Bug#948228: libaccountsservice0: gnome-shell crashed during accounts-daemon restart, trying to update user with NULL username

[Simon McVittie]

Package: libaccountsservice0
Version: 0.6.55-1
Severity: important

While installing apt updates, needrestart restarted
accounts-daemon.service and GNOME Shell crashed. From the stack trace and
the timing, I suspect the restart may have caused the crash.

In stack frames 3-5, libaccountsservice calls act_user_get_user_name(user)
which returns NULL, then tries to look that up in a hash table; but
g_str_hash() is not NULL-safe, leading to a crash.

#0  0x00007faa1d282e90 in g_str_hash (v=0x0) at ../../../glib/ghash.c:2324
#1  0x00007faa1d281f6f in g_hash_table_lookup_node (hash_return=<synthetic pointer>, key=0x0, hash_table=0x55d4362319e0)
    at ../../../glib/ghash.c:473
#2  0x00007faa1d281f6f in g_hash_table_lookup (hash_table=0x55d4362319e0, key=key at entry=0x0) at ../../../glib/ghash.c:1509
#3  0x00007fa9d3d6be78 in update_user (user=0x55d4361f6b00 [ActUser], manager=0x55d435949e90 [ActUserManager])
    at ../src/libaccountsservice/act-user-manager.c:1020
#4  0x00007fa9d3d6be78 in on_user_changed (manager=0x55d435949e90 [ActUserManager], user=0x55d4361f6b00 [ActUser])
    at ../src/libaccountsservice/act-user-manager.c:664
#5  0x00007fa9d3d6be78 in on_user_changed (user=0x55d4361f6b00 [ActUser], manager=0x55d435949e90 [ActUserManager])
    at ../src/libaccountsservice/act-user-manager.c:650
#9  0x00007faa1d39981f in <emit signal ??? on instance 0x55d4361f6b00 [ActUser]>
    (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../../../gobject/gsignal.c:3453
    #6  0x00007faa1d37ceb2 in g_closure_invoke
    (closure=0x55d4366344d0, return_value=0x0, n_param_values=1, param_values=0x7ffe672a9a00, invocation_hint=0x7ffe672a9980)
    at ../../../gobject/gclosure.c:810
    #7  0x00007faa1d3904d4 in signal_emit_unlocked_R
    (node=node at entry=0x55d4361ffb30, detail=detail at entry=0, instance=instance at entry=0x55d4361f6b00, emission_return=emission_return at entry=0x0, instance_and_params=instance_and_params at entry=0x7ffe672a9a00) at ../../../gobject/gsignal.c:3641
    #8  0x00007faa1d39918f in g_signal_emit_valist
    (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args at entry=0x7ffe672a9bb0)
    at ../../../gobject/gsignal.c:3397
#10 0x00007faa1b83b8ee in ffi_call_unix64 () at /usr/lib/x86_64-linux-gnu/libffi.so.6
#11 0x00007faa1b83b2bf in ffi_call () at /usr/lib/x86_64-linux-gnu/libffi.so.6
Python Exception <class 'gdb.error'> There is no member named v_pointer.:
#15 0x00007faa1d39829a in #16 0x00007fa9d3d74c5d in accounts_user_proxy_g_signal
    (proxy=<optimized out>, sender_name=<optimized out>, signal_name=<optimized out>, parameters=<optimized out>)
    at src/accounts-user-generated.c:5493
#20 0x00007faa1d39981f in <emit signal ??? on instance 0x55d4374ddf90 [AccountsUserProxy]>
    (instance=instance at entry=0x55d4374ddf90, signal_id=<optimized out>, detail=detail at entry=0)
    at ../../../gobject/gsignal.c:3453
    #17 0x00007faa1d37ceb2 in g_closure_invoke
    (closure=0x55d433fd5670, return_value=0x0, n_param_values=4, param_values=0x7ffe672aa3c0, invocation_hint=0x7ffe672aa340)
    at ../../../gobject/gclosure.c:810
    #18 0x00007faa1d38fc56 in signal_emit_unlocked_R
    (node=node at entry=0x55d433fd56a0, detail=detail at entry=0, instance=instance at entry=0x55d4374ddf90, emission_return=emission_return at entry=0x0, instance_and_params=instance_and_params at entry=0x7ffe672aa3c0) at ../../../gobject/gsignal.c:3679
    #19 0x00007faa1d39918f in g_signal_emit_valist
    (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args at entry=0x7ffe672aa5c0)
    at ../../../gobject/gsignal.c:3397
#21 0x00007faa1d4d4bc8 in on_signal_received
    (connection=<optimized out>, sender_name=0x7faa0c21a530 ":1.7344", object_path=<optimized out>, interface_name=<optimized out>, signal_name=0x7faa0c1c10f0 "Changed", parameters=0x7faa0c0d7350, user_data=0x55d436a3a2b0)
    at ../../../gio/gdbusproxy.c:924
#22 0x00007faa1d4c3944 in emit_signal_instance_in_idle_cb (data=0x7faa0c2e10b0) at ../../../gio/gdbusconnection.c:3747
#23 0x00007faa1d293dee in g_main_dispatch (context=0x55d433fc7320) at ../../../glib/gmain.c:3179
#24 0x00007faa1d293dee in g_main_context_dispatch (context=context at entry=0x55d433fc7320) at ../../../glib/gmain.c:3844
#25 0x00007faa1d2941a0 in g_main_context_iterate
    (context=0x55d433fc7320, block=block at entry=1, dispatch=dispatch at entry=1, self=<optimized out>)
    at ../../../glib/gmain.c:3917
#26 0x00007faa1d294473 in g_main_loop_run (loop=0x55d43430daa0) at ../../../glib/gmain.c:4111
#27 0x00007faa1c747ddc in meta_run () at ../src/core/main.c:676
#28 0x000055d432e83845 in main (argc=<optimized out>, argv=<optimized out>) at ../src/main.c:552

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-debug'), (500, 'buildd-unstable'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental-debug'), (1, 'buildd-experimental'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.4.0-1-amd64 (SMP w/2 CPU cores)
Kernel taint flags: TAINT_WARN, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libaccountsservice0 depends on:
ii  libc6         2.29-8
ii  libglib2.0-0  2.62.4-1

libaccountsservice0 recommends no packages.

libaccountsservice0 suggests no packages.

-- no debconf information