segfault in udisks_block_get_id_uuid

[seb128]

The Ubuntu bug tracker started receiving some reports about those errors after upgrading to the new serie

Backtrace from 2.9.0

#0  0x00007f28093cf19d in udisks_block_get_id_uuid (object=0x564a5025a760) at udisks-generated.c:14890
No locals.
#1  0x0000564a4e64227e in udisks_linux_block_matches_id (device_path=0x564a50217550 "UUID=a70e63b4-7f5a-424e-8451-be911d936723", block=0x564a5025a760) at udiskslinuxblock.c:521
        device = 0x0
        partuuid = 0x0
        partlabel = 0x0
        symlinks = <optimized out>
        label = 0x0
        uuid = 0x564a50217555 "a70e63b4-7f5a-424e-8451-be911d936723"
        device = <optimized out>
        label = <optimized out>
        uuid = <optimized out>
        partuuid = <optimized out>
        partlabel = <optimized out>
        symlinks = <optimized out>
        object = <optimized out>
        linux_device = <optimized out>
        _pp = <optimized out>
        _ptr = <optimized out>
        _pp = <optimized out>
        _ptr = <optimized out>
#2  udisks_linux_block_matches_id (block=0x564a5025a760, device_path=0x564a50217550 "UUID=a70e63b4-7f5a-424e-8451-be911d936723") at udiskslinuxblock.c:468
        symlinks = <optimized out>
        object = <optimized out>
        linux_device = <optimized out>
        _pp = <optimized out>
        _ptr = <optimized out>
        _pp = <optimized out>
        _ptr = <optimized out>
#3  0x0000564a4e6424d3 in find_fstab_entries (block=block@entry=0x564a5025a760, needle=needle@entry=0x0, daemon=0x564a501d2f00) at udiskslinuxblock.c:573
        entry = <optimized out>
        table = 0x564a502b8c00
        iter = 0x564a501d31e0
        fs = 0x564a502859b0
        ret = 0x0
#4  0x0000564a4e642e58 in calculate_configuration (block=0x564a5025a760, daemon=0x564a501d2f00, include_secrets=0, error=0x7ffdee33b0c0) at udiskslinuxblock.c:778
        entries = <optimized out>
        l = <optimized out>
        builder = {u = {s = {partial_magic = 0, type = 0x564a50266070, y = {94877172260977, 0, 0, 18446744073709551615, 94877172518416, 8, 0, 3, 1033660112, 0, 0, 0, 0, 0}}, x = {0, 94877172260976, 94877172260977, 0, 0, 18446744073709551615, 94877172518416, 8, 0, 3, 1033660112, 0, 0, 0, 0, 0}}}
        ret = 0x0
        __func__ = <optimized out>
        _g_boolean_var_ = <optimized out>
#5  0x0000564a4e6431a1 in update_configuration (block=0x564a5025a760, daemon=0x564a5021b860, daemon@entry=0x564a501d2f00) at udiskslinuxblock.c:838
        configuration = 0x564a5025a760
        error = 0x0
        __func__ = "update_configuration"
#6  0x0000564a4e64408e in udisks_linux_block_update (block=0x564a5025a760, object=object@entry=0x564a5027b8f0) at udiskslinuxblock.c:1228
        iface = <optimized out>
        daemon = 0x564a501d2f00
        object_manager = 0x564a501db830
        device = <optimized out>
        dev = <optimized out>
        drive_object_path = <optimized out>
        drive = <optimized out>
        s = <optimized out>
        device_file = 0x564a502bed00 "/dev/sdc1"
        symlinks = <optimized out>
        preferred_device_file = <optimized out>
        id_device_file = <optimized out>
        media_removable = <optimized out>
        size = <optimized out>
        media_available = 1
        media_change_detected = 1
        read_only = <optimized out>
        seems_encrypted = <optimized out>
        n = <optimized out>
        error = 0x0
        __func__ = "udisks_linux_block_update"
#7  0x0000564a4e63e20f in block_device_update (object=<optimized out>, uevent_action=<optimized out>, _iface=0x564a5025a760) at udiskslinuxblockobject.c:495
No locals.
#8  0x0000564a4e63e7b2 in udisks_linux_block_object_uevent (object=0x564a5027b8f0, action=0x0, device=<optimized out>) at udiskslinuxblockobject.c:878
        module_manager = <optimized out>
        modules = <optimized out>
        l = <optimized out>
        __func__ = "udisks_linux_block_object_uevent"
#9  0x00007f28091598fa in g_closure_invoke () from /srv/daisy.ubuntu.com/production/cache/Ubuntu 20.10/cache-ditol6/sandbox/Ubuntu 20.10/amd64/report-sandbox/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.6600.0
No symbol table info available.
#10 0x00007f280916c493 in signal_emit_unlocked_R.isra.0 () from /srv/daisy.ubuntu.com/production/cache/Ubuntu 20.10/cache-ditol6/sandbox/Ubuntu 20.10/amd64/report-sandbox/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.6600.0
No symbol table info available.
#11 0x00007f2809172c21 in g_signal_emit_valist () from /srv/daisy.ubuntu.com/production/cache/Ubuntu 20.10/cache-ditol6/sandbox/Ubuntu 20.10/amd64/report-sandbox/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.6600.0
No symbol table info available.
#12 0x00007f2809172d83 in g_signal_emit () from /srv/daisy.ubuntu.com/production/cache/Ubuntu 20.10/cache-ditol6/sandbox/Ubuntu 20.10/amd64/report-sandbox/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.6600.0
No symbol table info available.
#13 0x0000564a4e667580 in reload_mounts (monitor=0x564a501d9dc0) at udisksmountmonitor.c:269
        mount = <optimized out>
        cur_mounts = 0x7f27f4004f40
        added = 0x0
        removed = 0x564a501fe860
        l = 0x564a501fe860
#14 0x0000564a4e6678cc in mounts_changed_event (channel=<optimized out>, cond=<optimized out>, user_data=0x564a501d9dc0) at udisksmountmonitor.c:293
        monitor = <optimized out>
#15 0x00007f28090673ef in ?? ()
No symbol table info available.
#16 0x00007f2800000000 in ?? ()
No symbol table info available.
#17 0x0000000000000000 in ?? ()
No symbol table info available.

