Skip to content

Wayland: Invalid write in xfsm_logout_dialog

Description

I ran xfce4-session in Valgrind (with labwc) and triggered an invalid write while trying to log out. My VM was sluggish during the log out process, so I clicked the log out button multiple times. I think this is a race condition because I've performed the same scenario in the past and haven't triggered any invalid writes.

Valgrind log

Invalid write of size 4
   at 0x40223EF: xfsm_logout_dialog (xfsm-logout-dialog.c:784)
   by 0x40232C4: xfsm_manager_save_yourself_global (xfsm-manager.c:1289)
   by 0x402364C: xfsm_manager_dbus_shutdown_idled (xfsm-manager.c:2378)
   by 0x4B26E46: g_idle_dispatch (gmain.c:6466)
   by 0x4B27FD3: g_main_dispatch (gmain.c:3565)
   by 0x4B2AE3D: g_main_context_dispatch_unlocked (gmain.c:4425)
   by 0x4B2AE3D: g_main_context_iterate_unlocked (gmain.c:4490)
   by 0x4B2B6E8: g_main_loop_run (gmain.c:4695)
   by 0x4F7D5C5: gtk_main (gtkmain.c:1332)
   by 0x401C822: main (main.c:405)
 Address 0xb981d4c is 156 bytes inside a block of size 288 free'd
   at 0x488EA3B: free (vg_replace_malloc.c:990)
   by 0x4B31411: g_free_sized (gmem.c:238)
   by 0x4AAA6BD: g_type_free_instance (gtype.c:1972)
   by 0x4A8DFE2: g_object_unref (gobject.c:4920)
   by 0x4A92F9D: g_clear_object (gobject.c:4944)
   by 0x4A92FAD: g_value_object_free_value (gobject.c:5356)
   by 0x4AB0374: g_value_unset (gvalue.c:213)
   by 0x4A9CE3E: signal_emit_valist_unlocked (gsignal.c:3569)
   by 0x4AA4320: g_signal_emit_valist (gsignal.c:3278)
   by 0x4AA43CA: g_signal_emit (gsignal.c:3598)
   by 0x4023615: xfsm_manager_save_yourself_global (xfsm-manager.c:1390)
   by 0x402364C: xfsm_manager_dbus_shutdown_idled (xfsm-manager.c:2378)
   by 0x4B26E46: g_idle_dispatch (gmain.c:6466)
   by 0x4B27FD3: g_main_dispatch (gmain.c:3565)
   by 0x4B2AE3D: g_main_context_dispatch_unlocked (gmain.c:4425)
   by 0x4B2AE3D: g_main_context_iterate_unlocked (gmain.c:4490)
   by 0x4B2B6E8: g_main_loop_run (gmain.c:4695)
   by 0x4EE745F: gtk_dialog_run (gtkdialog.c:1399)
   by 0x402210A: xfsm_logout_dialog_run (xfsm-logout-dialog.c:651)
   by 0x402210A: xfsm_logout_dialog (xfsm-logout-dialog.c:769)
   by 0x40232C4: xfsm_manager_save_yourself_global (xfsm-manager.c:1289)
   by 0x402364C: xfsm_manager_dbus_shutdown_idled (xfsm-manager.c:2378)
   by 0x4B26E46: g_idle_dispatch (gmain.c:6466)
   by 0x4B27FD3: g_main_dispatch (gmain.c:3565)
   by 0x4B2AE3D: g_main_context_dispatch_unlocked (gmain.c:4425)
   by 0x4B2AE3D: g_main_context_iterate_unlocked (gmain.c:4490)
   by 0x4B2B6E8: g_main_loop_run (gmain.c:4695)
   by 0x4F7D5C5: gtk_main (gtkmain.c:1332)
   by 0x401C822: main (main.c:405)
 Block was alloc'd at
   at 0x4893187: calloc (vg_replace_malloc.c:1678)
   by 0x4B31375: g_malloc0 (gmem.c:133)
   by 0x4AAB9AE: g_type_create_instance (gtype.c:1872)
   by 0x4A8E8EB: g_object_new_internal (gobject.c:2665)
   by 0x4A90151: g_object_new_with_properties (gobject.c:2827)
   by 0x4A90F8E: g_object_new (gobject.c:2476)
   by 0x4024437: xfsm_manager_new (xfsm-manager.c:281)
   by 0x401C0DF: bus_acquired (main.c:163)
   by 0x49B6C50: connection_get_cb (gdbusnameowning.c:490)
   by 0x4951105: g_task_return_now (gtask.c:1363)
   by 0x4951F5A: g_task_return (gtask.c:1432)
   by 0x4952559: g_task_return_pointer (gtask.c:1874)
   by 0x49A6C3F: bus_get_async_initable_cb (gdbusconnection.c:8111)
   by 0x4951105: g_task_return_now (gtask.c:1363)
   by 0x495113B: complete_in_idle_cb (gtask.c:1377)
   by 0x4B26E46: g_idle_dispatch (gmain.c:6466)
   by 0x4B27FD3: g_main_dispatch (gmain.c:3565)
   by 0x4B2AE3D: g_main_context_dispatch_unlocked (gmain.c:4425)
   by 0x4B2AE3D: g_main_context_iterate_unlocked (gmain.c:4490)
   by 0x4B2B6E8: g_main_loop_run (gmain.c:4695)
   by 0x4F7D5C5: gtk_main (gtkmain.c:1332)
   by 0x401C822: main (main.c:405)

Version info

897ad9d6 compiled on Arch Linux