Backport patch to fix possible invalid pointer in dbus callback

... in the FD.o notification backend

https://bugzilla.redhat.com/show_bug.cgi?id=1584916
https://gitlab.gnome.org/GNOME/glib/merge_requests/90
https://gitlab.gnome.org/GNOME/glib/merge_requests/102

0001-gmain-Partial-revert-of-recent-wakeup-changes-to-gma.patch

@@ -0,0 +1,106 @@
+From 94b38beff1347ec4a733199f7a7abdacaa958678 Mon Sep 17 00:00:00 2001
+From: Philip Withnall <withnall@endlessm.com>
+Date: Wed, 17 Jan 2018 11:38:50 +0000
+Subject: [PATCH] gmain: Partial revert of recent wakeup changes to gmain.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts the following commits (but keeps the other recent changes
+to gmain.c):
+ • e4ee3079c Do not wake up main loop if change is from same thread
+ • 208702404 main: Create a helper function for "owner wakeup" optimization
+ • 0c0469b56 gmain: Signal wakeups if context has never been acquired as well
+ • 9ba95e25b gmain: only signal GWakeup right before or during a blocking poll
+
+Some combination of them is causing problems with LibreOffice and/or
+WebKit, and the safest thing to do at the moment is revert them all
+until we work out what’s going on. The previous revert (4976e8109) was
+not sufficient (it fixed WebKit, but re-broken LibreOffice).
+
+By reverting, we gain some spurious wakeups, but avoid dropping
+necessary wakeups, which is presumably what’s causing problems in the
+other modules.
+
+Signed-off-by: Philip Withnall <withnall@endlessm.com>
+
+https://bugzilla.gnome.org/show_bug.cgi?id=761102
+---
+ glib/gmain.c | 33 +++++----------------------------
+ 1 file changed, 5 insertions(+), 28 deletions(-)
+
+diff --git a/glib/gmain.c b/glib/gmain.c
+index 8ca54de3a45b..67102cdf75d0 100644
+--- a/glib/gmain.c
++++ b/glib/gmain.c
+@@ -1118,29 +1118,6 @@ source_remove_from_context (GSource      *source,
+     }
+ }
+ 
+-/* See https://bugzilla.gnome.org/show_bug.cgi?id=761102 for
+- * the introduction of this.
+- *
+- * The main optimization is to avoid waking up the main
+- * context if a change is made by the current owner.
+- */
+-static void
+-conditional_wakeup (GMainContext *context)
+-{
+-  /* We want to signal wakeups in two cases:
+-   *  1 When the context is owned by another thread
+-   *  2 When the context owner is NULL (two subcases)
+-   *   2a Possible if the context has never been acquired
+-   *   2b Or if the context has no current owner
+-   *
+-   * At least case 2a) is necessary to ensure backwards compatibility with
+-   * qemu's use of GMainContext.
+-   * https://bugzilla.gnome.org/show_bug.cgi?id=761102#c14
+-   */
+-  if (context->owner != G_THREAD_SELF)
+-    g_wakeup_signal (context->wakeup);
+-}
+-
+ static guint
+ g_source_attach_unlocked (GSource      *source,
+                           GMainContext *context,
+@@ -1187,8 +1164,8 @@ g_source_attach_unlocked (GSource      *source,
+   /* If another thread has acquired the context, wake it up since it
+    * might be in poll() right now.
+    */
+-  if (do_wakeup)
+-    conditional_wakeup (context);
++  if (do_wakeup && context->owner && context->owner != G_THREAD_SELF)
++    g_wakeup_signal (context->wakeup);
+ 
+   return source->source_id;
+ }
+@@ -1878,7 +1855,7 @@ g_source_set_ready_time (GSource *source,
+     {
+       /* Quite likely that we need to change the timeout on the poll */
+       if (!SOURCE_BLOCKED (source))
+-        conditional_wakeup (context);
++        g_wakeup_signal (context->wakeup);
+       UNLOCK_CONTEXT (context);
+     }
+ }
+@@ -4318,7 +4295,7 @@ g_main_context_add_poll_unlocked (GMainContext *context,
+   context->poll_changed = TRUE;
+ 
+   /* Now wake up the main loop if it is waiting in the poll() */
+-  conditional_wakeup (context);
++  g_wakeup_signal (context->wakeup);
+ }
+ 
+ /**
+@@ -4378,7 +4355,7 @@ g_main_context_remove_poll_unlocked (GMainContext *context,
+   context->poll_changed = TRUE;
+ 
+   /* Now wake up the main loop if it is waiting in the poll() */
+-  conditional_wakeup (context);
++  g_wakeup_signal (context->wakeup);
+ }
+ 
+ /**
+-- 
+2.14.3
+

