ALT Linux Bugzilla
– Attachment 9538 Details for
Bug 40585
lightdm: use-after-free, потенциально приводящий к прекращению работы функции запуска "предыдущей сессии"
New bug
|
Search
|
[?]
|
Help
Register
|
Log In
[x]
|
Forgot Password
Login:
[x]
|
EN
|
RU
lightdm.gdb.log
lightdm.gdb.log (text/x-log), 16.76 KB, created by
Aleksei Nikiforov
on 2021-07-27 13:45:13 MSK
(
hide
)
Description:
lightdm.gdb.log
Filename:
MIME Type:
Creator:
Aleksei Nikiforov
Created:
2021-07-27 13:45:13 MSK
Size:
16.76 KB
patch
obsolete
>(gdb) break g_variant_new_string >Breakpoint 1 at 0x7fcfb8989d43: file ../glib/gvariant.c, line 1261. >(gdb) break greeter_start_session_cb >Breakpoint 2 at 0x56132be64bb4: file seat.c, line 1184. >(gdb) c >Continuing. >[Thread 0x7fcfb7392640 (LWP 30646) exited] >[Detaching after fork from child process 30709] > >Thread 1 "lightdm" hit Breakpoint 2, greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x0, seat=0x56132d08c4c0) at seat.c:1184 >1184 { >(gdb) break find_session_config >Breakpoint 3 at 0x56132be6406a: file seat.c, line 1003. >(gdb) c >Continuing. > >[Switching to Thread 0x7fcfb8395800 (LWP 30643)] > >Thread 1 "lightdm" hit Breakpoint 1, g_variant_new_string (string=0x56132d0b1ca0 "\261`2\301\312\177") at ../glib/gvariant.c:1261 >1261 g_return_val_if_fail (string != NULL, NULL); >(gdb) bt >#0 g_variant_new_string (string=0x56132d0b1ca0 "\261`2\301\312\177") at ../glib/gvariant.c:1261 >#1 0x00007fcfb898ec4b in g_variant_valist_new_nnp (str=0x7ffd2493d6f8, ptr=0x56132d0b1ca0) at ../glib/gvariant.c:4796 >#2 0x00007fcfb898f2ab in g_variant_valist_new_leaf (str=0x7ffd2493d6f8, app=0x7ffd2493d740) at ../glib/gvariant.c:4991 >#3 0x00007fcfb898faf1 in g_variant_valist_new (str=0x7ffd2493d6f8, app=0x7ffd2493d740) at ../glib/gvariant.c:5173 >#4 0x00007fcfb898fdc3 in g_variant_valist_new (str=0x7ffd2493d6f8, app=0x7ffd2493d740) at ../glib/gvariant.c:5225 >#5 0x00007fcfb8990233 in g_variant_new_va (format_string=0x56132be8b359 ")", endptr=0x0, app=0x7ffd2493d740) at ../glib/gvariant.c:5401 >#6 0x00007fcfb899017a in g_variant_new (format_string=0x56132be8b357 "(s)") at ../glib/gvariant.c:5336 >#7 0x000056132be811ba in common_user_set_session (user=0x56132d0b38c0, session=0x56132d0b1ca0 "\261`2\301\312\177") at user-list.c:1407 >#8 0x000056132be50bbe in user_set_xsession (user=0x7fcfac00c300, xsession=0x56132d0b1ca0 "\261`2\301\312\177") at accounts.c:113 >#9 0x000056132be64dc7 in greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x56132d0b1ca0 "\261`2\301\312\177", seat=0x56132d08c4c0) at seat.c:1232 >#10 0x00007fcfb8469bad in ffi_call_unix64 () at ../src/x86/unix64.S:101 >#11 0x00007fcfb846913a in ffi_call_int (cif=0x7ffd2493db50, fn=0x56132be64b8b <greeter_start_session_cb>, rvalue=<optimized out>, avalue=<optimized out>, closure=<optimized out>) at ../src/x86/ffi64.c:669 >#12 0x00007fcfb8a47592 in g_cclosure_marshal_generic (closure=0x56132d09d920, return_gvalue=0x7ffd2493dd50, n_param_values=3, param_values=0x7ffd2493dd80, invocation_hint=0x7ffd2493dd30, marshal_data=0x0) at ../gobject/gclosure.c:1510 >#13 0x00007fcfb8a45b1a in g_closure_invoke (closure=0x56132d09d920, return_value=0x7ffd2493dd50, n_param_values=3, param_values=0x7ffd2493dd80, invocation_hint=0x7ffd2493dd30) at ../gobject/gclosure.c:810 >#14 0x00007fcfb8a64d94 in signal_emit_unlocked_R (node=0x56132d0a4650, detail=0, instance=0x56132d092460, emission_return=0x7ffd2493df80, instance_and_params=0x7ffd2493dd80) at ../gobject/gsignal.c:3741 >#15 0x00007fcfb8a64082 in g_signal_emit_valist (instance=0x56132d092460, signal_id=36, detail=0, var_args=0x7ffd2493e010) at ../gobject/gsignal.c:3507 >#16 0x00007fcfb8a64595 in g_signal_emit (instance=0x56132d092460, signal_id=36, detail=0) at ../gobject/gsignal.c:3553 >#17 0x000056132be56c6f in handle_start_session (greeter=0x56132d092460, session=0x0) at greeter.c:745 >#18 0x000056132be57a43 in read_cb (source=0x56132d08dba0, condition=G_IO_IN, data=0x56132d092460) at greeter.c:1032 >#19 0x000056132be576ed in read_cb (source=0x56132d08dba0, condition=G_IO_IN, data=0x56132d092460) at greeter.c:964 >#20 0x00007fcfb89a1e86 in g_io_unix_dispatch (source=0x56132d0bbc60, callback=0x56132be5747a <read_cb>, user_data=0x56132d092460) at ../glib/giounix.c:166 >#21 0x00007fcfb893a50d in g_main_dispatch (context=0x56132d07af30) at ../glib/gmain.c:3337 >#22 0x00007fcfb893b504 in g_main_context_dispatch (context=0x56132d07af30) at ../glib/gmain.c:4055 >#23 0x00007fcfb893b6ff in g_main_context_iterate (context=0x56132d07af30, block=1, dispatch=1, self=0x7fcfa8003410) at ../glib/gmain.c:4131 >#24 0x00007fcfb893bbc0 in g_main_loop_run (loop=0x56132d076890) at ../glib/gmain.c:4329 >#25 0x000056132be5cf70 in main (argc=1, argv=0x7ffd2493ed58) at lightdm.c:915 >(gdb) info break >Num Type Disp Enb Address What >1 breakpoint keep y 0x00007fcfb8989d43 in g_variant_new_string at ../glib/gvariant.c:1261 > breakpoint already hit 1 time >2 breakpoint keep y 0x000056132be64bb4 in greeter_start_session_cb at seat.c:1184 > breakpoint already hit 1 time >3 breakpoint keep y 0x000056132be6406a in find_session_config at seat.c:1003 >(gdb) disable 1 >(gdb) disable 3 >(gdb) c >Continuing. > >[Detaching after fork from child process 30771] >[Switching to Thread 0x7fcfb8395800 (LWP 30643)] > >Thread 1 "lightdm" hit Breakpoint 2, greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x0, seat=0x56132d08c4c0) at seat.c:1184 >1184 { >(gdb) print session_name >$1 = (const gchar *) 0x0 >(gdb) print &session_name >$2 = (const gchar **) 0x7ffd2493d898 >(gdb) print *((const gchar **) 0x7ffd2493d898) >$3 = (const gchar *) 0x0 >(gdb) watch *((const gchar **) 0x7ffd2493d898) >Hardware watchpoint 4: *((const gchar **) 0x7ffd2493d898) >(gdb) finish >Run till exit from #0 greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x0, seat=0x56132d08c4c0) at seat.c:1184 > >Thread 1 "lightdm" hit Hardware watchpoint 4: *((const gchar **) 0x7ffd2493d898) > >Old value = (const gchar *) 0x0 >New value = (const gchar *) 0x56132d090940 "Session" >greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x56132d090940 "Session", seat=0x56132d08c4c0) at seat.c:1226 >1226 language = user_get_language (user); >(gdb) bt >#0 greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x56132d090940 "Session", seat=0x56132d08c4c0) at seat.c:1226 >#1 0x00007fcfb8469bad in ffi_call_unix64 () at ../src/x86/unix64.S:101 >#2 0x00007fcfb846913a in ffi_call_int (cif=0x7ffd2493db50, fn=0x56132be64b8b <greeter_start_session_cb>, rvalue=<optimized out>, avalue=<optimized out>, closure=<optimized out>) at ../src/x86/ffi64.c:669 >#3 0x00007fcfb8a47592 in g_cclosure_marshal_generic (closure=0x56132d09d920, return_gvalue=0x7ffd2493dd50, n_param_values=3, param_values=0x7ffd2493dd80, invocation_hint=0x7ffd2493dd30, marshal_data=0x0) at ../gobject/gclosure.c:1510 >#4 0x00007fcfb8a45b1a in g_closure_invoke (closure=0x56132d09d920, return_value=0x7ffd2493dd50, n_param_values=3, param_values=0x7ffd2493dd80, invocation_hint=0x7ffd2493dd30) at ../gobject/gclosure.c:810 >#5 0x00007fcfb8a64d94 in signal_emit_unlocked_R (node=0x56132d0a4650, detail=0, instance=0x56132d092460, emission_return=0x7ffd2493df80, instance_and_params=0x7ffd2493dd80) at ../gobject/gsignal.c:3741 >#6 0x00007fcfb8a64082 in g_signal_emit_valist (instance=0x56132d092460, signal_id=36, detail=0, var_args=0x7ffd2493e010) at ../gobject/gsignal.c:3507 >#7 0x00007fcfb8a64595 in g_signal_emit (instance=0x56132d092460, signal_id=36, detail=0) at ../gobject/gsignal.c:3553 >#8 0x000056132be56c6f in handle_start_session (greeter=0x56132d092460, session=0x0) at greeter.c:745 >#9 0x000056132be57a43 in read_cb (source=0x56132d08dba0, condition=G_IO_IN, data=0x56132d092460) at greeter.c:1032 >#10 0x000056132be576ed in read_cb (source=0x56132d08dba0, condition=G_IO_IN, data=0x56132d092460) at greeter.c:964 >#11 0x00007fcfb89a1e86 in g_io_unix_dispatch (source=0x56132d0bbc60, callback=0x56132be5747a <read_cb>, user_data=0x56132d092460) at ../glib/giounix.c:166 >#12 0x00007fcfb893a50d in g_main_dispatch (context=0x56132d07af30) at ../glib/gmain.c:3337 >#13 0x00007fcfb893b504 in g_main_context_dispatch (context=0x56132d07af30) at ../glib/gmain.c:4055 >#14 0x00007fcfb893b6ff in g_main_context_iterate (context=0x56132d07af30, block=1, dispatch=1, self=0x7fcfa8003410) at ../glib/gmain.c:4131 >#15 0x00007fcfb893bbc0 in g_main_loop_run (loop=0x56132d076890) at ../glib/gmain.c:4329 >#16 0x000056132be5cf70 in main (argc=1, argv=0x7ffd2493ed58) at lightdm.c:915 >(gdb) l >1221 if (!session_name && g_strcmp0 (user_get_name (user), autologin_username) == 0) >1222 session_name = seat_get_string_property (seat, "autologin-session"); >1223 >1224 if (!session_name) >1225 session_name = user_get_xsession (user); >1226 language = user_get_language (user); >1227 } >1228 >1229 if (!session_name) >1230 session_name = seat_get_string_property (seat, "user-session"); >(gdb) c >Continuing. > >[Switching to Thread 0x7fcfb8395800 (LWP 30643)] > >Thread 1 "lightdm" hit Breakpoint 5, greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x56132d090940 "@*:L\026V", seat=0x56132d08c4c0) at seat.c:1229 >1229 if (!session_name) >(gdb) l >1224 if (!session_name) >1225 session_name = user_get_xsession (user); >1226 language = user_get_language (user); >1227 } >1228 >1229 if (!session_name) >1230 session_name = seat_get_string_property (seat, "user-session"); >1231 if (user) >1232 user_set_xsession (session_get_user (session), session_name); >1233 >(gdb) print session_name >$4 = (const gchar *) 0x56132d090940 "@*:L\026V" >(gdb) l >1234 g_autoptr(SessionConfig) session_config = find_session_config (seat, sessions_dir, session_name); >1235 if (!session_config) >1236 { >1237 l_debug (seat, "Can't find session '%s'", session_name); >1238 return FALSE; >1239 } >1240 >1241 configure_session (session, session_config, session_name, language); >1242 g_auto(GStrv) argv = get_session_argv (seat, session_config, get_session_wrapper (seat, session, "session-wrapper", "wayland-session-wrapper")); >1243 