            #4  0x00007fc367e1f441 __libc_start_main (libc.so.6)
            #5  0x000055c08010680a _start (colord-sane)
            
            Stack trace of thread 511:
            #0  0x00007fc367ee6f89 syscall (libc.so.6)
            #1  0x00007fc3686a260a g_cond_wait_until (libglib-2.0.so.0)
            #2  0x00007fc3686313b1 g_async_queue_pop_intern_unlocked (libglib-2.0.so.0)
            #3  0x00007fc36863196c g_async_queue_timeout_pop (libglib-2.0.so.0)
            #4  0x00007fc368684f6e g_thread_pool_wait_for_new_pool (libglib-2.0.so.0)
            #5  0x00007fc3686844c5 g_thread_proxy (libglib-2.0.so.0)
            #6  0x00007fc3681ab247 start_thread (libpthread.so.0)
            #7  0x00007fc367eebe2f __clone (libc.so.6)
            
            Stack trace of thread 515:
            #0  0x00007fc367ee1e8d poll (libc.so.6)
            #1  0x00007fc3670e1b21 poll (libusb-1.0.so.0)
            #2  0x00007fc3681ab247 start_thread (libpthread.so.0)
            #3  0x00007fc367eebe2f __clone (libc.so.6)
            
            Stack trace of thread 510:
            #0  0x00007fc367ee1e8d poll (libc.so.6)
            #1  0x00007fc36865ce59 g_main_context_poll (libglib-2.0.so.0)
            #2  0x00007fc36865cf6c g_main_context_iteration (libglib-2.0.so.0)
            #3  0x00007fc36865cfb1 glib_worker_main (libglib-2.0.so.0)
            #4  0x00007fc3686844c5 g_thread_proxy (libglib-2.0.so.0)
            #5  0x00007fc3681ab247 start_thread (libpthread.so.0)
            #6  0x00007fc367eebe2f __clone (libc.so.6)

GNU gdb (GDB) 7.12.1
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/lib/colord/colord-sane...done.
[New LWP 512]
[New LWP 508]
[New LWP 511]
[New LWP 515]
[New LWP 510]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `/usr/lib/colord/colord-sane'.
Program terminated with signal SIGABRT, Aborted.
#0 0x00007fc367e32620 in raise () from /usr/lib/libc.so.6
[Current thread is 1 (Thread 0x7fc364abc700 (LWP 512))]
(gdb) thread apply all bt full

Thread 5 (Thread 0x7fc365abe700 (LWP 510)):
#0 0x00007fc367ee1e8d in poll () at /usr/lib/libc.so.6
#1 0x00007fc36865ce59 in g_main_context_poll (priority=, n_fds=1, fds=0x7fc3600008e0, timeout=, context=0x55c082048370)
at gmain.c:4271
poll_func = 0x7fc36866c350 <g_poll>
max_priority = 2147483647
timeout = -1
some_ready =
nfds = 1
allocated_nfds = 1
fds = 0x7fc3600008e0
#2 0x00007fc36865ce59 in g_main_context_iterate (context=context@entry=0x55c082048370, block=block@entry=1, dispatch=dispatch@entry=1, self=)
at gmain.c:3967
max_priority = 2147483647
timeout = -1
some_ready =
nfds = 1
allocated_nfds = 1
fds = 0x7fc3600008e0
#3 0x00007fc36865cf6c in g_main_context_iteration (context=0x55c082048370, may_---Type to continue, or q to quit---
block=may_block@entry=1) at gmain.c:4033
retval =
#4 0x00007fc36865cfb1 in glib_worker_main (data=)
at gmain.c:5824
#5 0x00007fc3686844c5 in g_thread_proxy (data=0x55c082048800) at gthread.c:784
thread = 0x55c082048800
#6 0x00007fc3681ab247 in start_thread () at /usr/lib/libpthread.so.0
#7 0x00007fc367eebe2f in clone () at /usr/lib/libc.so.6

