Ubuntu
cups-filters package

cups-browsed crashed with SIGSEGV in timeout_free()

Bug #1431041 reported by blubber on 2015-03-11

248

This bug affects 27 people

	Status	Importance	Assigned to
avahi (Ubuntu)	Invalid	High	Unassigned
cups-filters (Ubuntu)	Fix Released	High	Till Kamppeter
glib2.0 (Ubuntu)	Invalid	Undecided	Unassigned

Bug Description

happened during update.

ProblemType: Crash
DistroRelease: Ubuntu 15.04
Package: cups-browsed 1.0.67-0ubuntu1
ProcVersionSignature: Ubuntu 3.19.0-8.8-generic 3.19.1
Uname: Linux 3.19.0-8-generic x86_64
NonfreeKernelModules: fglrx
ApportVersion: 2.16.2-0ubuntu2
Architecture: amd64
CupsErrorLog:

Date: Wed Mar 11 22:46:42 2015
ExecutablePath: /usr/sbin/cups-browsed
InstallationDate: Installed on 2015-03-01 (10 days ago)
InstallationMedia: Ubuntu-GNOME 15.04 "Vivid Vervet" - Alpha amd64 (20150224)
Lpstat: device for WF-2530: dnssd://EPSON%20WF-2530%20Series._ipp._tcp.local/?uuid=cfe92100-67c4-11d4-a45f-b0e89258fe55
MachineType: To Be Filled By O.E.M. To Be Filled By O.E.M.
Papersize: a4
PpdFiles: WF-2530: Epson WF-2530 Series - epson-inkjet-printer 1.0.0-1lsb3.2 (Seiko Epson Corporation LSB 3.2)
ProcAttrCurrent: /usr/sbin/cups-browsed (enforce)
ProcCmdline: /usr/sbin/cups-browsed
ProcEnviron:
LANG=de_DE.UTF-8
PATH=(custom, no user)
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.19.0-8-generic root=UUID=b98daf80-990b-45f5-aa26-844ab2d42789 ro quiet splash vt.handoff=7
SegvAnalysis:
Segfault happened at: 0x7f03e1e4815a: movl $0x1,0xa8(%rax)
PC (0x7f03e1e4815a) ok
source "$0x1" ok
destination "0xa8(%rax)" (0x000000a8) not located in a known VMA region (needed writable region)!
SegvReason: writing NULL VMA
Signal: 11
SourcePackage: cups-filters
StacktraceTop:
?? () from /usr/lib/x86_64-linux-gnu/libavahi-glib.so.1
?? () from /usr/lib/x86_64-linux-gnu/libavahi-client.so.3
?? () from /usr/lib/x86_64-linux-gnu/libavahi-glib.so.1
g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
Title: cups-browsed crashed with SIGSEGV in g_main_context_dispatch()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

dmi.bios.date: 04/08/2013
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: P1.70
dmi.board.name: 970DE3/U3S3
dmi.board.vendor: ASRock
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: To Be Filled By O.E.M.
dmi.chassis.version: To Be Filled By O.E.M.
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrP1.70:bd04/08/2013:svnToBeFilledByO.E.M.:pnToBeFilledByO.E.M.:pvrToBeFilledByO.E.M.:rvnASRock:rn970DE3/U3S3:rvr:cvnToBeFilledByO.E.M.:ct3:cvrToBeFilledByO.E.M.:
dmi.product.name: To Be Filled By O.E.M.
dmi.product.version: To Be Filled By O.E.M.
dmi.sys.vendor: To Be Filled By O.E.M.

