Control: forwarded -1 https://github.com/linuxmint/cinnamon-screensaver/pull/508
Control: tags -1 + patch upstream

Thanks for the report. I could reproduce it on a Debian sid VM (cinnamon
6.6.9, cinnamon-screensaver 6.6.1-1, python3-gi 3.57.0-2, glib 2.88.3-2) and
there are actually two distinct bugs involved.

1) The failure you see is a Python exception, not a crash of the main
process. Running the screensaver with --debug shows:

Traceback (most recent call last):
  File "/usr/share/cinnamon-screensaver/stage.py", line 647, in authentication_result_callback
    self.manager.unlock()
  File "/usr/share/cinnamon-screensaver/manager.py", line 104, in unlock
    self.set_locked(False)
  File "/usr/share/cinnamon-screensaver/manager.py", line 73, in set_locked
    self.kill_fallback_window()
  File "/usr/share/cinnamon-screensaver/manager.py", line 309, in kill_fallback_window
    if self.fb_pid > 0:
TypeError: '>' not supported between instances of 'Pid' and 'int'

Up to pygobject 3.56.3, GLib.Pid was gi._gi.Pid, a C type deriving from int.
Since 3.57.0 (upstream commit b6e14902, "Reimplement GLib.spawn_async in
Python") it is a plain Python class implementing only __int__() and close():
no __index__, no comparisons with integers. manager.py stores the result of
GLib.spawn_async() in self.fb_pid, so both `self.fb_pid > 0` and
os.kill(self.fb_pid, ...) now fail.

The exception aborts unlock() before cs-backup-locker is sent its SIGTERM,
but the stage window is destroyed anyway - so the backup locker grabs the
screen and you get "Something went wrong with the screensaver" with the
desktop still locked. That matches your description exactly.

2) The segfault you reported is a second, independent bug in cs-backup-locker
itself, latent since 5.6.1. I disassembled the crash address against
libglib2.0-0t64 2.88.3-2 and got a coredump backtrace confirming it:

  #0  g_cancellable_cancel (libgio-2.0.so.0 + 0x580cd)
  #1  quit (cs-backup-locker + 0x5109)
  #2  g_main_dispatch
  #3  g_main_context_dispatch_unlocked
  #4  g_main_loop_run
  #5  gtk_main
  #6  main

screensaver_window_gone() calls g_clear_object() on the GCancellable returned
by g_task_get_cancellable(), which is (transfer none) - it drops a reference
the process never owned. Once the GTask is finalized the cancellable is
freed, and quit() then cancels a dangling pointer. It is only reachable when
the main screensaver process dies first: on a normal unlock the SIGTERM
arrives before the screensaver window disappears, so that callback never
runs. Which is why it surfaced together with bug 1.

Both are fixed by the patches sent upstream in
https://github.com/linuxmint/cinnamon-screensaver/pull/508 and verified on
the same VM: unlocking works again, and forcing the crash path with the first
patch reverted no longer produces a SIGSEGV.

Note that int() around GLib.spawn_async() is safe on older pygobject too,
since GLib.Pid used to be an int - checked against 3.48.2 (Ubuntu 24.04),
3.50.0 (trixie) and 3.57.0 (sid).

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature

Reply via email to