Crash in _clutter_input_device_reset_scroll_info

[chennin]

Distribution

Arch

Package version

5.8.4

Graphics hardware in use

Nvidia 1070 Ti

Frequency

Only occasionally

Bug description

I built a new system. Twice (so far), Cinnamon has crashed shortly after login. It's not reliable, but both times were shortly after login, as I was moving the mouse towards the panel.

System log:

Nov 13 15:49:44 dejarik kernel: cinnamon[850]: segfault at e0 ip 00007f8f74aaa3e4 sp 00007fff45020808 error 4 in libmuffin-clutter-0.so.0.0.0[7f8f74a68000+9b000] likely on CPU 7 (core 7, socket 0)
Nov 13 15:49:44 dejarik kernel: Code: 4c 89 70 10 eb ac 48 8d 15 49 a8 06 00 48 8d 35 f2 be 06 00 48 8d 3d 40 8c 05 00 ff 15 75 b4 0a 00 eb be 0f 1f 00 f3 0f 1e fa <48> 8b 87 e0 00 00 00 48 85 c0 74 25 8b 50 08 85 d2 74 1e 48 8b 00

Possibly related comment: #640 (comment)

Can't tell if related top level: #640

Backtrace:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  _clutter_input_device_reset_scroll_info (device=device@entry=0x0) at ../muffin-5.8.1/clutter/clutter/clutter-input-device.c:1914
Downloading source file /usr/src/debug/muffin/build/../muffin-5.8.1/clutter/clutter/clutter-input-device.c
1914	  if (device->scroll_info == NULL)
[Current thread is 1 (Thread 0x7f8f6fc9efc0 (LWP 850))]
(gdb) bt
#0  _clutter_input_device_reset_scroll_info (device=device@entry=0x0) at ../muffin-5.8.1/clutter/clutter/clutter-input-device.c:1914
#1  0x00007f8f747f7c4c in meta_seat_x11_translate_event (event=0x55ff3dfcbb50, xevent=<optimized out>, seat=<optimized out>)
    at ../muffin-5.8.1/src/backends/x11/meta-seat-x11.c:2310
#2  meta_clutter_backend_x11_translate_event (backend=<optimized out>, native=<optimized out>, event=0x55ff3dfcbb50)
    at ../muffin-5.8.1/src/backends/x11/meta-clutter-backend-x11.c:98
#3  0x00007f8f7487564b in meta_x11_handle_event.isra.0 (xevent=xevent@entry=0x7fff450209e0) at ../muffin-5.8.1/src/backends/x11/meta-event-x11.c:106
#4  0x00007f8f747f62f2 in handle_host_xevent (event=0x7fff450209e0, backend=0x55ff3d5b2410) at ../muffin-5.8.1/src/backends/x11/meta-backend-x11.c:426
#5  x_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at ../muffin-5.8.1/src/backends/x11/meta-backend-x11.c:479
#6  0x00007f8f74bb2f69 in g_main_dispatch (context=0x55ff3d5af940) at ../glib/glib/gmain.c:3476
#7  0x00007f8f74c11327 in g_main_context_dispatch_unlocked (context=0x55ff3d5af940) at ../glib/glib/gmain.c:4284
#8  g_main_context_iterate_unlocked.isra.0 (context=0x55ff3d5af940, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4349
#9  0x00007f8f74bb3b97 in g_main_loop_run (loop=0x55ff3dcb0990) at ../glib/glib/gmain.c:4551
#10 0x00007f8f74830579 in meta_run () at ../muffin-5.8.1/src/core/main.c:663
#11 0x000055ff3bfc0566 in main (argc=<optimized out>, argv=<optimized out>) at ../cinnamon-5.8.4/src/main.c:404

Core (taken by systemd):
core.cinnamon.1000.9304e690fe9047289fccc8681b4c927d.850.1699908584000000.gz

Steps to reproduce

Log in and move the mouse to the panel?