Tags:

Related branches

lp://staging/ubuntu/vivid-proposed/cups-filters

Revision history for this message

blubber (blubber1698) wrote on 2015-03-11:

CurrentDmesg.txt Edit (67.5 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (3.8 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (817 bytes, text/plain; charset="utf-8")
Locale.txt Edit (327 bytes, text/plain; charset="utf-8")
Lspci.txt Edit (39.3 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (1.0 KiB, text/plain; charset="utf-8")
PrintingPackages.txt Edit (1.1 KiB, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (3.7 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (2.9 KiB, text/plain; charset="utf-8")
ProcMaps.txt Edit (17.2 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (5.6 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (778 bytes, text/plain; charset="utf-8")
Registers.txt Edit (766 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (1.4 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (2.7 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (170.0 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (242.8 KiB, text/plain; charset="utf-8")

Revision history for this message

Apport retracing service (apport) wrote on 2015-03-11: Possible regression detected

This crash has the same stack trace characteristics as bug #1427344. However, the latter was already fixed in an earlier package version than the one in this report. This might be a regression or because the problem is in a dependent package.

tags:

added: regression-retracer

Revision history for this message

Apport retracing service (apport) wrote on 2015-03-11:

StacktraceTop:
timeout_free (t=0x107f860) at glib-watch.c:206
connection_data_unref (d=0x10831d0) at ../avahi-common/dbus-watch-glue.c:81
start_timeout_callback (t=0x107f860) at glib-watch.c:252
dispatch_func (source=0x1076ec0, callback=<optimized out>, userdata=<optimized out>) at glib-watch.c:331
g_main_dispatch (context=0x1076dd0) at /build/buildd/glib2.0-2.43.91/./glib/gmain.c:3122

Revision history for this message

Apport retracing service (apport) wrote on 2015-03-11: Stacktrace.txt

Stacktrace.txt Edit (2.0 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2015-03-11: StacktraceSource.txt

StacktraceSource.txt Edit (1.6 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2015-03-11: ThreadStacktrace.txt

ThreadStacktrace.txt Edit (3.9 KiB, text/plain)

Changed in cups-filters (Ubuntu):
importance:	Undecided → Medium
summary:	- cups-browsed crashed with SIGSEGV in g_main_context_dispatch() + cups-browsed crashed with SIGSEGV in timeout_free()
tags:	removed: need-amd64-retrace

Revision history for this message

Launchpad Janitor (janitor) wrote on 2015-03-12:

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in cups-filters (Ubuntu):
status:	New → Confirmed

Apport retracing service (apport) on 2015-03-15

tags:

added: bugpattern-needed

Till Kamppeter (till-kamppeter) on 2015-03-15

information type:

Private → Public

Revision history for this message

Till Kamppeter (till-kamppeter) wrote on 2015-03-16:

Tim, I have followed your suggestion in bug 1427344, replacing g_source_destroy() by g_source_remove(), but this seems to have caused this bug. Any further suggestion?

Revision history for this message

Till Kamppeter (till-kamppeter) wrote on 2015-03-16:

Please everyone suffering this problem, can you attach your /etc/cups/cups-browsed.conf file? Thanks.

Revision history for this message

Tim Waugh (twaugh) wrote on 2015-03-16:

#10

Maybe it's an avahi bug? Without symbols it's hard to say.

Revision history for this message

Till Kamppeter (till-kamppeter) wrote on 2015-03-16:

#11

Tim, he stack traces attached to comment #4, #5, and #6 seem to contain symbols.

I am adding an Avahi task, to check whether it is perhaps really an Avahi problem.

Changed in cups-filters (Ubuntu):
status:	Confirmed → Incomplete
Changed in avahi (Ubuntu):
status:	New → Incomplete
importance:	Undecided → High
Changed in cups-filters (Ubuntu):
importance:	Medium → High

Revision history for this message

Sebastien Bacher (seb128) wrote on 2015-03-24:

#12

Till, that's a quite hightly ranked issue on e.u.c
https://errors.ubuntu.com/problem/e6a8f46421486ee16eb01db5bd331f69a3292d0c

Could you try to get that moving forward/resolved for vivid?

Changed in cups-filters (Ubuntu):
assignee:	nobody → Till Kamppeter (till-kamppeter)
status:	Incomplete → New

Revision history for this message

Launchpad Janitor (janitor) wrote on 2015-03-25:

#13

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in cups-filters (Ubuntu):
status:	New → Confirmed

Revision history for this message

Cavsfan (cavsfan) wrote on 2015-03-26:

#14

My /etc/cups/cups-browsed.conf file Edit (2.8 KiB, text/plain)

I got this errror at boot this morning.

Revision history for this message

Till Kamppeter (till-kamppeter) wrote on 2015-03-26: Re: [Bug 1431041] Re: cups-browsed crashed with SIGSEGV in timeout_free()

#15

On 16.03.2015 09:51, Tim Waugh wrote:
> Maybe it's an avahi bug? Without symbols it's hard to say.
>

I have changed the use of main loop functions as you told and released
1.0.67. Since then I get many more crashes. See

https://bugs.launchpad.net/ubuntu/+source/cups-filters

I have unlocked all bugs (after auto-generation they are all private) so
that you can read them. Most have symbolic backtraces and there are many
more cups-browsed crashes with 1.0.67 than with 1.0.66.

Did you observe similar things in Red Hat or Fedora?

I am asking you because you originally introduced the main loop and I
never modified anything on the main loop stuff.

Till

Revision history for this message

Tim Waugh (twaugh) wrote on 2015-03-27:

#16

No, I've not seen similar crashes in Red Hat Enterprise Linux or in Fedora.

From the varied reports, I haven't actually seen one that definitely uses the auto-shutdown feature, so I'm not sure the destroy/remove thing is relevant. In fact, with several reports it seems to be with the default configuration, l

It looks more like something is scribbling over memory somewhere. Have you tried using valgrind on it?

Revision history for this message

Launchpad Janitor (janitor) wrote on 2015-03-30:

#17

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in glib2.0 (Ubuntu):
status:	New → Confirmed

Revision history for this message

Till Kamppeter (till-kamppeter) wrote on 2015-03-31:

#18

To everyone who observed this crash: Are you able to reproduce the crash? If so, can you try to downgrade cups-browsed and/or libglib2.0-0 to older versions and see with which versions the crash goes away?

Changed in cups-filters (Ubuntu):
status:	Confirmed → Incomplete
Changed in glib2.0 (Ubuntu):
status:	Confirmed → Incomplete

Revision history for this message

Launchpad Janitor (janitor) wrote on 2015-04-10:

#19

This bug was fixed in the package cups-filters - 1.0.67-0ubuntu2

---------------
cups-filters (1.0.67-0ubuntu2) vivid; urgency=medium

  * debian/patches/cups-browsed-fix-numeric-ids-of-gsources.patch:
    cups-browsed: Numeric IDs for GSources of the glib event
    loop must be positive integers greater than zero according
    to the documentation of the g_source_get_id() function.
    Taken care of this at all places.
    Hopefully it fixes the recent crashes of cups-browsed: LP: #1435287,
    LP: #1436733, LP: #1436684, LP: #1431041, LP: #1434321
-- Till Kamppeter <email address hidden> Thu, 9 Apr 2015 22:40:03 -0300

Changed in cups-filters (Ubuntu):
status:	Incomplete → Fix Released

Revision history for this message

Enrico (enricobe) wrote on 2015-04-10:

#20

Thank you Till for the fix. This error no longer appeared on my Xubuntu since my last comment here. Anyway, thanks a lot for your work.

Revision history for this message

Till Kamppeter (till-kamppeter) wrote on 2015-04-10:

#21

Error tracker: https://errors.ubuntu.com/problem/e6a8f46421486ee16eb01db5bd331f69a3292d0c

Sebastien Bacher (seb128) on 2015-09-24

Changed in avahi (Ubuntu):
status:	Incomplete → Invalid
Changed in glib2.0 (Ubuntu):
status:	Incomplete → Invalid

Report a bug

This report contains Public information

Everyone can see this information.

Duplicates of this bug

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntucups-filters package

cups-browsed crashed with SIGSEGV in timeout_free()

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
cups-filters package