Package: dbus-broker
Version: 37-3
Severity: important

Hi,

This seems to be a strlen() on a NULL-pointer...

To reporoduce (hopefully):
1. Insert drive with LUKS-encrypted data (I use no partition table on my
drives, not sure if relevant)
2. Click the mount button on the Drives Plasmoid
3. Enter passphrase
4. Click ok
5. dbus-broker crashes and pulls other dbus-connected applications with
   it
6. Despair in front of your unusable desktop (Logout/reboot in Plasma
   doesn't work anymore, probably because those are dbus actions?)
7. Desktop "disappears" some minutes later (Some watchdog kills kwin?)


Backtrace:

Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/bin/dbus-broker --log 11 --controller 10 
--machine-id 185526166e484f06bc3b47fbfa9dd92a --max-bytes 100000000000000 
--max-fds 25000000000000 --max-matches 5000000000'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76

(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1  0x0000558757e05deb in build_message_query_name (queryp=<synthetic pointer>, 
n_queryp=<synthetic pointer>, security_label=0x55878f319200 "plasmashell", 
security_label@entry=0x0, bustype=0x55878f1c36e0 "session",
    name=0x55878f3a1020 "unconfined", receiver_context=0x55878f1c7290 
"org.freedesktop.Notifications", path=0x55878f4049e0 
"/org/kde/solid/UDisks2StorageAccess_1", interface=0x0, method=0x55878f404a20 
"passphraseReply")
    at ../src/util/apparmor.c:246
#2  apparmor_message_query_name (check_send=check_send@entry=false, 
security_label=security_label@entry=0x55878f319200 "plasmashell", 
bustype=bustype@entry=0x55878f1c36e0 "session",
    receiver_context=receiver_context@entry=0x55878f3a1020 "unconfined", 
name=0x55878f1c7290 "org.freedesktop.Notifications", 
path=path@entry=0x55878f4049e0 "/org/kde/solid/UDisks2StorageAccess_1", 
interface=0x0,
    method=0x55878f404a20 "passphraseReply", allow=0x7ffce482ab50, 
audit=0x7ffce482aa6c) at ../src/util/apparmor.c:318
#3  0x0000558757e06101 in apparmor_message_query 
(check_send=check_send@entry=false, 
security_label=security_label@entry=0x55878f319200 "plasmashell", 
bustype=0x55878f1c36e0 "session",
    receiver_context=receiver_context@entry=0x55878f3a1020 "unconfined", 
nameset=nameset@entry=0x7ffce482ac90, subject_id=subject_id@entry=36, 
path=0x55878f4049e0 "/org/kde/solid/UDisks2StorageAccess_1", interface=0x0,
    method=0x55878f404a20 "passphraseReply", allow=0x7ffce482ab50, 
audit=0x7ffce482ab54) at ../src/util/apparmor.c:388
#4  0x0000558757e06d58 in bus_apparmor_check_send (registry=0x55878f1c3c70, 
sender_context=<optimized out>, 
receiver_context=receiver_context@entry=0x55878f1e1ae0 "plasmashell (complain)",
    subject=subject@entry=0x7ffce482ac90, subject_id=36, 
path=path@entry=0x55878f4049e0 "/org/kde/solid/UDisks2StorageAccess_1", 
interface=0x0, method=0x55878f404a20 "passphraseReply") at 
../src/util/apparmor.c:559
#5  0x0000558757dfdd71 in policy_snapshot_check_send 
(snapshot=snapshot@entry=0x55878f1f2970, subject_seclabel=0x55878f1e1ae0 
"plasmashell (complain)", subject=subject@entry=0x7ffce482ac90, 
subject_id=<optimized out>,
    interface=0x0, method=0x55878f404a20 "passphraseReply", path=0x55878f4049e0 
"/org/kde/solid/UDisks2StorageAccess_1", type=1, broadcast=false, n_fds=0) at 
../src/bus/policy.c:1067
#6  0x0000558757dfafd1 in peer_queue_unicast (sender_policy=0x55878f1f2970, 
sender_names=sender_names@entry=0x7ffce482ad40, 
sender_replies=sender_replies@entry=0x55878f22c6f0, sender_user=0x55878f1c2570, 
sender_id=33,
    receiver=0x55878f235ff0, message=0x55878f4044a0) at ../src/bus/peer.c:811
#7  0x0000558757df4ff4 in driver_forward_unicast (sender=0x55878f22bc70, 
destination=<optimized out>, message=0x55878f4044a0) at ../src/bus/driver.c:2595
#8  driver_dispatch_internal (peer=<optimized out>, message=0x55878f4044a0) at 
../src/bus/driver.c:2754
#9  driver_dispatch (peer=peer@entry=0x55878f22bc70, message=0x55878f4044a0) at 
../src/bus/driver.c:2778
#10 0x0000558757df9b4d in peer_dispatch_connection (peer=<optimized out>, 
events=<optimized out>) at ../src/bus/peer.c:129
#11 peer_dispatch (file=0x55878f22c620) at ../src/bus/peer.c:201
#12 0x0000558757e02d05 in dispatch_context_dispatch 
(ctx=ctx@entry=0x55878f1c1af0) at ../src/util/dispatch.c:343
#13 0x0000558757de9bf0 in broker_run (broker=0x55878f1c1980) at 
../src/broker/broker.c:203
#14 0x0000558757de8fc3 in run (log=0x7ffce482afe0) at ../src/broker/main.c:280
#15 main (argc=<optimized out>, argv=0x7ffce482b148) at ../src/broker/main.c:311

I'm reluctant to provide core dump, because passphrases/secrets...

There seems to be a Debian-specific patch around the AppArmor-stuff, so
I haven't reported this upstream yet.

Regards, Tobias

-- System Information:
Debian Release: forky/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.17.12+deb14-amd64 (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_CPU_OUT_OF_SPEC
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), 
LANGUAGE=de:en_GB:en_US
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dbus-broker depends on:
ii  dbus-system-bus-common  1.16.2-2
ii  init-system-helpers     1.69
ii  libapparmor1            4.1.0-1+b1
ii  libaudit1               1:4.1.2-1+b1
ii  libc6                   2.42-6
ii  libcap-ng0              0.8.5-4+b2
ii  libexpat1               2.7.3-1
ii  libselinux1             3.9-4+b1
ii  libsystemd0             259-1
ii  systemd-sysv            259-1

Versions of packages dbus-broker recommends:
ii  dbus-bin  1.16.2-2

dbus-broker suggests no packages.

-- no debconf information

Reply via email to