[tbzatek]

Another backtrace from https://bugzilla.redhat.com/show_bug.cgi?id=1898705

Thread no. 1 (10 frames)
 #0 udisks_block_get_device at udisks-generated.c:14218
 #1 udisks_linux_block_matches_id at udiskslinuxblock.c:510
 #3 find_fstab_entries.constprop.0 at udiskslinuxblock.c:573
 #4 calculate_configuration.constprop.0 at udiskslinuxblock.c:778
 #5 update_configuration at udiskslinuxblock.c:838
 #6 udisks_linux_block_update at udiskslinuxblock.c:1228
 #7 block_device_update at udiskslinuxblockobject.c:495
 #8 udisks_linux_block_object_uevent at udiskslinuxblockobject.c:878
 #10 signal_emit_unlocked_R.isra.0 at ../gobject/gsignal.c:3738
 #13 reload_mounts at udisksmountmonitor.c:269

Looks like something is messing up with a reference to the UDisksLinuxBlockObject instance.

[tbzatek]

I guess I will need a reproducer in this case. Reading the source code and the backtraces everything looks correct. The crash is most likely just a consequence of refcounting issue somewhere else.

We might take a reference to UDisksLinuxBlockObject within on_mount_monitor_mount_added() and on_mount_monitor_mount_removed() callbacks but that'd be just a workaround with limited effect.

[seb128]

Ubuntu received on human report (the other instances are submissions to the errors tracker), which has this description

'I was inserting a USB key to my computer when this program crashed'

[tbzatek]

Ubuntu received on human report (the other instances are submissions to the errors tracker), which has this description

'I was inserting a USB key to my computer when this program crashed'

Thanks, still no luck reproducing it here. Tried different ways of (hot)plugging and unplugging, different kind of devices with no luck. No luck by reading the code all over again either.

[tbzatek]

TODO: might be worth trying running udisksd with a satanizer - e.g. ASAN_OPTIONS=detect_leaks=0 LD_PRELOAD=/usr/lib/gcc/x86_64-linux-gnu/10/libasan.so etc.