Debian Bug report logs - #508125
xdg-screensaver: Race in suspend/resume can lead to process leak

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Ben Hutchings <ben@decadent.org.uk>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: xdg-screensaver: Race in suspend/resume can lead to process leak

Date: Mon, 08 Dec 2008 05:06:11 +0000

Package: xdg-utils
Version: 1.0.2-6
Severity: normal

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In xdg-screensaver, do_resume() and track_window() both call
cleanup_suspend() to remove the tracking process from the status file.
cleanup_suspend() removes the process using a grep -v for the window
id.  This means there is a race condition after the first removal
where a new tracking process can be created and then removed from the
status file while it's still active.

I think this could be fixed by either (1) looking for the process id
in the status file, not the window id, or (2) removing one of the
calls to cleanup_suspend().

Ben.

- -- System Information:
Debian Release: 5.0
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (100, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

xdg-utils depends on no packages.

Versions of packages xdg-utils recommends:
ii  elinks [www-browser]   0.12~pre2.dfsg0-1 advanced text-mode WWW browser
ii  file                   4.26-1            Determines file type using "magic"
ii  iceweasel [www-browser 3.0.4-1           lightweight web browser based on M
ii  links [www-browser]    2.2-1             Web browser running in text mode
ii  mime-support           3.44-1            MIME files 'mime.types' & 'mailcap
ii  shared-mime-info       0.30-2            FreeDesktop.org shared MIME databa
ii  x11-utils              7.3+2             X11 utilities
ii  x11-xserver-utils      7.3+5             X server utilities

Versions of packages xdg-utils suggests:
ii  desktop-file-utils     0.15-1            Utilities for .desktop files
pn  exo-utils              <none>            (no description available)
ii  kdelibs4c2a            4:3.5.10.dfsg.1-1 core libraries and binaries for al
pn  konqueror              <none>            (no description available)
ii  libgnome2-0            2.20.1.1-2        The GNOME 2 library - runtime file
pn  libgnomevfs2-bin       <none>            (no description available)
ii  libgtk2.0-bin          2.12.11-4         The programs for the GTK+ graphica

- -- no debconf information

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJPKs979ZNCRIGYgcRAvf8AJ9tYQ6oWnC3Fm4iEQEK+PCGCwMhNQCeP4WL
PN0NlqiR7oGu5V8BhOZg4fI=
=OAmV
-----END PGP SIGNATURE-----

Message #10 received at 508125@bugs.debian.org (full text, mbox, reply):

From: Ben Hutchings <ben@decadent.org.uk>

To: 508125@bugs.debian.org

Subject: Re: xdg-screensaver: Race in suspend/resume can lead to process leak

Date: Wed, 24 Dec 2008 23:58:31 +0000

[Message part 1 (text/plain, inline)]

The following simple change fixes this for me.

Ben.

--- xdg-utils-1.0.2.orig/scripts/xdg-screensaver
+++ xdg-utils-1.0.2/scripts/xdg-screensaver
@@ -444,7 +444,7 @@
   lockfile
   test "${TMPDIR+set}" = set || TMPDIR=/tmp
   tmpfile=`mktemp $TMPDIR/tmp.XXXXXXXXXX`
-  grep -v "$window_id:" "$screensaver_file" > "$tmpfile" 2> /dev/null
+  grep -v "$window_id:$xprop_pid\$" "$screensaver_file" > "$tmpfile" 2> /dev/null
   $MV "$tmpfile" "$screensaver_file"
   if [ ! -s "$screensaver_file" ] ; then
       rm "$screensaver_file"
--- END ---

-- 
Ben Hutchings
All the simple programs have been written, and all the good names taken.

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 508125@bugs.debian.org (full text, mbox, reply):

From: Ben Hutchings <ben@decadent.org.uk>

To: debian-release@lists.debian.org

Cc: 374644@bugs.debian.org, 508125@bugs.debian.org, 508126@bugs.debian.org

Subject: Re: xine-ui: ctrl/shift key press emulation implementation broken

Date: Fri, 02 Jan 2009 15:30:01 +0000

[Message part 1 (text/plain, inline)]

I need some guidance on how to deal with the following related bugs:

#374644: xine-ui: ctrl/shift key press emulation implementation broken
#506001: xine-ui: xine causes left ctrl keyup events every 20 seconds
These are the same bug: xine-ui suppresses screensavers by injecting
fake keystrokes, which may be received by other windows.  It also
suppresses gnome-screensaver cleanly, so we could disable the key
injection code without affecting GNOME users.  However, this would be a
regression for users of the X server screensaver, xscreensaver or the
KDE screensaver.

