Public bug reported:
Steps to reproduce:
1. Launch gpk-application
2. Search for a package (e.g. fish)
3. Select it, click Remove
4. Click Apply Changes
(Also reproduces on Install when the selected package pulls in extra
dependencies, so it's not Remove-specific. Whichever operation triggers
PackageKit's "additional confirmation required" dependency dialog hits
this.)
Expected results: The confirmation dialog listing the additional
packages (with sizes) appears, and the transaction proceeds normally
after clicking Continue.
Actual results: gpk-application crashes immediately with SIGSEGV, logging first:
GLib-GIO-CRITICAL: GTask pk_package_sack_get_details_async (...) finalized
without ever returning (using g_task_return_*())
then:
Thread 1 "gpk-application" received signal SIGSEGV
0x... in g_task_get_source_object () from
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
Root cause analysis (via gdb against the apport coredump, reproduced
twice with matching backtraces):
gpk_task_simulate_question() in gnome-packagekit's src/gpk-task.c calls
gpk_task_add_dialog_deps_section(), which calls the synchronous
pk_package_sack_get_details() (from libpackagekit-glib2) to fetch package
sizes for the dialog. That function runs its own nested GMainLoop internally
while fetching details for multiple packages via concurrent async GetDetails
sub-calls. Its own bookkeeping for these concurrent
sub-calls is buggy: it frees a GTask while another sub-call for it is still in
flight, and a later completion callback dereferences the now-dangling GTask,
crashing in g_task_get_source_object(). This reproduces identically whether
pk_package_sack_get_details() is called reentrantly from inside another
PackageKit callback, or cleanly from a g_idle_add() callback - confirming the
bug is internal to
pk_package_sack_get_details() itself (pk-package-sack-sync.c), not a reentrancy
issue on the caller's side.
Environment:
- gnome-packagekit 43.0-4build1
- libpackagekit-glib2-18 1.3.4-3ubuntu1.2
- Ubuntu 26.04
Workaround: A gnome-packagekit-side patch that avoids the buggy code
path entirely by fetching sizes via the async
pk_task_get_details_async() (already used successfully elsewhere in the
same file) instead of the synchronous pk_package_sack_get_details().
(Disclaimer: AI was used heavily to help debug / write this patch.)
** Affects: gnome-packagekit (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "Crash report"
https://bugs.launchpad.net/bugs/2167930/+attachment/6001678/+files/gpk-application-redacted.crash
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167930
Title:
gpk-application (gnome-packagekit) crashes with SIGSEGV in
pk_package_sack_get_details() when confirming a transaction with extra
dependencies
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-packagekit/+bug/2167930/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