session_set_argv (session, argv); >(gdb) info break >Num Type Disp Enb Address What >1 breakpoint keep n 0x00007fcfb8989d43 in g_variant_new_string at ../glib/gvariant.c:1261 > breakpoint already hit 1 time >2 breakpoint keep y 0x000056132be64bb4 in greeter_start_session_cb at seat.c:1184 > breakpoint already hit 3 times >3 breakpoint keep n 0x000056132be6406a in find_session_config at seat.c:1003 >4 hw watchpoint keep y *((const gchar **) 0x7ffd2493d898) > breakpoint already hit 1 time >5 breakpoint keep y 0x000056132be64d78 in greeter_start_session_cb at seat.c:1229 > breakpoint already hit 1 time >(gdb) delete 4 >(gdb) c >Continuing. > >[Detaching after fork from child process 30794] >[Switching to Thread 0x7fcfb8395800 (LWP 30643)] > >Thread 1 "lightdm" hit Breakpoint 2, greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x0, seat=0x56132d08c4c0) at seat.c:1184 >1184 { >(gdb) print &session_name >$5 = (const gchar **) 0x7ffd2493d898 >(gdb) print session_name >$6 = (const gchar *) 0x0 >(gdb) print *((const gchar **) 0x7ffd2493d898) >$7 = (const gchar *) 0x0 >(gdb) watch *((const gchar **) 0x7ffd2493d898) >Hardware watchpoint 6: *((const gchar **) 0x7ffd2493d898) >(gdb) n >1185 SeatPrivate *priv = seat_get_instance_private (seat); >(gdb) n >1189 if (greeter_get_guest_authenticated (greeter)) >(gdb) n >1198 session = greeter_take_authentication_session (greeter); >(gdb) n >1201 g_autofree gchar *sessions_dir = NULL; >(gdb) n >1202 switch (type) >(gdb) n >1205 sessions_dir = config_get_string (config_get_instance (), "LightDM", "sessions-directory"); >(gdb) n >1206 break; >(gdb) n >1213 const gchar *language = NULL; >(gdb) n >1214 User *user = session_get_user (session); >(gdb) n >1215 if (user) >(gdb) n >1220 autologin_username = seat_get_string_property (seat, "autologin-user"); >(gdb) n >1221 if (!session_name && g_strcmp0 (user_get_name (user), autologin_username) == 0) >(gdb) n >1224 if (!session_name) >(gdb) n >1225 session_name = user_get_xsession (user); >(gdb) n > >Thread 1 "lightdm" hit Hardware watchpoint 6: *((const gchar **) 0x7ffd2493d898) > >Old value = (const gchar *) 0x0 >New value = (const gchar *) 0x56132d08fcd0 "Session" >greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x56132d08fcd0 "Session", seat=0x56132d08c4c0) at seat.c:1226 >1226 language = user_get_language (user); >(gdb) l >1221 if (!session_name && g_strcmp0 (user_get_name (user), autologin_username) == 0) >1222 session_name = seat_get_string_property (seat, "autologin-session"); >1223 >1224 if (!session_name) >1225 session_name = user_get_xsession (user); >1226 language = user_get_language (user); >1227 } >1228 >1229 if (!session_name) >1230 session_name = seat_get_string_property (seat, "user-session"); >(gdb) print (const gchar *) 0x56132d08fcd0 >$8 = (const gchar *) 0x56132d08fcd0 "Session" >(gdb) print *((const gchar *) 0x56132d08fcd0) >$9 = 83 'S' >(gdb) watch *((const gchar *) 0x56132d08fcd0) >Hardware watchpoint 7: *((const gchar *) 0x56132d08fcd0) >(gdb) c >Continuing. > >[Switching to Thread 0x7fcfb8395800 (LWP 30643)] > >Thread 1 "lightdm" hit Hardware watchpoint 7: *((const gchar *) 0x56132d08fcd0) > >Old value = 83 'S' >New value = 15 '\017' >tcache_put (tc_idx=0, chunk=0x56132d08fcc0) at malloc.c:2942 >2942 tcache->entries[tc_idx] = e; >(gdb) bt >#0 tcache_put (tc_idx=0, chunk=0x56132d08fcc0) at