My proposed fix involves using xdg-screensaver, which supports all the
different screensavers.  However, this suffers from the following bugs:
#508125: xdg-screensaver: Race in suspend/resume can lead to process leak
#508126: x11-utils: xprop -spy does not handle destruction properly
I do not think that these are, in themselves, RC.

I have now proposed fixes for all of these, and the result appears to be
robust.  Should I NMU with these fixes?  Should any of these bugs be
down/upgraded?

Ben.

-- 
Ben Hutchings
Lowery's Law:
             If it jams, force it. If it breaks, it needed replacing anyway.

[signature.asc (application/pgp-signature, inline)]

Message #24 received at 508125@bugs.debian.org (full text, mbox, reply):

From: Per Olofsson <pelle@dsv.su.se>

To: Ben Hutchings <ben@decadent.org.uk>, 508125@bugs.debian.org

Cc: debian-release@lists.debian.org, 374644@bugs.debian.org, 508126@bugs.debian.org

Subject: Re: Bug#508125: xine-ui: ctrl/shift key press emulation implementation broken

Date: Fri, 02 Jan 2009 18:17:41 +0100

Hi Ben,

Ben Hutchings wrote:
> I need some guidance on how to deal with the following related bugs:
> 
> #374644: xine-ui: ctrl/shift key press emulation implementation broken
> #506001: xine-ui: xine causes left ctrl keyup events every 20 seconds
> These are the same bug: xine-ui suppresses screensavers by injecting
> fake keystrokes, which may be received by other windows.  It also
> suppresses gnome-screensaver cleanly, so we could disable the key
> injection code without affecting GNOME users.  However, this would be a
> regression for users of the X server screensaver, xscreensaver or the
> KDE screensaver.
> 
> My proposed fix involves using xdg-screensaver, which supports all the
> different screensavers.  However, this suffers from the following bugs:
> #508125: xdg-screensaver: Race in suspend/resume can lead to process leak
> #508126: x11-utils: xprop -spy does not handle destruction properly
> I do not think that these are, in themselves, RC.
>
> I have now proposed fixes for all of these, and the result appears to be
> robust.  Should I NMU with these fixes?  Should any of these bugs be
> down/upgraded?

Feel free to NMU xdg-utils, as the maintainer I have no problems with
that. I would appreciate if you commit directly to the git repository,
which is in collab-maint (but it's not necessary).

Sorry for not responding earlier.

-- 
Pelle

Message #29 received at 508125@bugs.debian.org (full text, mbox, reply):

From: Ben Hutchings <ben@decadent.org.uk>

To: Per Olofsson <pelle@dsv.su.se>

Cc: 508125@bugs.debian.org, debian-release@lists.debian.org

Subject: Re: Bug#508125: xine-ui: ctrl/shift key press emulation implementation broken

Date: Fri, 02 Jan 2009 17:59:11 +0000

[Message part 1 (text/plain, inline)]

On Fri, 2009-01-02 at 18:17 +0100, Per Olofsson wrote:
> Hi Ben,
> 
> Ben Hutchings wrote:
> > I need some guidance on how to deal with the following related bugs:
> > 
> > #374644: xine-ui: ctrl/shift key press emulation implementation broken
> > #506001: xine-ui: xine causes left ctrl keyup events every 20 seconds
> > These are the same bug: xine-ui suppresses screensavers by injecting
> > fake keystrokes, which may be received by other windows.  It also
> > suppresses gnome-screensaver cleanly, so we could disable the key
> > injection code without affecting GNOME users.  However, this would be a
> > regression for users of the X server screensaver, xscreensaver or the
> > KDE screensaver.
> > 
> > My proposed fix involves using xdg-screensaver, which supports all the
> > different screensavers.  However, this suffers from the following bugs:
> > #508125: xdg-screensaver: Race in suspend/resume can lead to process leak
> > #508126: x11-utils: xprop -spy does not handle destruction properly
> > I do not think that these are, in themselves, RC.
> >
> > I have now proposed fixes for all of these, and the result appears to be
> > robust.  Should I NMU with these fixes?  Should any of these bugs be
> > down/upgraded?
> 
> Feel free to NMU xdg-utils, as the maintainer I have no problems with
> that. I would appreciate if you commit directly to the git repository,
> which is in collab-maint (but it's not necessary).

