diff --git a/glib2/0002-gthreadedresolver-Fix-race-between-source-callbacks-.patch b/glib2/0002-gthreadedresolver-Fix-race-between-source-callbacks-.patch new file mode 100644 index 0000000..17de85b --- /dev/null +++ b/glib2/0002-gthreadedresolver-Fix-race-between-source-callbacks-.patch @@ -0,0 +1,158 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Mon, 11 Sep 2023 16:02:15 +0100 +Subject: [PATCH] gthreadedresolver: Fix race between source callbacks and + finalize +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +I had thought that because `g_source_destroy()` was called for the two +sources (cancel and timeout) in the `GTask` finalize function for a +threaded resolver operation, that it would be fine to use a plain +pointer in the source callbacks to point to the `GTask`. + +That turns out to not be true: because the source callbacks are executed +in the GLib worker thread, and the `GTask` can be finalized in another +thread, it’s possible for a source callback (e.g. `cancelled_cb()`) to +be scheduled in the worker thread, then for the `GTask` to be finalized, +and then the source callback to continue execution and find itself +doing a use-after-free. + +Fix that by using a weak ref to the `GTask` in the source callbacks, +rather than a plain pointer. + +Signed-off-by: Philip Withnall + +Fixes: #3105 +--- + gio/gthreadedresolver.c | 43 +++++++++++++++++++++++++++++++++++------ + 1 file changed, 37 insertions(+), 6 deletions(-) + +diff --git a/gio/gthreadedresolver.c b/gio/gthreadedresolver.c +index 2d94531bfda3..c7a567549f28 100644 +--- a/gio/gthreadedresolver.c ++++ b/gio/gthreadedresolver.c +@@ -1422,85 +1422,116 @@ lookup_records_finish (GResolver *resolver, + static gboolean + timeout_cb (gpointer user_data) + { +- GTask *task = G_TASK (user_data); +- LookupData *data = g_task_get_task_data (task); ++ GWeakRef *weak_task = user_data; ++ GTask *task = NULL; /* (owned) */ ++ LookupData *data; + gboolean should_return; + ++ task = g_weak_ref_get (weak_task); ++ if (task == NULL) ++ return G_SOURCE_REMOVE; ++ ++ data = g_task_get_task_data (task); ++ + g_mutex_lock (&data->lock); + + should_return = g_atomic_int_compare_and_exchange (&data->will_return, NOT_YET, TIMED_OUT); + g_clear_pointer (&data->timeout_source, g_source_unref); + + g_mutex_unlock (&data->lock); + + if (should_return) + g_task_return_new_error (task, G_IO_ERROR, G_IO_ERROR_TIMED_OUT, + _("Socket I/O timed out")); + + /* Signal completion of the task. */ + g_mutex_lock (&data->lock); + data->has_returned = TRUE; + g_cond_broadcast (&data->cond); + g_mutex_unlock (&data->lock); + ++ g_object_unref (task); ++ + return G_SOURCE_REMOVE; + } + + /* Will be called in the GLib worker thread, so must lock all accesses to shared + * data. */ + static gboolean + cancelled_cb (GCancellable *cancellable, + gpointer user_data) + { +- GTask *task = G_TASK (user_data); +- LookupData *data = g_task_get_task_data (task); ++ GWeakRef *weak_task = user_data; ++ GTask *task = NULL; /* (owned) */ ++ LookupData *data; + gboolean should_return; + ++ task = g_weak_ref_get (weak_task); ++ if (task == NULL) ++ return G_SOURCE_REMOVE; ++ ++ data = g_task_get_task_data (task); ++ + g_mutex_lock (&data->lock); + + g_assert (g_cancellable_is_cancelled (cancellable)); + should_return = g_atomic_int_compare_and_exchange (&data->will_return, NOT_YET, CANCELLED); + g_clear_pointer (&data->cancellable_source, g_source_unref); + + g_mutex_unlock (&data->lock); + + if (should_return) + g_task_return_error_if_cancelled (task); + + /* Signal completion of the task. */ + g_mutex_lock (&data->lock); + data->has_returned = TRUE; + g_cond_broadcast (&data->cond); + g_mutex_unlock (&data->lock); + ++ g_object_unref (task); ++ + return