malloc.c:2942 >#1 _int_free (av=0x7fcfb86faa00 <main_arena>, p=0x56132d08fcc0, have_lock=0) at malloc.c:4240 >#2 0x00007fcfb8943735 in g_free (mem=0x56132d08fcd0) at ../glib/gmem.c:199 >#3 0x000056132be80774 in load_dmrc (user=0x56132d0b38c0) at user-list.c:1193 >#4 0x000056132be80d5f in common_user_get_language (user=0x56132d0b38c0) at user-list.c:1322 >#5 0x000056132be50b65 in user_get_language (user=0x7fcfa0008c40) at accounts.c:105 >#6 0x000056132be64d74 in greeter_start_session_cb (greeter=0x56132d092460, type=SESSION_TYPE_LOCAL, session_name=0x56132d08fcd0 "\017w:L\026V", seat=0x56132d08c4c0) at seat.c:1226 >#7 0x00007fcfb8469bad in ffi_call_unix64 () at ../src/x86/unix64.S:101 >#8 0x00007fcfb846913a in ffi_call_int (cif=0x7ffd2493db50, fn=0x56132be64b8b <greeter_start_session_cb>, rvalue=<optimized out>, avalue=<optimized out>, closure=<optimized out>) at ../src/x86/ffi64.c:669 >#9 0x00007fcfb8a47592 in g_cclosure_marshal_generic (closure=0x56132d09d920, return_gvalue=0x7ffd2493dd50, n_param_values=3, param_values=0x7ffd2493dd80, invocation_hint=0x7ffd2493dd30, marshal_data=0x0) at ../gobject/gclosure.c:1510 >#10 0x00007fcfb8a45b1a in g_closure_invoke (closure=0x56132d09d920, return_value=0x7ffd2493dd50, n_param_values=3, param_values=0x7ffd2493dd80, invocation_hint=0x7ffd2493dd30) at ../gobject/gclosure.c:810 >#11 0x00007fcfb8a64d94 in signal_emit_unlocked_R (node=0x56132d0a4650, detail=0, instance=0x56132d092460, emission_return=0x7ffd2493df80, instance_and_params=0x7ffd2493dd80) at ../gobject/gsignal.c:3741 >#12 0x00007fcfb8a64082 in g_signal_emit_valist (instance=0x56132d092460, signal_id=36, detail=0, var_args=0x7ffd2493e010) at ../gobject/gsignal.c:3507 >#13 0x00007fcfb8a64595 in g_signal_emit (instance=0x56132d092460, signal_id=36, detail=0) at ../gobject/gsignal.c:3553 >#14 0x000056132be56c6f in handle_start_session (greeter=0x56132d092460, session=0x0) at greeter.c:745 >#15 0x000056132be57a43 in read_cb (source=0x56132d08dba0, condition=G_IO_IN, data=0x56132d092460) at greeter.c:1032 >#16 0x000056132be576ed in read_cb (source=0x56132d08dba0, condition=G_IO_IN, data=0x56132d092460) at greeter.c:964 >#17 0x00007fcfb89a1e86 in g_io_unix_dispatch (source=0x56132d0bbc60, callback=0x56132be5747a <read_cb>, user_data=0x56132d092460) at ../glib/giounix.c:166 >#18 0x00007fcfb893a50d in g_main_dispatch (context=0x56132d07af30) at ../glib/gmain.c:3337 >#19 0x00007fcfb893b504 in g_main_context_dispatch (context=0x56132d07af30) at ../glib/gmain.c:4055 >#20 0x00007fcfb893b6ff in g_main_context_iterate (context=0x56132d07af30, block=1, dispatch=1, self=0x7fcfa8003410) at ../glib/gmain.c:4131 >#21 0x00007fcfb893bbc0 in g_main_loop_run (loop=0x56132d076890) at ../glib/gmain.c:4329 >#22 0x000056132be5cf70 in main (argc=1, argv=0x7ffd2493ed58) at lightdm.c:915 >(gdb) l user-list.c:1322 >1317 { >1318 g_return_val_if_fail (COMMON_IS_USER (user), NULL); >1319 // Quick fix: always re-read .dmrc in order to get the >1320 // up to date locale settings (ALTBUG #30329). >1321 GET_USER_PRIVATE (user)->loaded_dmrc = FALSE; >1322 load_dmrc (user); >1323 const gchar *language = GET_USER_PRIVATE (user)->language; >1324 return (language && language[0] == 0) ? NULL : language; /* Treat "" as NULL */ >1325 } >1326 >(gdb)
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 40585
: 9538