Public bug reported:
Package: gnome-settings-daemon 46.0-1ubuntu1.24.04.1 (noble-updates),
Ubuntu 24.04 LTS, amd64, kernel 6.8.0-147-generic.
SUMMARY
/usr/libexec/gsd-usb-protection may dereference a NULL GError in the callback
usb_protection_proxy_ready when the connection to the screensaver service
fails. The process dies with SIGSEGV (read at address 0x8).
Type of request: stable release update (SRU) for reliability — a crash
fix. This is not a security report: no security impact is claimed.
The bug is already fixed upstream (GNOME gnome-settings-daemon issue
#792, merge request !410, commit
d91c98ed0eeb7fa7ce5f4b3f2e3b105752ca97f9, merged 2025-04-19 on master;
the gnome-48 branch has the fixed code). The gnome-46 and gnome-47
branches, and the package currently in noble-updates, still contain the
faulty code. I am requesting that the fix be backported to Ubuntu 24.04
LTS as a reliability SRU.
WHAT HAPPENS
In the 46.0 code, when gnome_settings_bus_get_screen_saver_proxy() returns
NULL, the callback logs:
if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
g_warning ("Failed to connect to screensaver service: %s",
error->message);
At this point "error" is declared as g_autoptr(GError) error = NULL; and
was only set by an earlier call that succeeded, so it is still NULL.
g_error_matches (NULL, ...) returns FALSE, so the warning is executed
and error->message is read from a NULL pointer. Whether this path is
reached depends on the screensaver service being unavailable; when it
is, the service may crash.
EVIDENCE (from the affected machine)
- Kernel log, 5 consecutive crashes of the service within about 8 seconds, each
of the form: gsd-usb-protect[PID]: segfault at 8 ip ... error 4 in
gsd-usb-protection[...+4000] (same instruction offset every time).
- Static disassembly of the packaged binary (gdb), crash offset in the .text of
the executable: "mov 0x8(%rax),%rcx" immediately before a call to g_log with
the format string "Failed to connect to screensaver service: %s". Offset 8 is
the "message" field of GError. The preceding g_error_matches test uses a
different stack variable than the one dereferenced.
- Apport report: Signal 11 (SIGSEGV), SegvReason "reading NULL VMA", package
version as above. The core dump is not attached (it may contain private data);
the report file is retained locally and can be inspected on request.
- Session bus log (session of the unprivileged desktop user), just before the
crash: "Activated service 'org.gnome.ScreenSaver' failed: Failed to execute
program org.gnome.ScreenSaver: No such file or directory", then
"gsd-usb-protect: Failed to connect to the screen saver: Error calling
StartServiceByName for org.gnome.ScreenSaver ...", then the segfault. gsd-power
hit the same ScreenSaver failure but did not crash.
HISTORICAL TRIGGER (no longer present on this machine)
The system had been given a minimal GNOME installation (installed with
--no-install-recommends), so the package gjs was missing. The D-Bus service
file /usr/share/dbus-1/services/org.gnome.ScreenSaver.service (package
gnome-shell) runs "/usr/bin/gjs -m
/usr/share/gnome-shell/org.gnome.ScreenSaver", so the service could not start
in that session. The session was a plain GNOME session (the gnome.session
component list contains the USB protection service; ubuntu.session does not).
After the full ubuntu-desktop installation (gjs installed), the ScreenSaver
service activates normally and no further crash occurred. So the trigger is
gone here, but the defect in the code remains: any situation in which the
screensaver service cannot be reached, on a session that starts
gsd-usb-protection, may crash it. Other distributions report the same crash
signature in the same function (Arch Linux with dbus-broker 36-1, Fedora ABRT
reports for gnome-settings-daemon 47.2/48.1; see the upstream issue).
I did not reproduce the crash artificially; the analysis above is based
on the observed crashes, the journal, the packaged binary, and the
upstream source of the 46 branch.
REFERENCES
- Upstream issue:
https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/792 (closed
2025-04-19)
- Upstream merge request:
https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/merge_requests/410 ("usb
protection: Fix segmentation fault on accessing unset variable.")
- Upstream commit: d91c98ed0eeb7fa7ce5f4b3f2e3b105752ca97f9
- Equivalent downstream patch (Guix): https://debbugs.gnu.org/db/77/77135.html
DUPLICATE CHECK
Searched Launchpad bugs for the source package gnome-settings-daemon in Ubuntu
(terms "gsd-usb-protection", "usb protection", "screensaver segfault", across
open and closed statuses, final check before submission) and the general Ubuntu
tracker ("usb_protection_proxy_ready", "gsd-usb-protection segfault"): no
matching bug found. The only hit, bug 1872153, is a different glib2.0 crash
(g_source_set_ready_time). Launchpad's own similar-bug search on the summary
also reported no similar bug reports.
REQUEST
Please backport the upstream fix (a change of the faulty warning so that it no
longer reads error->message when error is NULL) to gnome-settings-daemon in
noble (24.04 LTS), as a stable release update.
SRU INFORMATION (proposed)
- Impact: gsd-usb-protection may crash (SIGSEGV) in sessions that run this
service when the screensaver service is unavailable; in the observed case
systemd restarted it until the start limit was hit, and apport reported the
crash.
- Test case: start a GNOME session in which org.gnome.ScreenSaver cannot be
activated (for example a session where its D-Bus service executable is missing)
and check that gsd-usb-protection logs a warning instead of crashing. Not run
by the reporter on purpose; the reporter observed it on a real installation.
- Where problems could occur: the change only alters a log message on an error
path; regression risk is very low.
- Other info: no workaround requested; the service was not disabled or masked.
Information deliberately not included: passwords, user names, host and
network addresses, full logs and core dumps.
** Affects: gnome-settings-daemon (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172332
Title:
gsd-usb-protection may crash (SIGSEGV) in usb_protection_proxy_ready
when the screensaver proxy is unavailable — fixed upstream (MR !410);
SRU request (reliability) for noble
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-settings-daemon/+bug/2172332/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
