Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump reported libudev version? #2

Open
vishwin opened this issue Jul 2, 2022 · 5 comments
Open

Bump reported libudev version? #2

vishwin opened this issue Jul 2, 2022 · 5 comments

Comments

@vishwin
Copy link

vishwin commented Jul 2, 2022

For example, muffin 5.4 (from Cinnamon desktop environment) specifies a minimum version requirement of 228.

wulf7 added a commit that referenced this issue Jul 14, 2022
to match eudev and libudev-zero and satisfy software like muffin 5.4

#2
@wulf7
Copy link
Owner

wulf7 commented Jul 14, 2022

Could you test the current master?

@vishwin
Copy link
Author

vishwin commented Jul 15, 2022

muffin builds fine, but barfs at runtime. Seems like enabling muffin's udev support offloads otherwise included functionality/code to udev that we haven't quite implemented yet?

(lldb) bt
* thread #1, name = 'cinnamon', stop reason = signal SIGBUS
  * frame #0: 0x000000085b57968f libudev.so.0`udev_list_RB_MINMAX(head=0x000000086a623048, val=-1) at udev-list.c:176:1
    frame #1: 0x000000085b57979a libudev.so.0`udev_list_entry_get_first(ul=0x000000086a623048) at udev-list.c:111:10
    frame #2: 0x000000085b577bad libudev.so.0`udev_device_get_property_value(ud=0x000000086a623040, property="") at udev-device.c:209:2
    frame #3: 0x00000008262b9227 libmuffin.so.0`has_udev_property(settings=0x000000086a5f5b10, device=0x000000086a653620, property_name="") at meta-input-settings-x11.c:608:15
    frame #4: 0x00000008262b8f24 libmuffin.so.0`is_mouse(settings=0x000000086a5f5b10, device=0x000000086a653620) at meta-input-settings-x11.c:633:11
    frame #5: 0x00000008262b8110 libmuffin.so.0`meta_input_settings_x11_set_mouse_accel_profile(settings=0x000000086a5f5b10, device=0x000000086a653620, profile=C_DESKTOP_POINTER_ACCEL_PROFILE_DEFAULT) at meta-input-settings-x11.c:700:8
    frame #6: 0x000000082628f37b libmuffin.so.0`do_update_pointer_accel_profile(input_settings=0x000000086a5f5b10, settings=0x000000086a5c94e0, device=0x000000086a653620, profile=C_DESKTOP_POINTER_ACCEL_PROFILE_DEFAULT) at meta-input-settings.c:356:5
    frame #7: 0x000000082628e361 libmuffin.so.0`update_pointer_accel_profile(input_settings=0x000000086a5f5b10, settings=0x000000086a5c94e0, device=0x000000086a653620) at meta-input-settings.c:394:11
    frame #8: 0x000000082628dcc9 libmuffin.so.0`apply_device_settings(input_settings=0x000000086a5f5b10, device=0x0000000000000000) at meta-input-settings.c:1694:3
    frame #9: 0x000000082628daf5 libmuffin.so.0`meta_input_settings_constructed(object=0x000000086a5f5b10) at meta-input-settings.c:1966:3
    frame #10: 0x0000000822f83848 libgobject-2.0.so.0`g_object_new_internal(class=0x000000086a4eff00, params=0x0000000000000000, n_params=0) at gobject.c:2053:5
    frame #11: 0x0000000822f82b85 libgobject-2.0.so.0`g_object_new_with_properties(object_type=36679990176, n_properties=0, names=0x0000000000000000, values=0x0000000000000000) at gobject.c:2181:14
    frame #12: 0x0000000822f828ce libgobject-2.0.so.0`g_object_new(object_type=36679990176, first_property_name=0x0000000000000000) at gobject.c:1821:12
    frame #13: 0x00000008262af5af libmuffin.so.0`meta_backend_x11_cm_create_input_settings(backend=0x000000086a501200) at meta-backend-x11-cm.c:126:10
    frame #14: 0x0000000826283552 libmuffin.so.0`meta_backend_create_input_settings(backend=0x000000086a501200) at meta-backend.c:507:10
    frame #15: 0x0000000826282d4d libmuffin.so.0`meta_backend_real_post_init(backend=0x000000086a501200) at meta-backend.c:538:26
    frame #16: 0x00000008262b14fe libmuffin.so.0`meta_backend_x11_post_init(backend=0x000000086a501200) at meta-backend-x11.c:571:3
    frame #17: 0x00000008262af49d libmuffin.so.0`meta_backend_x11_cm_post_init(backend=0x000000086a501200) at meta-backend-x11-cm.c:90:3
    frame #18: 0x0000000826283bdf libmuffin.so.0`meta_backend_post_init(backend=0x000000086a501200) at meta-backend.c:974:3
    frame #19: 0x000000082628399f libmuffin.so.0`meta_backend_initable_init(initable=0x000000086a501200, cancellable=0x0000000000000000, error=0x00000008208bfcf0) at meta-backend.c:1020:3
    frame #20: 0x00000008262b2ae0 libmuffin.so.0`meta_backend_x11_initable_init(initable=0x000000086a501200, cancellable=0x0000000000000000, error=0x00000008208bfcf0) at meta-backend-x11.c:817:10
    frame #21: 0x00000008221bf205 libgio-2.0.so.0`g_initable_init(initable=0x000000086a501200, cancellable=0x0000000000000000, error=0x00000008208bfcf0) at ginitable.c:128:10
    frame #22: 0x000000082628211e libmuffin.so.0`meta_init_backend(backend_gtype=36142960976) at meta-backend.c:1391:8
    frame #23: 0x000000082630943f libmuffin.so.0`meta_init at main.c:594:3
    frame #24: 0x0000000000202e97 cinnamon`main + 263
    frame #25: 0x0000000000202b65 cinnamon`_start + 261
(lldb) 