Thread 4 (Thread 0x7fc357d95700 (LWP 515)):
#0 0x00007fc367ee1e8d in poll () at /usr/lib/libc.so.6
#1 0x00007fc3670e1b21 in poll (__timeout=-1, __nfds=2, __fds=0x7fc357d94e50)
at /usr/include/bits/poll2.h:46
dummy = 0 '\000'
r =
udev_dev =
fds =
{{fd = 8, events = 1, revents = 0}, {fd = 7, events = 1, revents = 0}}
FUNCTION = "linux_udev_event_thread_main"
#2 0x00007fc3670e1b21 in linux_udev_event_thread_main (arg=)
at os/linux_udev.c:175
dummy = 0 '\000'
---Type to continue, or q to quit---
r =
udev_dev =
fds =
{{fd = 8, events = 1, revents = 0}, {fd = 7, events = 1, revents = 0}}
FUNCTION = "linux_udev_event_thread_main"
#3 0x00007fc3681ab247 in start_thread () at /usr/lib/libpthread.so.0
#4 0x00007fc367eebe2f in clone () at /usr/lib/libc.so.6

Thread 3 (Thread 0x7fc3652bd700 (LWP 511)):
#0 0x00007fc367ee6f89 in syscall () at /usr/lib/libc.so.6
#1 0x00007fc3686a260a in g_cond_wait_until (cond=cond@entry=0x55c0820482b8, mutex=mutex@entry=0x55c0820482b0, end_time=end_time@entry=60726001)
at gthread-posix.c:1442
now = {tv_sec = 45, tv_nsec = 726002039}
span = {tv_sec = 14, tv_nsec = 999998961}
sampled = 0
res =
#2 0x00007fc3686313b1 in g_async_queue_pop_intern_unlocked (queue=queue@entry=0x55c0820482b0, wait=wait@entry=1, end_time=end_time@entry=60726001)
at gasyncqueue.c:422
retval =
func = "g_async_queue_pop_intern_unlocked"
---Type to continue, or q to quit---
#3 0x00007fc36863196c in g_async_queue_timeout_pop (queue=0x55c0820482b0, timeout=timeout@entry=15000000) at gasyncqueue.c:543
end_time = 60726001
retval =
#4 0x00007fc368684f6e in g_thread_pool_wait_for_new_pool ()
at gthreadpool.c:167
pool =
local_wakeup_thread_serial =
last_wakeup_thread_serial =
have_relayed_thread_marker =
free_pool =
pool =
#5 0x00007fc368684f6e in g_thread_pool_thread_proxy (data=)
at gthreadpool.c:364
free_pool =
pool =
#6 0x00007fc3686844c5 in g_thread_proxy (data=0x55c082048850) at gthread.c:784
thread = 0x55c082048850
#7 0x00007fc3681ab247 in start_thread () at /usr/lib/libpthread.so.0
#8 0x00007fc367eebe2f in clone () at /usr/lib/libc.so.6

Thread 2 (Thread 0x7fc369342400 (LWP 508)):
#0 0x00007fc3692073ac in _dl_sort_fini () at /lib64/ld-linux-x86-64.so.2
---Type to continue, or q to quit---
#1 0x00007fc369207682 in _dl_fini () at /lib64/ld-linux-x86-64.so.2
#2 0x00007fc367e35218 in __run_exit_handlers () at /usr/lib/libc.so.6
#3 0x00007fc367e3526a in () at /usr/lib/libc.so.6
#4 0x00007fc367e1f441 in __libc_start_main () at /usr/lib/libc.so.6
#5 0x000055c08010680a in _start ()

Thread 1 (Thread 0x7fc364abc700 (LWP 512)):

#0 0x00007fc367e32620 in raise () at /usr/lib/libc.so.6
#1 0x00007fc367e33c80 in abort () at /usr/lib/libc.so.6
#2 0x00007fc3686a1a81 in g_thread_abort (status=, function=function@entry=0x7fc368704b31 "pthread_setspecific") at gthread-posix.c:78
#3 0x00007fc3686a200a in g_private_set (key=key@entry=0x7fc368924ae0 <private_thread_memory>, value=value@entry=0x7fc35c005a40) at gthread-posix.c:1076
status =
#4 0x00007fc36867a48d in thread_memory_from_self () at gslice.c:522

    n_magazines = <optimized out>
    init_mutex = {p = 0x0, i = {0, 0}}
    tmem = 0x7fc35c005a40
    tmem = <optimized out>
    init_mutex = {p = 0x0, i = {0, 0}}
    ix = <optimized out>
    chunk_size = 16