G_SOURCE_REMOVE; + } + ++static void ++weak_ref_clear_and_free (GWeakRef *weak_ref) ++{ ++ g_weak_ref_clear (weak_ref); ++ g_free (weak_ref); ++} ++ + static void + run_task_in_thread_pool_async (GThreadedResolver *self, + GTask *task) + { + LookupData *data = g_task_get_task_data (task); + guint timeout_ms = g_resolver_get_timeout (G_RESOLVER (self)); + GCancellable *cancellable = g_task_get_cancellable (task); + + g_mutex_lock (&data->lock); + + g_thread_pool_push (self->thread_pool, g_object_ref (task), NULL); + + if (timeout_ms != 0) + { ++ GWeakRef *weak_task = g_new0 (GWeakRef, 1); ++ g_weak_ref_set (weak_task, task); ++ + data->timeout_source = g_timeout_source_new (timeout_ms); + g_source_set_static_name (data->timeout_source, "[gio] threaded resolver timeout"); +- g_source_set_callback (data->timeout_source, G_SOURCE_FUNC (timeout_cb), task, NULL); ++ g_source_set_callback (data->timeout_source, G_SOURCE_FUNC (timeout_cb), g_steal_pointer (&weak_task), (GDestroyNotify) weak_ref_clear_and_free); + g_source_attach (data->timeout_source, GLIB_PRIVATE_CALL (g_get_worker_context) ()); + } + + if (cancellable != NULL) + { ++ GWeakRef *weak_task = g_new0 (GWeakRef, 1); ++ g_weak_ref_set (weak_task, task); ++ + data->cancellable_source = g_cancellable_source_new (cancellable); + g_source_set_static_name (data->cancellable_source, "[gio] threaded resolver cancellable"); +- g_source_set_callback (data->cancellable_source, G_SOURCE_FUNC (cancelled_cb), task, NULL); ++ g_source_set_callback (data->cancellable_source, G_SOURCE_FUNC (cancelled_cb), g_steal_pointer (&weak_task), (GDestroyNotify) weak_ref_clear_and_free); + g_source_attach (data->cancellable_source, GLIB_PRIVATE_CALL (g_get_worker_context) ()); + } + diff --git a/glib2/PKGBUILD b/glib2/PKGBUILD index df302cd..cf0a8c2 100644 --- a/glib2/PKGBUILD +++ b/glib2/PKGBUILD @@ -9,7 +9,7 @@ #pkgname=(glib2 glib2-docs) pkgname=glib2 pkgver=2.78.0 -pkgrel=01 +pkgrel=02 pkgdesc="Low level core library" url="https://wiki.gnome.org/Projects/GLib" depends=(pcre2 libffi util-linux-libs zlib) # libsysprof-capture) @@ -22,6 +22,7 @@ _commit=3c543ef69ffab7c78e29eaf383e7fe2c7df6cd49 # tags/2.78.0^0 source=("git+https://gitlab.gnome.org/GNOME/glib.git#commit=$_commit" "git+https://gitlab.gnome.org/GNOME/gvdb.git" 0001-glib-compile-schemas-Remove-noisy-deprecation-warnin.patch + 0002-gthreadedresolver-Fix-race-between-source-callbacks-.patch gio-querymodules.hook glib-compile-schemas.hook) @@ -36,6 +37,11 @@ prepare() { # Suppress noise from glib-compile-schemas.hook git apply -3 ../0001-glib-compile-schemas-Remove-noisy-deprecation-warnin.patch + # Fix NetworkManager crashes + # https://bugs.archlinux.org/task/79658 + # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3575 + git apply -3 ../0002-gthreadedresolver-Fix-race-between-source-callbacks-.patch + git submodule init git submodule set-url subprojects/gvdb "$srcdir/gvdb" git -c protocol.file.allow=always submodule update @@ -111,7 +117,8 @@ validpgpkeys=('923B7025EE03C1C59F42684CF0942E894B2EAFA0') # Philip Withnall (htt sha256sums=(SKIP SKIP 7f8ee5db60987f0d0feba84643e1cf988c98a294a681fb8d4fce1a5b2c25d1d3 # 0001-glib-compile-schemas-Remove-noisy-deprecation-warnin.patch + d790be86bb8eeb144afd5b8c5110eaf91bdeb205163317c06fdd472938b4ec7d # 0002-gthreadedresolver-Fix-race-between-source-callbacks-.patch 557c88177f011ced17bdeac1af3f882b2ca33b386a866fdf900b35f927a2bbe8 # gio-querymodules.hook 64ae5597dda3cc160fc74be038dbe6267d41b525c0c35da9125fbf0de27f9b25) # glib-compile-schemas.hook -## 916d46f2ebb41da8f3937d4c15d66aa9c322f12372e2e5ecc15f82443a951b05 glib2-2.78.0-01-x86_64.pkg.tar.lz +## 606bdcc63ef0466783903412d7e2e2cedd5c212650a25aef68109a4fc6ae30af glib2-2.78.0-02-x86_64.pkg.tar.lz diff --git a/glib2/PKGBUILD-arch