Bug#1021043: linphone-desktop: linphone crashes and is unusable

[Daniel Kahn Gillmor]

Package: linphone-desktop
Version: 4.3.2-2
Severity: grave
Justification: renders package unusable
X-Debbugs-Cc: d...@fifthhorseman.net

I've used linphone for years. Recently (i think with the upgrade to
4.3.2-2) it no longer works for me, crashing with a range of errors.

Working with my longstanding configuration, i see the following on stderr:


0 dkg@alice:~$ linphone
[17:53:37:555][0x562cdf49f5f0][Info]"Starting Linphone (bin: linphone)"
[17:53:37:555][0x562cdf49f5f0][Info]"Use locale: en_US"
[17:53:37:610][0x562cdf49f5f0][Info]Available fonts : ([REDACTED FOR LENGTH])
[17:53:37:611][0x562cdf49f5f0][Info]"Running app..."
[17:53:37:660][0x562cdf49f5f0][Info]"Activated selectors:" ("custom", "en_US", "unix", "linux", "debian")
[17:53:37:661][0x562cdf49f5f0][Info]"Registering types..."
[17:53:37:662][0x562cdf49f5f0][Info]"Registering shared types..."
[17:53:37:662][0x562cdf49f5f0][Info]"Registering tool types..."
[17:53:37:662][0x562cdf49f5f0][Info]"Registering shared tool types..."
[17:53:37:804][0x562cdf49f5f0][Info]"Loading main view..."
[17:53:37:928][0x562cdf49f5f0][Info]"Launch async core creation."
[17:53:38:078][0x562cdf49f5f0][Info]Core is starting "Starting up"
[17:53:38:123][0x562cdf49f5f0][Info]Core is running "On"
[17:53:38:123][0x562cdf49f5f0][Info]"Set `Friends` path: `/home/dkg/.local/share/linphone/friends.db`"
[17:53:38:138][0x562cdf49f5f0][Info]"Set `CallLogs` path: `/home/dkg/.local/share/linphone/call-history.db`"
[17:53:38:144][0x562cdf49f5f0][Info]Using ZrtpSecrets path : "/home/dkg/.local/share/linphone/zidcache"
[17:53:38:144][0x562cdf49f5f0][Info]Using UserCertificate path : "/home/dkg/.local/share/linphone/usr-crt/"
[17:53:38:144][0x562cdf49f5f0][Info]Using RootCa path : "/usr/share/linphone/rootca.pem"
[17:53:38:145][0x562cdf49f5f0][Info]"Start iterate"
[17:53:38:181][0x562cdf49f5f0][Info]Sip addresses model from Chats : 34 ms.
[17:53:38:192][0x562cdf49f5f0][Info]Sip addresses model from Calls : 10 ms.
[17:53:38:192][0x562cdf49f5f0][Info]Sip addresses model from Refs : 0 ms.
[17:53:38:193][0x562cdf49f5f0][Info]Sip addresses model from Contacts : 0 ms.
[17:53:38:193][0x562cdf49f5f0][Info]Sip addresses model initialized in: 45 ms.
[17:53:38:242][0x562cdf49f5f0][Info]"Notify event count: 0."
[17:53:38:242][0x562cdf49f5f0][Info]"CoreManager initialized"
[17:53:38:471][0x562cdf49f5f0][Info]"Open Linphone app."
[17:53:38:471][0x562cdf49f5f0][Info]"Creating subwindow: `qrc:/ui/views/App/Calls/CallsWindow.qml`."
[17:53:38:534][0x562cdf49f5f0][Info]"Subwindow status: `1`."
[17:53:38:574][0x562cdf49f5f0][Info]"Creating subwindow: `qrc:/ui/views/App/Settings/SettingsWindow.qml`."
[17:53:38:641][0x562cdf49f5f0][Info]"Subwindow status: `1`."
[17:53:39:708][0x562cdf49f5f0][Info]"Notify event count: 0."
terminate called after throwing an instance of 'std::logic_error'
what(): basic_string: construction from null is not valid
Aborted
134 dkg@alice:~$


I decided that maybe there was something wrong with my configuration,
so i moved ~/.config/linphone, ~/.linphonerc, and
~/.local/share/linphone out of the way to start fresh.

