Ubuntu
hal package

HAL crashes from QueryCapability DBUS method.

Bug #30198 reported by Scott Robinson on 2006-01-31

Affects		Status	Importance	Assigned to	Milestone
	hal (Ubuntu)	Fix Released	High	Martin Pitt

Bug Description

A user can construct a script to crash HAL anytime it emits a device addition or removal signal.

The script calls back to HAL requesting further information while it's already in a signal.

Revision history for this message

Scott Robinson (scott-ubuntu) wrote on 2006-01-31: Example crasher script.

Example crasher script. Edit (1.5 KiB, text/x-python)

Look at the header of this script for how it works. But, put simply:

1. Run it.
2. Insert or remove something hotpluggable.
3. Marvel as HAL dies.

Revision history for this message

Scott Robinson (scott-ubuntu) wrote on 2006-01-31: Re: HAL crashes from nested dbus callbacks.

This crash occurs in dapper, hal version 0.5.6-1ubuntu1.

Revision history for this message

Scott Robinson (scott-ubuntu) wrote on 2006-02-01: hald crash output.

hald crash output. Edit (1.2 KiB, text/plain)

The debugging output from hald when the crash occurs.

Revision history for this message

Scott Robinson (scott-ubuntu) wrote on 2006-02-01: Re: HAL crashes from nested dbus callbacks.

The bug is in hald/hald_dbus.c:device_query_capability. Specifically, lines 1576-1589. The code is treating the property "info.capabilities" as a string that needs to be parsed.

However, it's actually a strlist. Thus, an assertion occurs when the hal_device_property_get_string is attempted.

It seems likely this code is stale...

Revision history for this message

Scott Robinson (scott-ubuntu) wrote on 2006-02-01: Bug fix patch.

Bug fix patch. Edit (863 bytes, text/plain)

Fixed in upstream CVS, but no new version has been released. The upstream bugfix is a pretty ugly duplication of code.

The attached patch is much cleaner. Drop it in debian/patches.

Revision history for this message

Tormod Volden (tormodvolden) wrote on 2006-02-06: Re: HAL crashes from nested dbus callbacks.

hald died for me when I un/replugged a USB mouse. Thought this could be related.

Your script does crash my hald - as if I needed a script for that :) Nice-looking patch AFAICS.

Changed in hal:
status:	Unconfirmed → Confirmed

Matthew Garrett (mjg59) on 2006-02-06

Changed in hal:
assignee:	nobody → pitti

Revision history for this message

Scott Robinson (scott-ubuntu) wrote on 2006-02-06: Re: [Bug 30198] HAL crashes from QueryCapability DBUS method.

On Mon, Feb 06, 2006 at 07:11:51PM -0000, Matthew Garrett wrote:
> Public bug report changed:
> https://launchpad.net/malone/bugs/30198
>
> Task: ubuntu hal
> Severity: Normal => Major
> Assignee: (unassigned) => Martin Pitt

Sorry about subscribing you. I saw the Hal update and noticed you
were distinctly different than the person notifications were going
toward...

I figured the active maintainer would probably be the best bet.

Scott.

--
http://quadhome.com/ - Personal webpage

Revision history for this message

Martin Pitt (pitti) wrote on 2006-02-08:

hal (0.5.6-1ubuntu3) dapper; urgency=low
.
   * Add debian/patches/dbus-query-capability.patch:
     - Use hal_device_has_capability() instead of broken "info.capabilities"
       parsing.
     - Malone #30198, thanks to Scott Robinson for the patch.