Arch Linux

Description:

My XFCE session crashed after I closed a window. I saw this in dmesg:

[155791.127032] traps: xfce4-session[3062] general protection fault ip:55bab078f919 sp:7ffdcda70850 error:0 in xfce4-session[55bab077a000+1a000]

According to GDB there was a segmentation fault here:

Core was generated by `xfce4-session'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 remove_clients_for_connection (service_name=0x7f9c00067380 ":1.2575",
manager=0x55bab1a074a0) at /usr/src/debug/xfce4-session/xfce4-session-4.18.1/xfce4-session/xfsm-manager.c:2079
2079 XfsmClient *client = XFSM_CLIENT (lp->data);
[Current thread is 1 (Thread 0x7f9c0ccf39c0 (LWP 3062))]
(gdb) bt
#0 remove_clients_for_connection (service_name=0x7f9c00067380 ":1.2575", manager=0x55bab1a074a0) at /usr/src/debug/xfce4-session/xfce4-session-4.18.1/xfce4-session/xfsm-manager.c:2079
#1 on_name_owner_notify
(connection=<optimized out>, sender_name=<optimized out>, object_path=<optimized out>, interface_name=<optimized out>, signal_name=<optimized out>, parameters=<optimized out>, user_data=0x55bab1a074a0) at /usr/src/debug/xfce4-session/xfce4-session-4.18.1/xfce4-session/xfsm-manager.c:2104
#2 0x00007f9c10997f68 in emit_signal_instance_in_idle_cb (data=0x7f9c0001c1a0) at ../glib/gio/gdbusconnection.c:3800
#3 0x00007f9c10747afb in g_main_dispatch (context=0x55bab1996110) at ../glib/glib/gmain.c:3460
#4 g_main_context_dispatch (context=0x55bab1996110) at ../glib/glib/gmain.c:4200
#5 0x00007f9c107a45d9 in g_main_context_iterate.constprop.0 (context=0x55bab1996110, block=1, dispatch=1, self=<optimized out>) at ../glib/glib/gmain.c:4276
#6 0x00007f9c107470cf in g_main_loop_run (loop=0x55bab19a1d90) at ../glib/glib/gmain.c:4479
#7 0x00007f9c10fec77d in gtk_main () at ../gtk/gtk/gtkmain.c:1321
#8 0x0000000000000000 in ()
(gdb) list
2074
2075 for (lp = g_queue_peek_nth_link (manager->running_clients, 0);
2076 lp;
2077 lp = lp->next)
2078 {
2079 XfsmClient *client = XFSM_CLIENT (lp->data);
2080 if (g_strcmp0 (xfsm_client_get_service_name (client), service_name) == 0)
2081 {
2082 xfsm_manager_close_connection (manager, client, FALSE);
2083 }


When I inspect the queue itself it looks OK, but the 'lp' pointer is garbage:

(gdb) print *manager->running_clients
$3 = {head = 0x55bab19f4fe0 = {0x55bab19f4570, 0x55bab1bc3b80, 0x55bab1bd2820, 0x55bab1bb6750, 0x55bab1bbfdd0, 0x55bab1bbf9a0, 0x55bab1bbef80, 0x55bab1bbe340, 0x55bab1a153a0,
0x55bab1ab8460, 0x55bab1b54510, 0x55bab1db1200}, tail = 0x55bab1ae62c0 = {0x55bab1db1200}, length = 12}
(gdb) print lp
$1 = 0xa76edaa37074d9ea = {Cannot access memory at address 0xa76edaa37074d9ea


This issue is addressed by upstream commit cff23d0f ("manager: Fix GQueue memory management"):

https://gitlab.xfce.org/xfce/xfce4-session/-/commit/cff23d0fadd502f7db9230f9ebbc02c00853f825


Additional info:
* xfce4-session version 4.18.1-1
* upstream bug report: https://gitlab.xfce.org/xfce/xfce4-session/-/issues/166