When i did that, and restarted linphone, i got the following error:

0 dkg@alice:~$ linphone
2022-09-30 18:31:09:410 bctbx-error-bctbx_file_open: Error open No such file or directory
[18:31:09:422][0x564abb71f5f0][Info]"Starting Linphone (bin: linphone)"
[18:31:09:422][0x564abb71f5f0][Info]"Use locale: en_US"
[18:31:09:466][0x564abb71f5f0][Info]Available fonts : ([REDACTED FOR LENGTH])
[18:31:09:467][0x564abb71f5f0][Info]"Running app..."
[18:31:09:500][0x564abb71f5f0][Info]"Activated selectors:" ("custom", "en_US", "unix", "linux", "debian")
[18:31:09:500][0x564abb71f5f0][Info]"Registering types..."
[18:31:09:501][0x564abb71f5f0][Info]"Registering shared types..."
[18:31:09:501][0x564abb71f5f0][Info]"Registering tool types..."
[18:31:09:501][0x564abb71f5f0][Info]"Registering shared tool types..."
[18:31:09:595][0x564abb71f5f0][Info]"Loading main view..."
[18:31:09:698][0x564abb71f5f0][Info]"Launch async core creation."
[18:31:09:804][0x564abb71f5f0][Info]Core is starting "Starting up"
[18:31:09:853][0x564abb71f5f0][Info]Core is running "On"
[18:31:09:854][0x564abb71f5f0][Info]"Set `Friends` path: `/home/dkg/.local/share/linphone/friends.db`"
[18:31:09:871][0x564abb71f5f0][Info]"Set `CallLogs` path: `/home/dkg/.local/share/linphone/call-history.db`"
free(): invalid pointer
Aborted
134 dkg@alice:~$

Running it a second time i get:

0 dkg@alice:~$ linphone
[18:32:24:342][0x55e23f1ba5f0][Info]"Starting Linphone (bin: linphone)"
[18:32:24:342][0x55e23f1ba5f0][Info]"Use locale: en_US"
[18:32:24:383][0x55e23f1ba5f0][Info]Available fonts : ([READACTED FOR LENGTH])
[18:32:24:383][0x55e23f1ba5f0][Info]"Running app..."
[18:32:24:415][0x55e23f1ba5f0][Info]"Activated selectors:" ("custom", "en_US", "unix", "linux", "debian")
[18:32:24:415][0x55e23f1ba5f0][Info]"Registering types..."
[18:32:24:415][0x55e23f1ba5f0][Info]"Registering shared types..."
[18:32:24:415][0x55e23f1ba5f0][Info]"Registering tool types..."
[18:32:24:415][0x55e23f1ba5f0][Info]"Registering shared tool types..."
[18:32:24:505][0x55e23f1ba5f0][Info]"Loading main view..."
[18:32:24:604][0x55e23f1ba5f0][Info]"Launch async core creation."
[18:32:24:708][0x55e23f1ba5f0][Info]Core is starting "Starting up"
Fatal glibc error: malloc assertion failure in _int_malloc: (unsigned long) (size) >= (unsigned long) (nb)
Aborted
134 dkg@alice:~$

and a third time yields the same log sequence but with this error instead of the "Fatal glibc error":

free(): invalid pointer

running it repeatedly seems to randomly yield either the "Fatal glibc error" or the "free(): invalid pointer"

when i install the matching linphone-desktop-dbgsym package, and i try restarting, i get the following backtrace (for "invalid pointer"):

(gdb) bt
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1 0x00007ffff48895df in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2 0x00007ffff483da02 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3 0x00007ffff4828469 in __GI_abort () at ./stdlib/abort.c:79
#4 0x00007ffff487d888 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff49b66fb "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#5 0x00007ffff48931ea in malloc_printerr (str=str@entry=0x7ffff49b41d0 "free(): invalid pointer") at ./malloc/malloc.c:5659
#6 0x00007ffff4894d2c in _int_free (av=<optimized out>, p=<optimized out>, have_lock=have_lock@entry=0) at ./malloc/malloc.c:4434
#7 0x00007ffff489789f in __GI___libc_free (mem=<optimized out>) at ./malloc/malloc.c:3386
#8 0x00007ffff4b47aa2 in sqlite3_free () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#9 0x00007ffff4b43548 in sqlite3LeaveMutexAndCloseZombie () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#10 0x00007ffff4b448fa in () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#11 0x00007ffff7b27155 in linphone_core_call_log_storage_close () at /lib/x86_64-linux-gnu/liblinphone.so.10
#12 0x00007ffff7b402d0 in linphone_core_set_call_logs_database_path () at /lib/x86_64-linux-gnu/liblinphone.so.10
#13 0x00005555556f84ea in CoreManager::setDatabasesPaths() (this=0x555556269aa0) at ./linphone-app/src/components/core/CoreManager.cpp:199
#14 0x00005555556fab9c in CoreManager::createLinphoneCore(QString const&) (this=0x555556269aa0, configPath=<optimized out>) at ./linphone-app/src/components/core/CoreManager.cpp:269
#15 0x00007ffff52ec852 in () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#16 0x00007ffff52dd0bd in QObject::event(QEvent*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#17 0x00007ffff6162f4e in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt5Widgets.so.5
#18 0x00007ffff52b1618 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#19 0x00007ffff53085c1 in QTimerInfoList::activateTimers() () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#20 0x00007ffff5308e54 in () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#21 0x00007ffff13da729 in g_main_dispatch (context=0x7fffe0005010) at ../../../glib/gmain.c:3444
#22 g_main_context_dispatch (context=context@entry=0x7fffe0005010) at ../../../glib/gmain.c:4162
#23 0x00007ffff13da9b8 in g_main_context_iterate (context=context@entry=0x7fffe0005010, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4238
#24 0x00007ffff13daa4c in g_main_context_iteration (context=0x7fffe0005010, may_block=1) at ../../../glib/gmain.c:4303
#25 0x00007ffff53091c6 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#26 0x00007ffff52b009b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#27 0x00007ffff52b8206 in QCoreApplication::exec() () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#28 0x000055555562d23d in main(int, char**) (argc=<optimized out>, argv=<optimized out>) at ./linphone-app/src/app/main.cpp:48
(gdb)

