Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package glib2 for openSUSE:Factory checked 
in at 2023-10-02 20:04:11
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/glib2 (Old)
 and      /work/SRC/openSUSE:Factory/.glib2.new.28202 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "glib2"

Mon Oct  2 20:04:11 2023 rev:271 rq:1114647 version:2.78.0

Changes:
--------
--- /work/SRC/openSUSE:Factory/glib2/glib2.changes      2023-09-20 
13:21:23.717891281 +0200
+++ /work/SRC/openSUSE:Factory/.glib2.new.28202/glib2.changes   2023-10-02 
20:04:40.486938518 +0200
@@ -1,0 +2,6 @@
+Thu Sep 28 07:40:17 UTC 2023 - Samuel Cabrero <scabr...@suse.de>
+
+- Fix NetworkManager crashing repeatedly with glib 2.78.0;
+  (bsc#1215709); Add patch 0005-gthreadedresolver-Fix-race.patch
+
+-------------------------------------------------------------------

New:
----
  0005-gthreadedresolver-Fix-race.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ glib2.spec ++++++
--- /var/tmp/diff_new_pack.2Clu5j/_old  2023-10-02 20:04:43.579049718 +0200
+++ /var/tmp/diff_new_pack.2Clu5j/_new  2023-10-02 20:04:43.595050294 +0200
@@ -56,6 +56,8 @@
 Patch2:         glib2-suppress-schema-deprecated-path-warning.patch
 # PATCH-FIX-OPENSUSE glib2-gdbus-codegen-version.patch  o...@aepfle.de -- 
Remove version string from files generated by gdbus-codegen
 Patch4:         glib2-gdbus-codegen-version.patch
+# PATCH-FIX-OPENSUSE 0005-gthreadedresolver-Fix-race.patch bsc#1215709 -- 
Backport patch to fix race between source callbacks and finalize causing NM to 
crash repeatedly
+Patch5:         0005-gthreadedresolver-Fix-race.patch
 
 BuildRequires:  docbook-xsl-stylesheets
 BuildRequires:  fdupes
@@ -258,6 +260,7 @@
 %patch1 -p1
 %patch2 -p1
 %patch4 -p1
+%patch5 -p1
 
 cp -a %{SOURCE1} %{SOURCE2} %{SOURCE5} .
 cp -a %{SOURCE4} gnome_defaults.conf

++++++ 0005-gthreadedresolver-Fix-race.patch ++++++
>From 82c764ce2e42f0d1032627dabcbd742d5f2bd8fa Mon Sep 17 00:00:00 2001
From: Philip Withnall <phi...@tecnocode.co.uk>
Date: Mon, 11 Sep 2023 16:02:15 +0100
Subject: [PATCH] gthreadedresolver: Fix race between source callbacks and
 finalize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I had thought that because `g_source_destroy()` was called for the two
sources (cancel and timeout) in the `GTask` finalize function for a
threaded resolver operation, that it would be fine to use a plain
pointer in the source callbacks to point to the `GTask`.

That turns out to not be true: because the source callbacks are executed
in the GLib worker thread, and the `GTask` can be finalized in another
thread, it’s possible for a source callback (e.g. `cancelled_cb()`) to
be scheduled in the worker thread, then for the `GTask` to be finalized,
and then the source callback to continue execution and find itself
doing a use-after-free.

Fix that by using a weak ref to the `GTask` in the source callbacks,
rather than a plain pointer.

