Root cause found and fixed upstream (GNOME/gdm): https://gitlab.gnome.org/GNOME/gdm/-/issues/1087 / https://gitlab.gnome.org/GNOME/gdm/-/merge_requests/385
This is a gdm bug, not a GLib one. In `daemon/gdm-session.c` both connection-teardown paths - `free_pending_worker_connection()` and `gdm_session_close()` - drop the reference owned by the tracking lists without disconnecting the `"closed"` signal handlers first. The handlers unconditionally unref the connection, so when a connection closes concurrently with a session reset/close (which happens inside `gdm-session-worker` whenever a lock/unlock reauthentication finishes or is cancelled), the queued `::closed` emission runs a stale handler that releases a reference it does not own. The connection is finalized one unref early and GDBus's own `emit_closed_data_free()` then unrefs freed memory, producing exactly the backtrace in this report. I reproduced the analysis from source and corroborated it with a coredump on Fedora 44 (gdm 50.1, glib2 2.88.2): at the fatal unref the victim GDBusConnection's header already holds allocator freelist metadata, and the one live reauthentication GdmSession tracked the victim in neither of its two connection lists. The fix is a two-line disconnect on each teardown path (mirroring what `register_worker()` has done since 2014); the merge request above also plugs a related reference leak on the `register_worker()` rejection path. Both should apply to the Noble gdm3 sources with little or no change, if someone wants to carry them as a distro patch before the upstream release. ** Bug watch added: gitlab.gnome.org/GNOME/gdm/-/issues #1087 https://gitlab.gnome.org/GNOME/gdm/-/issues/1087 ** Bug watch added: gitlab.gnome.org/GNOME/gdm/issues #1087 https://gitlab.gnome.org/GNOME/gdm/issues/1087 ** Also affects: gdm via https://gitlab.gnome.org/GNOME/gdm/issues/1087 Importance: Unknown Status: Unknown -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2117149 Title: gdm-session-worker crashed with SIGSEGV in g_type_check_instance_is_fundamentally_a() from g_object_unref() from emit_closed_data_free() from g_source_callback_unref() from g_source_callback_unref() To manage notifications about this bug go to: https://bugs.launchpad.net/gdm/+bug/2117149/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