Done, thanks.

> Sorry for not responding earlier.

That's OK, the bug report wasn't obviously urgent.

Ben.

-- 
Ben Hutchings
Lowery's Law:
             If it jams, force it. If it breaks, it needed replacing anyway.

[signature.asc (application/pgp-signature, inline)]

Message #34 received at 508125-close@bugs.debian.org (full text, mbox, reply):

From: Ben Hutchings <ben@decadent.org.uk>

To: 508125-close@bugs.debian.org

Subject: Bug#508125: fixed in xdg-utils 1.0.2-6.1

Date: Fri, 02 Jan 2009 18:02:06 +0000

Source: xdg-utils
Source-Version: 1.0.2-6.1

We believe that the bug you reported is fixed in the latest version of
xdg-utils, which is due to be installed in the Debian FTP archive:

xdg-utils_1.0.2-6.1.diff.gz
  to pool/main/x/xdg-utils/xdg-utils_1.0.2-6.1.diff.gz
xdg-utils_1.0.2-6.1.dsc
  to pool/main/x/xdg-utils/xdg-utils_1.0.2-6.1.dsc
xdg-utils_1.0.2-6.1_all.deb
  to pool/main/x/xdg-utils/xdg-utils_1.0.2-6.1_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 508125@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ben Hutchings <ben@decadent.org.uk> (supplier of updated xdg-utils package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 02 Jan 2009 17:47:19 +0000
Source: xdg-utils
Binary: xdg-utils
Architecture: source all
Version: 1.0.2-6.1
Distribution: unstable
Urgency: low
Maintainer: Per Olofsson <pelle@debian.org>
Changed-By: Ben Hutchings <ben@decadent.org.uk>
Description: 
 xdg-utils  - desktop integration utilities from freedesktop.org
Closes: 508125
Changes: 
 xdg-utils (1.0.2-6.1) unstable; urgency=low
 .
   * Non-maintainer upload.
   * debian/patches/fix-xdg-screensaver-race: Fix race condition which
     leads to process leak. Closes: #508125.
Checksums-Sha1: 
 bc14df7113e233d29d7ba238bc609bdb4c79164d 1141 xdg-utils_1.0.2-6.1.dsc
 41f1ddbae72d9461f37d0221340642703f37e089 5681 xdg-utils_1.0.2-6.1.diff.gz
 19e1506a7c31380bafdedd8b94476cbe01ab8f3b 54326 xdg-utils_1.0.2-6.1_all.deb
Checksums-Sha256: 
 e9c720e6638e4c814845a10dbac75590f9509e22e47f5aca7d729f2dd68e3506 1141 xdg-utils_1.0.2-6.1.dsc
 5149f428e8f4bff15ea82dc208a2101f83c3608b018d8d98d04f89fc2320a216 5681 xdg-utils_1.0.2-6.1.diff.gz
 9ab3a79da00b6c73c3d780afc338f7ae68399a7140a02cd02110f837a5365d5a 54326 xdg-utils_1.0.2-6.1_all.deb
Files: 
 ecdf1002b14b544918b2164463b1c42c 1141 utils optional xdg-utils_1.0.2-6.1.dsc
 4e3096db7f8a11bbfcb813d62be18e01 5681 utils optional xdg-utils_1.0.2-6.1.diff.gz
 2efe2d56491897cfb790e3635df8d8c6 54326 utils optional xdg-utils_1.0.2-6.1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJXlVt79ZNCRIGYgcRAjZzAJ4+wW5f9fMr7vZ2ord27pBat1cbtACg2R7A
WeTR58wHJfQxJLNUbb1LZ0k=
=EcMR
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.