Expected behavior

Additional information

Arch Linux fully updated 2023-11-23
Intel 9700K
Nvidia 1070 Ti
Gigabyte AORUS FV43U Monitor. Plugged in to the monitor:

• Logitech G502 wireless mouse
• Logitech K295 wireless keyboard

Other devices: LG G535 headset (was not turned on - receiver still plugged in). Supersonic SC-1420SB soundbar (not turned on).
Apps set to start on login: Steam, Discord, Solaar
Cinnamon 5.8.4
Muffin 5.8.1

[chennin]

Still getting the crash in muffin 6.0.1-1. I can semi-regularly reproduce it by rebooting and touching nothing until auto-login completes and Steam/Discord finish starting.

• Now on AMD 6700XT GPU
• cinnamon 6.0.4-1
• muffin 6.0.1-1

Core was generated by `cinnamon --replace'.
Program terminated with signal SIGSEGV, Segmentation fault.

warning: Section `.reg-xstate/963' in core file too small.
#0  _clutter_input_device_reset_scroll_info (device=device@entry=0x0)
    at ../muffin-6.0.1/clutter/clutter/clutter-input-device.c:1914
Downloading source file /usr/src/debug/muffin/build/../muffin-6.0.1/clutter/clutter/clutter-input-device.c
1914      if (device->scroll_info == NULL)
[Current thread is 1 (Thread 0x72eddafb6fc0 (LWP 963))]
(gdb) bt
#0  _clutter_input_device_reset_scroll_info (device=device@entry=0x0)
    at ../muffin-6.0.1/clutter/clutter/clutter-input-device.c:1914
#1  0x000072eddfd6040c in meta_seat_x11_translate_event
    (event=0x6174128976a0, xevent=<optimized out>, seat=<optimized out>)
    at ../muffin-6.0.1/src/backends/x11/meta-seat-x11.c:2310
#2  meta_clutter_backend_x11_translate_event (backend=<optimized out>, native=<optimized out>, event=0x6174128976a0)
    at ../muffin-6.0.1/src/backends/x11/meta-clutter-backend-x11.c:98
#3  0x000072eddfe24cbb in meta_x11_handle_event.isra.0 (xevent=xevent@entry=0x7ffe4a73cd60)
    at ../muffin-6.0.1/src/backends/x11/meta-event-x11.c:106
#4  0x000072eddfd5eab2 in handle_host_xevent (event=0x7ffe4a73cd60, backend=0x6174114beae0)
    at ../muffin-6.0.1/src/backends/x11/meta-backend-x11.c:426
#5  x_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>)
    at ../muffin-6.0.1/src/backends/x11/meta-backend-x11.c:479
#6  0x000072ede018df69 in g_main_dispatch (context=0x6174114bba50) at ../glib/glib/gmain.c:3476
#7  0x000072ede01ec367 in g_main_context_dispatch_unlocked (context=0x6174114bba50) at ../glib/glib/gmain.c:4284
#8  g_main_context_iterate_unlocked.isra.0
    (context=0x6174114bba50, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at ../glib/glib/gmain.c:4349
#9  0x000072ede018eb97 in g_main_loop_run (loop=0x6174118f9540) at ../glib/glib/gmain.c:4551
#10 0x000072eddfd9ff61 in meta_run () at ../muffin-6.0.1/src/core/main.c:663
#11 0x0000617410e7d4ad in main (argc=<optimized out>, argv=<optimized out>) at ../cinnamon-6.0.4/src/main.c:398

core.cinnamon.1000.e7294ebb2a37412e9ced8c5eb6303994.963.1705436100000000.gz

[github-actions]

This issue has been automatically marked as stale because it has not had
any activity in over 2 years.

If this issue is still relevant:

• Please test on a current version of this package.
• Add a comment with your findings

If no activity occurs in the next 30 days, this issue will be
automatically closed. Issues can be reopened if needed.

[UweSchneider]

Patch available: NULL guard in _clutter_input_device_reset_scroll_info

This crash is a NULL pointer dereference where device=0x0 is passed to _clutter_input_device_reset_scroll_info. The existing code checks device->scroll_info == NULL but doesn't check if device itself is NULL.

Fix in clutter/clutter/clutter-input-device.c:

 void
 _clutter_input_device_reset_scroll_info (ClutterInputDevice *device)
 {
   guint i;
 
+  if (device == NULL)
+    return;
+
   if (device->scroll_info == NULL)
     return;

We've built this as a proper Debian package via dpkg-buildpackage (muffin 6.6.3) together with fixes for #807 and #769, and it's running stable.