b/glib2/PKGBUILD-arch index f457e43..c6f0822 100644 --- a/glib2/PKGBUILD-arch +++ b/glib2/PKGBUILD-arch @@ -7,7 +7,7 @@ pkgname=( glib2-docs ) pkgver=2.78.0 -pkgrel=1 +pkgrel=2 pkgdesc="Low level core library" url="https://wiki.gnome.org/Projects/GLib" license=(LGPL) @@ -43,12 +43,14 @@ source=( "git+https://gitlab.gnome.org/GNOME/glib.git#commit=$_commit" "git+https://gitlab.gnome.org/GNOME/gvdb.git" 0001-glib-compile-schemas-Remove-noisy-deprecation-warnin.patch + 0002-gthreadedresolver-Fix-race-between-source-callbacks-.patch gio-querymodules.hook glib-compile-schemas.hook ) b2sums=('SKIP' 'SKIP' '94c73ca7070c239494873dd52d6ee09382bbb5b1201f7afd737cfa140b1a2fb0744b2c2831baf3943d1d072550c35888d21ce6f19f89481ff9d1a60d9a0b30e0' + 'ffa7a0f8d9dc09864a6a8083b20f634788e5929cd678f7c38ce65be7cdfdea50d0be3cf3a7e6b9a2641f21a085b90b7ac33a2a81ae62a8963992aa9eb7699f57' '14c9211c0557f6d8d9a914f1b18b7e0e23f79f4abde117cb03ab119b95bf9fa9d7a712aa0a29beb266468aeb352caa3a9e4540503cfc9fe0bbaf764371832a96' 'd30d349b4cb4407839d9074ce08f5259b8a5f3ca46769aabc621f17d15effdb89c4bf19bd23603f6df3d59f8d1adaded0f4bacd0333afcab782f2d048c882858') @@ -64,6 +66,11 @@ prepare() { # Suppress noise from glib-compile-schemas.hook git apply -3 ../0001-glib-compile-schemas-Remove-noisy-deprecation-warnin.patch + # Fix NetworkManager crashes + # https://bugs.archlinux.org/task/79658 + # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3575 + git apply -3 ../0002-gthreadedresolver-Fix-race-between-source-callbacks-.patch + git submodule init git submodule set-url subprojects/gvdb "$srcdir/gvdb" git -c protocol.file.allow=always submodule update diff --git a/libarchive/PKGBUILD b/libarchive/PKGBUILD index 138c3c9..221c6e5 100644 --- a/libarchive/PKGBUILD +++ b/libarchive/PKGBUILD @@ -6,7 +6,7 @@ #-----------------------------------------| DESCRIPTION |--------------------------------------- pkgname=libarchive -pkgver=3.7.1 +pkgver=3.7.2 pkgrel=01 pkgdesc='Multi-format archive and compression library' url='https://libarchive.org/' @@ -56,7 +56,8 @@ license=('BSD') validpgpkeys=(A5A45B12AD92D964B89EEE2DEC560C81CEC2276E # Martin Matuska DB2C7CF1B4C265FAEF56E3FC5848A18B8F14184B) # Martin Matuska -sha256sums=(b17403ce670ff18d8e06fea05a9ea9accf70678c88f1b9392a2e29b51127895f # libarchive-3.7.1.tar.xz - 9f39af2efa0435466846ab21bc39564589287fceb5dfe9697fd2c6c51db916a2) # libarchive-3.7.1.tar.xz.asc +sha256sums=(04357661e6717b6941682cde02ad741ae4819c67a260593dfb2431861b251acb # libarchive-3.7.2.tar.xz + 2c2b98622c2f3e59608118fae3e412c900100ec1bf9f825775930b3a8b4f5635) # libarchive-3.7.2.tar.xz.asc + +## d46a5e77ba94d7aef18ccfaffbffb835c00195f205167e1333e931a420f84273 libarchive-3.7.2-01-x86_64.pkg.tar.lz -## bd722a148cfa5929c47b32497b22c96f552aa9ff38a1ae8168c3f2860effc2b2 libarchive-3.7.1-01-x86_64.pkg.tar.lz diff --git a/libarchive/PKGBUILD-arch b/libarchive/PKGBUILD-arch index 6b030f2..9aaba7a 100644 --- a/libarchive/PKGBUILD-arch +++ b/libarchive/PKGBUILD-arch @@ -2,7 +2,7 @@ # Maintainer: Dan McGee pkgname=libarchive -pkgver=3.7.1 +pkgver=3.7.2 pkgrel=1 pkgdesc='Multi-format archive and compression library' arch=('x86_64') @@ -14,7 +14,7 @@ provides=('libarchive.so') validpgpkeys=('A5A45B12AD92D964B89EEE2DEC560C81CEC2276E' # Martin Matuska 'DB2C7CF1B4C265FAEF56E3FC5848A18B8F14184B') # Martin Matuska source=("https://github.com/${pkgname}/${pkgname}/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.xz"{,.asc}) -sha256sums=('b17403ce670ff18d8e06fea05a9ea9accf70678c88f1b9392a2e29b51127895f' +sha256sums=('04357661e6717b6941682cde02ad741ae4819c67a260593dfb2431861b251acb' 'SKIP') build() { diff --git a/libarchive/deps b/libarchive/deps index b28b04f..139597f 100644 --- a/libarchive/deps +++ b/libarchive/deps @@ -1,3 +1,2 @@ -