[Pkg-utopia-maintainers] Bug#1123876: dbus-broker: Crashes when trying to mount encrypted USB from Plasma

[Tobias Gruetzmacher]

Package: dbus-broker
Version: 37-3
Severity: important

Hi,

This seems to be a strlen() on a NULL-pointer...

To reporoduce (hopefully):
1. Insert drive with LUKS-encrypted data (I use no partition table on my
drives, not sure if relevant)
2. Click the mount button on the Drives Plasmoid
3. Enter passphrase
4. Click ok
5. dbus-broker crashes and pulls other dbus-connected applications with
   it
6. Despair in front of your unusable desktop (Logout/reboot in Plasma
   doesn't work anymore, probably because those are dbus actions?)
7. Desktop "disappears" some minutes later (Some watchdog kills kwin?)


Backtrace:

Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/bin/dbus-broker --log 11 --controller 10 --machine-id 185526166e484f06bc3b47fbfa9dd92a --max-bytes 100000000000000 --max-fds 25000000000000 --max-matches 5000000000'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76

(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1  0x0000558757e05deb in build_message_query_name (queryp=<synthetic pointer>, n_queryp=<synthetic pointer>, security_label=0x55878f319200 "plasmashell", security_label at entry=0x0, bustype=0x55878f1c36e0 "session",
    name=0x55878f3a1020 "unconfined", receiver_context=0x55878f1c7290 "org.freedesktop.Notifications", path=0x55878f4049e0 "/org/kde/solid/UDisks2StorageAccess_1", interface=0x0, method=0x55878f404a20 "passphraseReply")
    at ../src/util/apparmor.c:246
#2  apparmor_message_query_name (check_send=check_send at entry=false, security_label=security_label at entry=0x55878f319200 "plasmashell", bustype=bustype at entry=0x55878f1c36e0 "session",
    receiver_context=receiver_context at entry=0x55878f3a1020 "unconfined", name=0x55878f1c7290 "org.freedesktop.Notifications", path=path at entry=0x55878f4049e0 "/org/kde/solid/UDisks2StorageAccess_1", interface=0x0,
    method=0x55878f404a20 "passphraseReply", allow=0x7ffce482ab50, audit=0x7ffce482aa6c) at ../src/util/apparmor.c:318
#3  0x0000558757e06101 in apparmor_message_query (check_send=check_send at entry=false, security_label=security_label at entry=0x55878f319200 "plasmashell", bustype=0x55878f1c36e0 "session",
    receiver_context=receiver_context at entry=0x55878f3a1020 "unconfined", nameset=nameset at entry=0x7ffce482ac90, subject_id=subject_id at entry=36, path=0x55878f4049e0 "/org/kde/solid/UDisks2StorageAccess_1", interface=0x0,
    method=0x55878f404a20 "passphraseReply", allow=0x7ffce482ab50, audit=0x7ffce482ab54) at ../src/util/apparmor.c:388
#4  0x0000558757e06d58 in bus_apparmor_check_send (registry=0x55878f1c3c70, sender_context=<optimized out>, receiver_context=receiver_context at entry=0x55878f1e1ae0 "plasmashell (complain)",
    subject=subject at entry=0x7ffce482ac90, subject_id=36, path=path at entry=0x55878f4049e0 "/org/kde/solid/UDisks2StorageAccess_1", interface=0x0, method=0x55878f404a20 "passphraseReply") at ../src/util/apparmor.c:559
#5  0x0000558757dfdd71 in policy_snapshot_check_send (snapshot=snapshot at entry=0x55878f1f2970, subject_seclabel=0x55878f1e1ae0 "plasmashell (complain)", subject=subject at entry=0x7ffce482ac90, subject_id=<optimized out>,
    interface=0x0, method=0x55878f404a20 "passphraseReply", path=0x55878f4049e0 "/org/kde/solid/UDisks2StorageAccess_1", type=1, broadcast=false, n_fds=0) at ../src/bus/policy.c:1067
#6  0x0000558757dfafd1 in peer_queue_unicast (sender_policy=0x55878f1f2970, sender_names=sender_names at entry=0x7ffce482ad40, sender_replies=sender_replies at entry=0x55878f22c6f0, sender_user=0x55878f1c2570, sender_id=33,
    receiver=0x55878f235ff0, message=0x55878f4044a0) at ../src/bus/peer.c:811
#7  0x0000558757df4ff4 in driver_forward_unicast (sender=0x55878f22bc70, destination=<optimized out>, message=0x55878f4044a0) at ../src/bus/driver.c:2595
#8  driver_dispatch_internal (peer=<optimized out>, message=0x55878f4044a0) at ../src/bus/driver.c:2754
#9  driver_dispatch (peer=peer at entry=0x55878f22bc70, message=0x55878f4044a0) at ../src/bus/driver.c:2778
#10 0x0000558757df9b4d in peer_dispatch_connection (peer=<optimized out>, events=<optimized out>) at ../src/bus/peer.c:129
#11 peer_dispatch (file=0x55878f22c620) at ../src/bus/peer.c:201
#12 0x0000558757e02d05 in dispatch_context_dispatch (ctx=ctx at entry=0x55878f1c1af0) at ../src/util/dispatch.c:343
#13 0x0000558757de9bf0 in broker_run (broker=0x55878f1c1980) at ../src/broker/broker.c:203
#14 0x0000558757de8fc3 in run (log=0x7ffce482afe0) at ../src/broker/main.c:280
#15 main (argc=<optimized out>, argv=0x7ffce482b148) at ../src/broker/main.c:311

I'm reluctant to provide core dump, because passphrases/secrets...

There seems to be a Debian-specific patch around the AppArmor-stuff, so
I haven't reported this upstream yet.

Regards, Tobias

-- System Information:
Debian Release: forky/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.17.12+deb14-amd64 (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_CPU_OUT_OF_SPEC
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), LANGUAGE=de:en_GB:en_US
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dbus-broker depends on:
ii  dbus-system-bus-common  1.16.2-2
ii  init-system-helpers     1.69
ii  libapparmor1            4.1.0-1+b1
ii  libaudit1               1:4.1.2-1+b1
ii  libc6                   2.42-6
ii  libcap-ng0              0.8.5-4+b2
ii  libexpat1               2.7.3-1
ii  libselinux1             3.9-4+b1
ii  libsystemd0             259-1
ii  systemd-sysv            259-1

Versions of packages dbus-broker recommends:
ii  dbus-bin  1.16.2-2

dbus-broker suggests no packages.

-- no debconf information