segfault in update_device_cb on ubuntu 21:04

[alexanderkjall]

I got an segfault on this line:

xiccd/assets/xiccd/sources/xiccd.c

Line 102 in 39851da

g_debug ("loading profile '%s' for display %s",

complete stack trace:

(gdb) bt full
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:65
#1  0x00007f9a5375b2d8 in __vfprintf_internal (s=s@entry=0x7ffdb98ade60, format=format@entry=0x5627868020f0 "loading profile '%s' for display %s", ap=ap@entry=0x7ffdb98ae0a0, mode_flags=mode_flags@entry=2) at vfprintf-internal.c:1647
        len = <optimized out>
        step0_jumps = {0, 2448, 2360, 3000, 2504, 2896, 1904, 3088, 2216, 2112, 2760, 3344, 1752, 2344, 2840, 1832, 3424, 2008, 2592, 1520, -200, 40, 352, 1432, 296, -496, 1208, -656, -652, 3256}
        space = <optimized out>
        is_short = <optimized out>
        use_outdigits = <optimized out>
        step1_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 2112, 2760, 3344, 1752, 2344, 2840, 1832, 3424, 2008, 2592, 1520, -200, 40, 352, 1432, 296, -496, 1208, -656, -652, 0}
        group = <optimized out>
        prec = <optimized out>
        step2_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2760, 3344, 1752, 2344, 2840, 1832, 3424, 2008, 2592, 1520, -200, 40, 352, 1432, 296, -496, 1208, -656, -652, 0}
        string = 0x3f96580000000000 <error: Cannot access memory at address 0x3f96580000000000>
        left = <optimized out>
        is_long_double = <optimized out>
        width = <optimized out>
        step3a_jumps = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2680, 0, 0, 0, 2840, 1832, 3424, 2008, 2592, 0, 0, 0, 0, 1432, 0, 0, 0, 0, 0, 0}
        alt = <optimized out>
        showsign = <optimized out>
        is_long = 0
        is_char = <optimized out>
        pad = <optimized out>
        step3b_jumps = {0 <repeats 11 times>, 1752, 0, 0, 2840, 1832, 3424, 2008, 2592, 1520, -200, 40, 352, 1432, 296, -496, 1208, 0, 0, 0}
        step4_jumps = {0 <repeats 14 times>, 2840, 1832, 3424, 2008, 2592, 1520, -200, 40, 352, 1432, 296, -496, 1208, 0, 0, 0}
        is_negative = <optimized out>
        number = {longlong = <optimized out>, word = <optimized out>}
        base = <optimized out>
        the_arg = 
          {pa_wchar = 1397521568 L'\x534c7ca0', pa_int = 1397521568, pa_long_int = 140300799212704, pa_long_long_int = 140300799212704, pa_u_int = 1397521568, pa_u_long_int = 140300799212704, pa_u_long_long_int = 140300799212704, pa_double = 6.9317804975067656e-310, pa_long_double = <invalid float value>, pa_float128 = 1.67583549582042756888565553969983548e-4932, pa_string = 0x7f9a534c7ca0 "", pa_wstring = 0x7f9a534c7ca0 L"", pa_pointer = 0x7f9a534c7ca0, pa_user = 0x7f9a534c7ca0}
        spec = 115 's'
        _buffer = {__routine = 0x73663332, __arg = 0x63686164, __canceltype = 1936077618, __prev = 0x7f9a53564158 <__pow+24>}
        _avail = <optimized out>
        thousands_sep = 0x0
        grouping = 0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>
        done = 103
        f = 0x562786802112 "s"
        lead_str_end = 0x562786802101 "%s' for display %s"
        end_of_spec = <optimized out>
        work_buffer = "\020\034JS\232\177\000\000\265\251GS\232\177\000\000\000\000\060\004\000\000\000\000\205^HS\232\177\000\000`\326\t\207'V\000\000`\326\t\207'V\000\000\020ߊ\271\375\177\000\000p܊\271\375\177\000\000\340\350\t\207'V\000\000\271bHS\232\177\000\000\367\326\366>\200\000\000?\323,\323>\375\177\000\000 \340\212\271\375\177\000\000U\274HS\232\177\000\000@ފ\271\375\177\000\000`ފ\271\375\177\000\000\260܊\271\375\177\000\000\332_GS\232\177\000\000\000\000\000\000\000\000\360?\000\000\000\000\000\000\000\000\000\020\000\000\000\000\000\000\203\204GS\232\177\000\000\001\000\000\000\000\000\000\000\000\271\225:v,\260\321\060ۊ\271\375\177\000\000\356\224GS\232\177"...
        workend = 0x7ffdb98ade08 ""
        ap_save = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffdb98ae180, reg_save_area = 0x7ffdb98ae0c0}}
        nspecs_done = 1
        save_errno = 0
        readonly_format = 0
#2  0x00007f9a5376d0fa in __vasprintf_internal (result_ptr=0x7ffdb98adfc0, format=0x5627868020f0 "loading profile '%s' for display %s", args=0x7ffdb98ae0a0, mode_flags=2) at vasprintf.c:57
        string = 0x7f9a4802baa0 "+.\246\261\235\177"
        sf = 