glib2-gfdonotificationbackend-fix-possible-invalid-pointer.patch

@@ -0,0 +1,136 @@
+From ea795f6a5d898f4f8be2d5bdf896b711155671da Mon Sep 17 00:00:00 2001
+From: Arnaud Rebillout <elboulangero@gmail.com>
+Date: Sun, 10 Jun 2018 20:56:12 +0700
+Subject: [PATCH] gfdonotificationbackend: Fix possible invalid pointer in dbus
+ callback
+
+The way things were before: a FreedesktopNotification struct is
+allocated before the dbus call, and this same struct is possibly re-used
+for other dbus calls. If the server becomes unavailable, the callback
+will be invoked after the call times out, which leaves a long time where
+other dbus calls can happen, re-using the same FreedesktopNotification
+as user data. When the first call times out, the callback is invoked,
+and the user data is freed. Subsequent calls that used the same user
+data will time out later on, and try to free a pointer that was already
+freed, hence segfaults.
+
+This bug can be reproduced in Cinnamon 3.6.7, as mentioned in:
+<https://github.com/linuxmint/Cinnamon/issues/7491>
+
+This commit fixes that by always allocating a new
+FreedesktopNotification before invoking dbus_call(), ensuring that the
+callback always have a valid user data.
+
+Signed-off-by: Arnaud Rebillout <elboulangero@gmail.com>
+---
+ gio/gfdonotificationbackend.c | 55 ++++++++++++++++++++++++++-----------------
+ 1 file changed, 34 insertions(+), 21 deletions(-)
+
+diff --git a/gio/gfdonotificationbackend.c b/gio/gfdonotificationbackend.c
+index a0d4814335be..ab5329497d1e 100644
+--- a/gio/gfdonotificationbackend.c
++++ b/gio/gfdonotificationbackend.c
+@@ -62,7 +62,6 @@ typedef struct
+   GVariant *default_action_target;
+ } FreedesktopNotification;
+ 
+-
+ static void
+ freedesktop_notification_free (gpointer data)
+ {
+@@ -76,6 +75,24 @@ freedesktop_notification_free (gpointer data)
+   g_slice_free (FreedesktopNotification, n);
+ }
+ 
++static FreedesktopNotification *
++freedesktop_notification_new (GFdoNotificationBackend *backend,
++                              const gchar             *id,
++                              GNotification           *notification)
++{
++  FreedesktopNotification *n;
++
++  n = g_slice_new0 (FreedesktopNotification);
++  n->backend = backend;
++  n->id = g_strdup (id);
++  n->notify_id = 0;
++  g_notification_get_default_action (notification,
++                                     &n->default_action,
++                                     &n->default_action_target);
++
++  return n;
++}
++
+ static FreedesktopNotification *
+ g_fdo_notification_backend_find_notification (GFdoNotificationBackend *backend,
+                                               const gchar             *id)
+@@ -319,8 +336,19 @@ notification_sent (GObject      *source_object,
+   val = g_dbus_connection_call_finish (G_DBUS_CONNECTION (source_object), result, &error);
+   if (val)
+     {
++      GFdoNotificationBackend *backend = n->backend;
++      FreedesktopNotification *match;
++
+       g_variant_get (val, "(u)", &n->notify_id);
+       g_variant_unref (val);
++
++      match = g_fdo_notification_backend_find_notification_by_notify_id (backend, n->notify_id);
++      if (match != NULL)
++        {
++          backend->notifications = g_slist_remove (backend->notifications, match);
++          freedesktop_notification_free (match);
++        }
++      backend->notifications = g_slist_prepend (backend->notifications, n);
+     }
+   else
+     {
+@@ -331,9 +359,7 @@ notification_sent (GObject      *source_object,
+           warning_printed = TRUE;
+         }
+ 
+-      n->backend->notifications = g_slist_remove (n->backend->notifications, n);
+       freedesktop_notification_free (n);
+-
+       g_error_free (error);
+     }
+ }
+@@ -378,7 +404,7 @@ g_fdo_notification_backend_send_notification (GNotificationBackend *backend,
+                                               GNotification        *notification)
+ {
+   GFdoNotificationBackend *self = G_FDO_NOTIFICATION_BACKEND (backend);
+-  FreedesktopNotification *n;
++  FreedesktopNotification *n, *tmp;
+ 
+   if (self->notify_subscription == 0)
+     {
+@@ -391,24 +417,11 @@ g_fdo_notification_backend_send_notification (GNotificationBackend *backend,
+                                             notify_signal, backend, NULL);
+     }
+ 
+-  n = g_fdo_notification_backend_find_notification (self, id);
+-  if (n == NULL)
+-    {
+-      n = g_slice_new0 (FreedesktopNotification);
+-      n->backend = self;
+-      n->id = g_strdup (id);
+-      n->notify_id = 0;
+-
+-      n->backend->notifications = g_slist_prepend (n->backend->notifications, n);
+-    }
+-  else
+-    {
+-      /* Only clear default action. All other fields are still valid */
+-      g_clear_pointer (&n->default_action, g_free);
+-      g_clear_pointer (&n->default_action_target, g_variant_unref);
+-    }
++  n = freedesktop_notification_new (self, id, notification);
+ 
+-  g_notification_get_default_action (notification, &n->default_action, &n->default_action_target);
++  tmp = g_fdo_notification_backend_find_notification (self, id);
++  if (tmp)
++    n->notify_id = tmp->notify_id;
+ 
+   call_notify (backend->dbus_connection, backend->application, n->notify_id, notification, notification_sent, n);
+ }
+-- 
+2.14.4
+

glib2.spec

@@ -4,14 +4,23 @@
 %global __python %{__python3}
 
 Name: glib2
-Version: 2.54.2
-Release: 1%{?dist}
+Version: 2.54.3
+Release: 3%{?dist}
 Summary: A library of handy utility functions
 
 License: LGPLv2+
 URL: http://www.gtk.org
 Source0: http://download.gnome.org/sources/glib/2.54/glib-%{version}.tar.xz
 
+# Backported from upstream
+# https://bugzilla.gnome.org/show_bug.cgi?id=761102
+Patch0: 0001-gmain-Partial-revert-of-recent-wakeup-changes-to-gma.patch
+
+# https://gitlab.gnome.org/GNOME/glib/merge_requests/90
+# https://gitlab.gnome.org/GNOME/glib/merge_requests/102
+# https://bugzilla.redhat.com/show_bug.cgi?id=1584916
+Patch1: glib2-gfdonotificationbackend-fix-possible-invalid-pointer.patch
+
 BuildRequires: chrpath
 BuildRequires: gettext
 BuildRequires: perl-interpreter
@@ -231,6 +240,16 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
 %{_datadir}/installed-tests
 
 %changelog
+* Mon Jun 25 2018 Debarshi Ray <rishi@fedoraproject.org> - 2.54.2-3
+- Backport patch to fix possible invalid pointer in dbus callback in the FD.o
+  notification backend (RH #1584916)
+
+* Thu Jan 18 2018 Kalev Lember <klember@redhat.com> - 2.54.3-2
+- gmain: Partial revert of recent wakeup changes
+
+* Tue Jan 09 2018 Kalev Lember <klember@redhat.com> - 2.54.3-1
+- Update to 2.54.3
+
 * Wed Nov 01 2017 Kalev Lember <klember@redhat.com> - 2.54.2-1
 - Update to 2.54.2
 

sources

@@ -1 +1 @@
-SHA512 (glib-2.54.2.tar.xz) = 09ee6fa3a6f3f15af229bd789bef536e3570f36d1e4ce624a57e97c4040577f6baccd6ab5746257863ccf7173b558cfa753951d562a278f854e52604104ba7ee
+SHA512 (glib-2.54.3.tar.xz) = 23eb4458684624f80c17aa784eab42a38eec87bb5979fcfe56f0bc63b5c7bcf8251a0d4ea916fe2c8109ff5b14a4b60c6260755d079ff984c0d8e6a2871d307d