Signed-off-by: Philip Withnall <phi...@tecnocode.co.uk>

Fixes: #3105
---
 gio/gthreadedresolver.c | 43 +++++++++++++++++++++++++++++++++++------
 1 file changed, 37 insertions(+), 6 deletions(-)

diff --git a/gio/gthreadedresolver.c b/gio/gthreadedresolver.c
index 2d94531bf..c7a567549 100644
--- a/gio/gthreadedresolver.c
+++ b/gio/gthreadedresolver.c
@@ -1422,10 +1422,17 @@ lookup_records_finish (GResolver     *resolver,
 static gboolean
 timeout_cb (gpointer user_data)
 {
-  GTask *task = G_TASK (user_data);
-  LookupData *data = g_task_get_task_data (task);
+  GWeakRef *weak_task = user_data;
+  GTask *task = NULL;  /* (owned) */
+  LookupData *data;
   gboolean should_return;
 
+  task = g_weak_ref_get (weak_task);
+  if (task == NULL)
+    return G_SOURCE_REMOVE;
+
+  data = g_task_get_task_data (task);
+
   g_mutex_lock (&data->lock);
 
   should_return = g_atomic_int_compare_and_exchange (&data->will_return, 
NOT_YET, TIMED_OUT);
@@ -1443,6 +1450,8 @@ timeout_cb (gpointer user_data)
   g_cond_broadcast (&data->cond);
   g_mutex_unlock (&data->lock);
 
+  g_object_unref (task);
+
   return G_SOURCE_REMOVE;
 }
 
@@ -1452,10 +1461,17 @@ static gboolean
 cancelled_cb (GCancellable *cancellable,
               gpointer      user_data)
 {
-  GTask *task = G_TASK (user_data);
-  LookupData *data = g_task_get_task_data (task);
+  GWeakRef *weak_task = user_data;
+  GTask *task = NULL;  /* (owned) */
+  LookupData *data;
   gboolean should_return;
 
+  task = g_weak_ref_get (weak_task);
+  if (task == NULL)
+    return G_SOURCE_REMOVE;
+
+  data = g_task_get_task_data (task);
+
   g_mutex_lock (&data->lock);
 
   g_assert (g_cancellable_is_cancelled (cancellable));
@@ -1473,9 +1489,18 @@ cancelled_cb (GCancellable *cancellable,
   g_cond_broadcast (&data->cond);
   g_mutex_unlock (&data->lock);
 
+  g_object_unref (task);
+
   return G_SOURCE_REMOVE;
 }
 
+static void
+weak_ref_clear_and_free (GWeakRef *weak_ref)
+{
+  g_weak_ref_clear (weak_ref);
+  g_free (weak_ref);
+}
+
 static void
 run_task_in_thread_pool_async (GThreadedResolver *self,
                                GTask             *task)
@@ -1490,17 +1515,23 @@ run_task_in_thread_pool_async (GThreadedResolver *self,
 
   if (timeout_ms != 0)
     {
+      GWeakRef *weak_task = g_new0 (GWeakRef, 1);
+      g_weak_ref_set (weak_task, task);
+
       data->timeout_source = g_timeout_source_new (timeout_ms);
       g_source_set_static_name (data->timeout_source, "[gio] threaded resolver 
timeout");
-      g_source_set_callback (data->timeout_source, G_SOURCE_FUNC (timeout_cb), 
task, NULL);
+      g_source_set_callback (data->timeout_source, G_SOURCE_FUNC (timeout_cb), 
g_steal_pointer (&weak_task), (GDestroyNotify) weak_ref_clear_and_free);
       g_source_attach (data->timeout_source, GLIB_PRIVATE_CALL 
(g_get_worker_context) ());
     }
 
   if (cancellable != NULL)
     {
+      GWeakRef *weak_task = g_new0 (GWeakRef, 1);
+      g_weak_ref_set (weak_task, task);
+
       data->cancellable_source = g_cancellable_source_new (cancellable);
       g_source_set_static_name (data->cancellable_source, "[gio] threaded 
resolver cancellable");
-      g_source_set_callback (data->cancellable_source, G_SOURCE_FUNC 
(cancelled_cb), task, NULL);
+      g_source_set_callback (data->cancellable_source, G_SOURCE_FUNC 
(cancelled_cb), g_steal_pointer (&weak_task), (GDestroyNotify) 
weak_ref_clear_and_free);
       g_source_attach (data->cancellable_source, GLIB_PRIVATE_CALL 
(g_get_worker_context) ());
     }
 
-- 
2.42.0

Reply via email to