            {_sbf = {_f = {_flags = -72515584, _IO_read_ptr = 0x56278702fc00 "loading profile '/home/capitol/.local/share/icc/edid-7a7f78d7dfbe6027bd078e6100a27d75.icc' for display ", _IO_read_end = 0x56278702fc65 "y ", _IO_read_base = 0x56278702fc00 "loading profile '/home/capitol/.local/share/icc/edid-7a7f78d7dfbe6027bd078e6100a27d75.icc' for display ", _IO_write_base = 0x56278702fc00 "loading profile '/home/capitol/.local/share/icc/edid-7a7f78d7dfbe6027bd078e6100a27d75.icc' for display ", _IO_write_ptr = 0x56278702fc67 "", _IO_write_end = 0x56278702fd2c "ON_WF_3720_S\301\002", _IO_buf_base = 0x56278702fc00 "loading profile '/home/capitol/.local/share/icc/edid-7a7f78d7dfbe6027bd078e6100a27d75.icc' for display ", _IO_buf_end = 0x56278702fd2c "ON_WF_3720_S\301\002", _IO_save_base = 0x0, _IO_backup_base = 0x0, _IO_save_end = 0x0, _markers = 0x0, _chain = 0x0, _fileno = 0, _flags2 = 128, _old_offset = -3337118437580883712, _cur_column = 0, _vtable_offset = -118 '\212', _shortbuf = "\271", _lock = 0x0, _offset = 0, _codecvt = 0xd1b02c763a95b900, _wide_data = 0xffffffffffffffff, _freeres_list = 0x0, _freeres_buf = 0x0, __pad5 = 18446744073709551496, _mode = -1, _unused2 --Type <RET> for more, q to quit, c to continue without paging--
= "'V\000\000\200\000\000\000\000\000\000\000\300ߊ\271\375\177\000"}, vtable = 0x7f9a538c7560 <_IO_str_jumps>}, _s = {_allocate_buffer_unused = 0x7f9a5377c130 <__GI___libc_malloc>, _free_buffer_unused = 0x7f9a5377c740 <__GI___libc_free>}}
        ret = <optimized out>
        needed = <optimized out>
        allocated = <optimized out>
#3  0x00007f9a53d610e3 in g_vasprintf () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007f9a53d33381 in g_strdup_vprintf () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007f9a53d1a95e in g_logv () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#6  0x00007f9a53d1adb3 in g_log () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#7  0x00005627867fed12 in  ()
#8  0x00007f9a539fd7d9 in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#9  0x00007f9a539fda1b in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#10 0x00007f9a53b3be5a in  () at /lib/x86_64-linux-gnu/libcolord.so.2
#11 0x00007f9a539fd7d9 in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#12 0x00007f9a539fda1b in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#13 0x00007f9a53a6647d in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#14 0x00007f9a539fd7d9 in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#15 0x00007f9a539fda1b in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#16 0x00007f9a53a68098 in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#17 0x00007f9a539fd7d9 in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#18 0x00007f9a539fda1b in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#19 0x00007f9a53a569ef in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#20 0x00007f9a539fd7d9 in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#21 0x00007f9a539fd81d in  () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#22 0x00007f9a53d127ef in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#23 0x00007f9a53d65d28 in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#24 0x00007f9a53d11e53 in g_main_loop_run () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#25 0x00005627867fe603 in  ()
#26 0x00007f9a5370d565 in __libc_start_main (main=0x5627867fe490, argc=1, argv=0x7ffdb98ae6c8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffdb98ae6b8) at ../csu/libc-start.c:332
        self = <optimized out>
        result = <optimized out>
        unwind_buf = 
              {cancel_jmp_buf = {{jmp_buf = {94727760255616, -5406738654803864332, 94727760242256, 0, 0, 0, 5407720080933573876, 5459419616432280820}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x1, 0x7ffdb98ae6c8}, data = {prev = 0x0, cleanup = 0x0, canceltype = 1}}}
        not_first_call = <optimized out>
#27 0x00005627867fe67e in  ()

[agalakhov]

Is this repeatable? I'm looking at the code and I can't imagine how this can happen.

[alexanderkjall]

Sorry no, I played around with it a bit after I got the segfault report but it never crashed again.

[paravoid]

It's probably repeatable, since what I think is the same stacktrace seems to be reported by other users in Ubuntu's bug tracker:
https://bugs.launchpad.net/ubuntu/+source/xiccd/+bug/1965531

The stacktraces there are more extensive and complete. I haven't looked into it very deeply, but I can't imagine how this can happen either yet, though.