Or this backtrace (for "Fatal glibc error"):

#0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1 0x00007ffff48895df in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2 0x00007ffff483da02 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3 0x00007ffff4828469 in __GI_abort () at ./stdlib/abort.c:79
#4 0x00007ffff487d888 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff49b8d88 "Fatal glibc error: malloc assertion failure in %s: %s\n") at ../sysdeps/posix/libc_fatal.c:155
#5 0x00007ffff4896b73 in __malloc_assert (function=<synthetic pointer>, line=4297, file=<synthetic pointer>, assertion=0x7ffff49b9928 "(unsigned long) (size) >= (unsigned long) (nb)") at ./malloc/malloc.c:299
#6 _int_malloc (av=av@entry=0x7ffff49f4c60 <main_arena>, bytes=bytes@entry=96) at ./malloc/malloc.c:4297
#7 0x00007ffff4897315 in __GI___libc_malloc (bytes=96) at ./malloc/malloc.c:3324
#8 0x00007ffff4b48264 in () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#9 0x00007ffff4b47860 in sqlite3Malloc () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#10 0x00007ffff4b47e51 in () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#11 0x00007ffff4b47ec9 in sqlite3DbMallocZero () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#12 0x00007ffff4aeb033 in sqlite3FindFunction () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#13 0x00007ffff4b44ab5 in sqlite3CreateFunc () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#14 0x00007ffff4b44d4d in () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#15 0x00007ffff4b44e29 in sqlite3_create_function_v2 () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#16 0x00007ffff4b44eb8 in sqlite3_overload_function () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#17 0x00007ffff4b01fb1 in sqlite3Fts3Init () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#18 0x00007ffff4b46d60 in () at /lib/x86_64-linux-gnu/libsqlite3.so.0
#19 0x00007fffe660f89f in () at /lib/x86_64-linux-gnu/libsoci_sqlite3.so.4.0
#20 0x00007fffe660eba1 in () at /lib/x86_64-linux-gnu/libsoci_sqlite3.so.4.0
#21 0x00007ffff6cd8937 in soci::session::open(soci::connection_parameters const&) () at /lib/x86_64-linux-gnu/libsoci_core.so.4.0
#22 0x00007ffff6cda67f in soci::session::session(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) () at /lib/x86_64-linux-gnu/libsoci_core.so.4.0
#23 0x00007ffff7b0ca92 in LinphonePrivate::DbSession::DbSession(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) () at /lib/x86_64-linux-gnu/liblinphone.so.10
#24 0x00007ffff79899d3 in LinphonePrivate::AbstractDb::connect(LinphonePrivate::AbstractDb::Backend, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ()
at /lib/x86_64-linux-gnu/liblinphone.so.10
#25 0x00007ffff79800ec in LinphonePrivate::CorePrivate::init() () at /lib/x86_64-linux-gnu/liblinphone.so.10
#26 0x00007ffff7b4d73c in linphone_core_start () at /lib/x86_64-linux-gnu/liblinphone.so.10
#27 0x00005555556fab94 in CoreManager::createLinphoneCore(QString const&) (this=0x5555562547b0, configPath=<optimized out>) at /usr/include/c++/12/bits/shared_ptr_base.h:1665
#28 0x00007ffff52ec852 in () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#29 0x00007ffff52dd0bd in QObject::event(QEvent*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#30 0x00007ffff6162f4e in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt5Widgets.so.5
#31 0x00007ffff52b1618 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#32 0x00007ffff53085c1 in QTimerInfoList::activateTimers() () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#33 0x00007ffff5308e54 in () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#34 0x00007ffff13da729 in g_main_dispatch (context=0x7fffe0005010) at ../../../glib/gmain.c:3444
#35 g_main_context_dispatch (context=context@entry=0x7fffe0005010) at ../../../glib/gmain.c:4162
#36 0x00007ffff13da9b8 in g_main_context_iterate (context=context@entry=0x7fffe0005010, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4238
#37 0x00007ffff13daa4c in g_main_context_iteration (context=0x7fffe0005010, may_block=1) at ../../../glib/gmain.c:4303
#38 0x00007ffff53091c6 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#39 0x00007ffff52b009b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#40 0x00007ffff52b8206 in QCoreApplication::exec() () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#41 0x000055555562d23d in main(int, char**) (argc=<optimized out>, argv=<optimized out>) at ./linphone-app/src/app/main.cpp:48