#5 0x00007fc36867a48d in g_slice_free1 (mem_size=16, mem_block=0x55c082041810)
---Type to continue, or q to quit---
at gslice.c:1112
ix =
chunk_size = 16
#6 0x00007fc36867b05f in g_slist_delete_link (list=, link_=) at gslist.c:544
#7 0x00007fc36893a7e5 in g_object_unref (_object=0x55c082052080)
at gobject.c:3269
weak_ref_location =
weak_locations = 0x55c082051a30
old_ref =
object = 0x55c082052080 [GDBusConnection]
object = 0x55c082052080 [GDBusConnection]

#8 0x00007fc3675aed0e in on_worker_message_about_to_be_sent (worker=, message=0x55c082048b20 [GDBusMessage], user_data=)
at gdbusconnection.c:2360
connection = 0x55c082052080 [GDBusConnection]
filters = 0x7fc35c004c40
n =
alive =
#9 0x00007fc3675c351e in _g_dbus_worker_emit_message_about_to_be_sent (message=0x55c082048b20 [GDBusMessage], worker=0x7fc35800ca70) at gdbusprivate.c:488
ret = 0x0

    old_message = 0x55c082048b20 [GDBusMessage]

---Type to continue, or q to quit---
new_blob =
new_blob_size = 140477241968633
error = 0x0
data = 0x55c082055130
flush_async_data = 0x0
func = "continue_writing"
#10 0x00007fc3675c351e in continue_writing (worker=0x7fc35800ca70)
at gdbusprivate.c:1479
old_message = 0x55c082048b20 [GDBusMessage]
new_blob =
new_blob_size = 140477241968633
error = 0x0
data = 0x55c082055130
flush_async_data = 0x0
func = "continue_writing"
#11 0x00007fc3675c36a9 in continue_writing_in_idle_cb (user_data=) at gdbusprivate.c:1540
worker =
#12 0x00007fc36865cb15 in g_main_dispatch (context=0x7fc35800a8d0)
at gmain.c:3234
dispatch = 0x7fc368659450 <g_idle_dispatch>
prev_source = 0x0
was_in_call = 0
---Type to continue, or q to quit---
user_data = 0x7fc35800ca70
callback = 0x7fc3675c3690 <continue_writing_in_idle_cb>
cb_funcs = 0x7fc368924920 <g_source_callback_funcs>
cb_data = 0x55c082184de0
need_destroy =
source = 0x55c082155650
current = 0x7fc3580014b0
i = 0
#13 0x00007fc36865cb15 in g_main_context_dispatch (context=context@entry=0x7fc35800a8d0) at gmain.c:3899
#14 0x00007fc36865ced8 in g_main_context_iterate (context=0x7fc35800a8d0, block=block@entry=1, dispatch=dispatch@entry=1, self=) at gmain.c:3972
max_priority = 2147483647
timeout = -1
some_ready = 1
nfds =
allocated_nfds = 2
fds = 0x7fc35c0010c0
#15 0x00007fc36865d1f2 in g_main_loop_run (loop=0x7fc35800c850) at gmain.c:4168
func = "g_main_loop_run"
#16 0x00007fc3675c1ee6 in gdbus_shared_thread_func (user_data=0x7fc35800ca10)
at gdbusprivate.c:272
data = 0x7fc35800ca10
---Type to continue, or q to quit---
#17 0x00007fc3686844c5 in g_thread_proxy (data=0x55c082048ed0) at gthread.c:784
thread = 0x55c082048ed0
#18 0x00007fc3681ab247 in start_thread () at /usr/lib/libpthread.so.0
#19 0x00007fc367eebe2f in clone () at /usr/lib/libc.so.6

I think you need to report this to the same project.

ok, thank you. I will.

This is a bug in OpenSSL which deletes one of GLib's thread-local storage keys from atexit while GDBus is still doing stuff in a worker thread.

Just for correctness, can GDBus be shut down properly before main() ends?