@wulf7
Copy link
Owner

wulf7 commented Jul 15, 2022

It looks like some sort of memory corruption. Could you check ul content in frame #1. And ud in frame #2

@wulf7
Copy link
Owner

wulf7 commented Jul 15, 2022

Test following patch:

--- a/udev-device.c
+++ b/udev-device.c
@@ -49,7 +49,7 @@ struct udev_device {
 	int refcount;
 	struct {
 		unsigned int action : 2;
-		unsigned int is_parent : 1;
+		unsigned int parent_got : 1;
 	} flags;
 	struct udev_list prop_list;
 	struct udev_list sysattr_list;
@@ -323,8 +323,7 @@ udev_device_ref(struct udev_device *ud)
 {
 	TRC("(%p/%s) %d", ud, ud->syspath, ud->refcount);
 
-	if (!ud->flags.is_parent)
-		++ud->refcount;
+	++ud->refcount;
 	return (ud);
 }
 
@@ -336,7 +335,7 @@ udev_device_free(struct udev_device *ud)
 	udev_list_free(&ud->sysattr_list);
 	udev_list_free(&ud->tag_list);
 	udev_list_free(&ud->devlink_list);
-	if (ud->parent != NULL)
+	if (!ud->flags.parent_got && ud->parent != NULL)
 		udev_device_free(ud->parent);
 	_udev_unref(ud->udev);
 	free(ud);
@@ -347,8 +346,6 @@ udev_device_unref(struct udev_device *ud)
 {
 
 	TRC("(%p/%s) %d", ud, ud->syspath, ud->refcount);
-	if (ud->flags.is_parent)
-		return;
 	if (--ud->refcount == 0)
 		udev_device_free(ud);
 }
@@ -358,6 +355,8 @@ udev_device_get_parent(struct udev_device *ud)
 {
 
 	TRC("(%p/%s) %p", ud, ud->syspath, ud->parent);
+	if (ud->parent != NULL)
+		ud->flags.parent_got = 1;
 	return (ud->parent);
 }
 
@@ -374,8 +373,6 @@ udev_device_get_parent_with_subsystem_devtype(struct udev_device *ud,
 void
 udev_device_set_parent(struct udev_device *ud, struct udev_device *parent)
 {
-
-	parent->flags.is_parent = 1;
 	ud->parent = parent;
 }
 

@vishwin
Copy link
Author

vishwin commented Jul 16, 2022

No crash with patch. Will need to continue dogfooding the functionality muffin exposes with this option, which is a different multi-monitor management implementation (OPTION marked experimental in the WIP port for now)

wulf7 added a commit that referenced this issue Jul 16, 2022
to client via udev_device_get_parent().

This fixes use-after-free in following scenario found in muffun 5.4:

parent_dev = udev_device_get_parent(child_dev);
udev_device_unref(child_dev);
udev_device_do_something(parent_dev);

#2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants