Bug 344571 - krfb crashes on connect
Summary: krfb crashes on connect
Status: RESOLVED UPSTREAM
Alias: None
Product: krfb
Classification: Applications
Component: general (show other bugs)
Version: unspecified
Platform: openSUSE Linux
: NOR crash
Target Milestone: ---
Assignee: George Goldberg
URL:
Keywords: drkonqi
: 344084 344668 345243 345432 345442 345778 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-02-25 21:43 UTC by rainer
Modified: 2015-05-24 19:00 UTC (History)
13 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
New crash information added by DrKonqi (2.83 KB, text/plain)
2015-02-27 15:24 UTC, vlad.shkapsky
Details
valgrind log as requested (8.76 KB, text/x-log)
2015-03-01 15:43 UTC, rainer
Details
New crash information added by DrKonqi (3.67 KB, text/plain)
2015-03-10 06:49 UTC, rainer
Details
valgrind log with debug symbols for glibc as well (8.44 KB, text/plain)
2015-03-16 22:06 UTC, rainer
Details
New crash information added by DrKonqi (2.69 KB, text/plain)
2015-05-07 06:23 UTC, vlad.shkapsky
Details

Note You need to log in before you can comment on or make changes to this bug.
Description rainer 2015-02-25 21:43:36 UTC
Application: krfb (4.14.4)
KDE Platform Version: 4.14.4
Qt Version: 4.8.6
Operating System: Linux 3.16.7-7-desktop x86_64
Distribution: "openSUSE 13.2 (Harlequin) (x86_64)"

-- Information about the crash:
Since two versions does krfb always crashes on connect from a vnc client

The crash can be reproduced every time.

-- Backtrace:
Application: Freigabe der Arbeitsfläche (krfb), signal: Aborted
Using host libthread_db library "/lib64/libthread_db.so.1".
[Current thread is 1 (Thread 0x7fc349040000 (LWP 8327))]

Thread 2 (Thread 0x7fc335091700 (LWP 8332)):
#0  0x00007fc34515bc3d in poll () at /lib64/libc.so.6
#1  0x00007fc341f25be4 in  () at /usr/lib64/libglib-2.0.so.0
#2  0x00007fc341f25cec in g_main_context_iteration () at /usr/lib64/libglib-2.0.so.0
#3  0x00007fc345afb0de in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQtCore.so.4
#4  0x00007fc345acce6f in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQtCore.so.4
#5  0x00007fc345acd165 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQtCore.so.4
#6  0x00007fc3459ca0bf in QThread::exec() () at /usr/lib64/libQtCore.so.4
#7  0x00007fc345aae783 in  () at /usr/lib64/libQtCore.so.4
#8  0x00007fc3459cc79f in  () at /usr/lib64/libQtCore.so.4
#9  0x00007fc3457360a4 in start_thread () at /lib64/libpthread.so.0
#10 0x00007fc34516406d in clone () at /lib64/libc.so.6

Thread 1 (Thread 0x7fc349040000 (LWP 8327)):
[KCrash Handler]
#5  0x00007fc3450b4187 in raise () at /lib64/libc.so.6
#6  0x00007fc3450b5538 in abort () at /lib64/libc.so.6
#7  0x00007fc3450f1844 in  () at /lib64/libc.so.6
#8  0x00007fc3451744d7 in __fortify_fail () at /lib64/libc.so.6
#9  0x00007fc3451726f0 in __readonly_area () at /lib64/libc.so.6
#10 0x00007fc345174447 in  () at /lib64/libc.so.6
#11 0x00007fc348a2c208 in rfbProcessNewConnection () at /usr/lib64/libvncserver.so.0
#12 0x00007fc345ae21fa in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () at /usr/lib64/libQtCore.so.4
#13 0x00007fc345b2d10e in QSocketNotifier::activated(int) () at /usr/lib64/libQtCore.so.4
#14 0x00007fc345aeafab in QSocketNotifier::event(QEvent*) () at /usr/lib64/libQtCore.so.4
#15 0x00007fc34675976c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib64/libQtGui.so.4
#16 0x00007fc34675fcad in QApplication::notify(QObject*, QEvent*) () at /usr/lib64/libQtGui.so.4
#17 0x00007fc347d46baa in KApplication::notify(QObject*, QEvent*) () at /usr/lib64/libkdeui.so.5
#18 0x00007fc345ace2ad in QCoreApplication::notifyInternal(QObject*, QEvent*) () at /usr/lib64/libQtCore.so.4
#19 0x00007fc345afbe18 in  () at /usr/lib64/libQtCore.so.4
#20 0x00007fc341f25a04 in g_main_context_dispatch () at /usr/lib64/libglib-2.0.so.0
#21 0x00007fc341f25c48 in  () at /usr/lib64/libglib-2.0.so.0
#22 0x00007fc341f25cec in g_main_context_iteration () at /usr/lib64/libglib-2.0.so.0
#23 0x00007fc345afb0be in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQtCore.so.4
#24 0x00007fc3467f6676 in  () at /usr/lib64/libQtGui.so.4
#25 0x00007fc345acce6f in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQtCore.so.4
#26 0x00007fc345acd165 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib64/libQtCore.so.4
#27 0x00007fc345ad25b9 in QCoreApplication::exec() () at /usr/lib64/libQtCore.so.4
#28 0x000000000040f325 in  ()
#29 0x00007fc3450a0b05 in __libc_start_main () at /lib64/libc.so.6
#30 0x000000000040f3d4 in _start ()

Reported using DrKonqi
Comment 1 Christoph Feck 2015-02-25 23:38:35 UTC
*** Bug 344084 has been marked as a duplicate of this bug. ***
Comment 2 rainer 2015-02-26 06:29:32 UTC
Today I cross-checked again with krfb 4.14.3 (previously also checked 4.14.2) installed from the openSuse updates Repo. Both work in the same environment without apparent issues.

I am developer myself, albeit without almost any experience in native Linux development in general or KDE development in particular, but willing to assist with anything that can help clarifying this issue.
Comment 3 vlad.shkapsky 2015-02-27 15:24:56 UTC
Created attachment 91325 [details]
New crash information added by DrKonqi

krfb (4.14.4) on KDE Platform 4.14.4 using Qt 4.8.6

- What I was doing when the application crashed:
You are connecting from a remote machine, after entering the password got connection error.
- Unusual behavior I noticed:
The bug had appeared after the update 2 weeks ago.

-- Backtrace (Reduced):
#11 0x00007f4add106208 in rfbProcessNewConnection () from /usr/lib64/libvncserver.so.0
[...]
#13 0x00007f4ada20710e in QSocketNotifier::activated(int) () from /usr/lib64/libQtCore.so.4
#14 0x00007f4ada1c4fab in QSocketNotifier::event(QEvent*) () from /usr/lib64/libQtCore.so.4
#15 0x00007f4adae3376c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
#16 0x00007f4adae39cad in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
Comment 4 Christoph Feck 2015-02-28 22:16:18 UTC
*** Bug 344668 has been marked as a duplicate of this bug. ***
Comment 5 Christoph Feck 2015-02-28 22:18:00 UTC
This seems to be a problem in "libvncserver.so". I am not sure if there was a recent update for this library in openSUSE.
Comment 6 Hrvoje Senjan 2015-03-01 00:12:09 UTC
there haven't been any updates for the LibVNCServer source package within 13.2, i'll check Tumbleweed (but looks like the problem is on 13.2?)
Comment 7 rainer 2015-03-01 09:02:47 UTC
As stated above I checked installing the openSUSE 13.2 package 4.14.3-4.2-x86_64. This version works on the same system where the current package (14.12.1-8.1-x86_64) crashes. libvncserver is the same in both contexts.
Comment 8 Christoph Feck 2015-03-01 09:54:48 UTC
Ah I see. With the updated krfb application, the bundled libvncserver is no longer used, but the system's libvncserver.

It looks like this change has not been well tested with different libvncserver versions.
Comment 9 rainer 2015-03-01 13:43:48 UTC
With bundled do you mean 'statically linked'? Because the shared library (libvncserver.so) is not part of the rpm in both versions, as far as I can see.
Comment 10 Albert Astals Cid 2015-03-01 13:45:28 UTC
Which libvncserver version are you running?
Comment 11 rainer 2015-03-01 14:47:35 UTC
The libvncserver package carries the version number 0.9.9-10.2.1-x86_64
Comment 12 Albert Astals Cid 2015-03-01 15:01:37 UTC
krfb works just fine here with a similar-ish version number in ubuntu.

No idea if debug packages for opensuse exist, can you install them for both krfb and libvncserver and then run in a terminal

killall krfb
valgrind krfb --nofork

try to connect, and attach the log of running krfb under valgrind?
Comment 13 rainer 2015-03-01 15:43:22 UTC
Created attachment 91365 [details]
valgrind log as requested

I created the log by running valgrind krfb --nofork 2> valgrind.log

If something different is required, please just tell.
Comment 14 rainer 2015-03-10 06:49:45 UTC
Created attachment 91517 [details]
New crash information added by DrKonqi

krfb (4.14.5) on KDE Platform 4.14.5 using Qt 4.8.6

- What I was doing when the application crashed:
Trying to connect to the computer running krfb with a mobile vnc client as before. In the meantime there was an update of the openSUSE krfb package, but the behaviour didn't change.

-- Backtrace (Reduced):
#7  0x00007fb9eec86844 in  () at /lib64/libc.so.6
#8  0x00007fb9eed094d7 in __fortify_fail () at /lib64/libc.so.6
#9  0x00007fb9eed076f0 in __readonly_area () at /lib64/libc.so.6
#10 0x00007fb9eed09447 in  () at /lib64/libc.so.6
#11 0x00007fb9f25c1208 in rfbProcessNewConnection (rfbScreen=0x2942ff0) at sockets.c:407
Comment 15 Christoph Feck 2015-03-15 22:09:41 UTC
Rainer, could you additionally install debug symbols for glibc?
Comment 16 rainer 2015-03-16 22:06:35 UTC
Created attachment 91586 [details]
valgrind log with debug symbols for glibc as well

Created a new valgrind log, additionally with debug symbols for glibc as requested.
Comment 17 Christoph Feck 2015-03-16 22:14:55 UTC
Okey, that confirms my suspicion. The assert is caused by __fdelt_chk, which means that either an invalid file descriptor is passed to/ or from rfbProcessNewConnection in libvncserver, or the system ran out of file descriptors.
Comment 18 rainer 2015-03-16 22:33:50 UTC
I would be surprised if my system ran out of filedescriptors - all other activities went on unhindered.
Is there something more I can try or do to reveal the reason for this invalid filedescriptor?
Comment 19 Christoph Feck 2015-03-18 06:52:27 UTC
*** Bug 345243 has been marked as a duplicate of this bug. ***
Comment 20 Christoph Feck 2015-03-23 10:21:44 UTC
*** Bug 345432 has been marked as a duplicate of this bug. ***
Comment 21 Christoph Feck 2015-03-23 10:23:59 UTC
*** Bug 345442 has been marked as a duplicate of this bug. ***
Comment 22 Christoph Feck 2015-05-03 09:21:15 UTC
*** Bug 345778 has been marked as a duplicate of this bug. ***
Comment 23 Albert Astals Cid 2015-05-06 22:36:03 UTC
libvncserver in opensuse needs to be updated, ubuntu is using this patchset that works

Description: Do not segfault on listenSock/listen6Sock
Author: mackyle

Index: libvncserver/libvncserver/sockets.c
===================================================================
--- libvncserver.orig/libvncserver/sockets.c    2014-05-01 10:11:04.295952467 +0200
+++ libvncserver/libvncserver/sockets.c 2014-05-01 10:16:22.953295982 +0200
@@ -402,9 +402,9 @@
       rfbLogPerror("rfbProcessNewConnection: error in select");
       return FALSE;
     }
-    if (FD_ISSET(rfbScreen->listenSock, &listen_fds)) 
+    if (rfbScreen->listenSock >= 0 && FD_ISSET(rfbScreen->listenSock, &listen_fds)) 
       chosen_listen_sock = rfbScreen->listenSock;
-    if (FD_ISSET(rfbScreen->listen6Sock, &listen_fds)) 
+    if (rfbScreen->listen6Sock >= 0 && FD_ISSET(rfbScreen->listen6Sock, &listen_fds)) 
       chosen_listen_sock = rfbScreen->listen6Sock;
 
     if ((sock = accept(chosen_listen_sock,

Or they can get an updated upstream version from libvncserver that also has this fixed in a similar way, see https://github.com/LibVNC/libvncserver/blob/master/libvncserver/sockets.c
Comment 24 vlad.shkapsky 2015-05-07 06:23:24 UTC
Created attachment 92469 [details]
New crash information added by DrKonqi

krfb (4.14.6) on KDE Platform 4.14.6 using Qt 4.8.6

Hi
Upgraded system, the problem persists.

-- Backtrace (Reduced):
#11 0x00007ff7355d4208 in rfbProcessNewConnection () from /usr/lib64/libvncserver.so.0
[...]
#13 0x00007ff7326d510e in QSocketNotifier::activated(int) () from /usr/lib64/libQtCore.so.4
#14 0x00007ff732692fab in QSocketNotifier::event(QEvent*) () from /usr/lib64/libQtCore.so.4
#15 0x00007ff73330176c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
#16 0x00007ff733307cad in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQtGui.so.4
Comment 25 Christoph Feck 2015-05-07 22:33:47 UTC
> Upgraded system

There was no update to the libvncserver package yet.

Or are you saying that you compiled source code from upstream and still get the crash?
Comment 26 rainer 2015-05-24 18:18:32 UTC
Today I received a new version of libvncserver.so through a security update package from openSUSE for my version 13.2. The libvncserver package version is now 0.9.10-10.4.1-x86_64 and the crash is gone.
Should I close this issue?
Comment 27 Howard 2015-05-24 19:00:04 UTC
Today's installation of libvncserver 0.9.10-10.4.1-i586 fixed the crash on my 32-bit system, after a reboot.
Thanks,
Howard