Please let me know if you'd like me to supply any additional debugging information.

--dkg


-- System Information:
Debian Release: bookworm/sid
APT prefers testing-debug
APT policy: (500, 'testing-debug'), (500, 'testing'), (200, 'unstable-debug'), (200, 'unstable'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.19.0-1-amd64 (SMP w/4 CPU threads; PREEMPT)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages linphone-desktop depends on:
ii libbctoolbox1 5.0.37-3
ii libbelcard1 5.0.37-2
ii libc6 2.35-1
ii libgcc-s1 12.2.0-3
ii liblinphone++10 5.0.37-5
ii liblinphone10 5.0.37-5
ii libmediastreamer11 1:5.0.37+dfsg-4
ii libqt5core5a 5.15.4+dfsg-5
ii libqt5dbus5 5.15.4+dfsg-5
ii libqt5gui5 5.15.4+dfsg-5
ii libqt5network5 5.15.4+dfsg-5
ii libqt5qml5 [qtdeclarative-abi-5-15-4] 5.15.4+dfsg-4
ii libqt5quick5 5.15.4+dfsg-4
ii libqt5quickcontrols2-5 5.15.4+dfsg-2
ii libqt5svg5 5.15.4-2
ii libqt5texttospeech5 5.15.4-2
ii libqt5widgets5 5.15.4+dfsg-5
ii libstdc++6 12.2.0-3
ii linphone-common 5.0.37-5
ii qml-module-qt-labs-platform 5.15.4+dfsg-2
ii qml-module-qtgraphicaleffects 5.15.4-2
ii qml-module-qtquick-controls 5.15.4-2
ii qml-module-qtquick-controls2 5.15.4+dfsg-2
ii qml-module-qtquick-dialogs 5.15.4-2
ii qml-module-qtquick-layouts 5.15.4+dfsg-4
ii qml-module-qtquick-shapes 5.15.4+dfsg-4
ii qml-module-qtquick-window2 5.15.4+dfsg-4
ii qml-module-qtquick2 5.15.4+dfsg-4

Versions of packages linphone-desktop recommends:
pn qt5-gtk2-platformtheme <none>

linphone-desktop suggests no packages.

-- no debconf information

[Dennis Filder]

Control: tags -1 + confirmed
X-Debbugs-Cc: Daniel Kahn Gillmor <d...@fifthhorseman.net>

On Fri, Sep 30, 2022 at 06:56:04PM -0400, Daniel Kahn Gillmor wrote:

> I've used linphone for years. Recently (i think with the upgrade to
> 4.3.2-2) it no longer works for me, crashing with a range of errors.

It would help a lot to know the exact time when those crashes started.
Can you try narrowing it down, e.g. by looking at the ctime of
files/directories you created in reaction to the crashes? I also saw
one segfault that was not handled by __GI_abort() -- maybe you had
one, too, so it might show up as a message in /var/log/message*
somewhere. Also, do you have the impression that the crashes suddenly
became more frequent somehow? If so: When? What is the output of?:

stat /usr/share/doc/linphone-desktop/changelog.Debian.gz

> Working with my longstanding configuration, i see the following on stderr:
>

> [...]

>
> Please let me know if you'd like me to supply any additional debugging information.

I could reproduce all of those messages and stack traces with varying
frequencies except the first one. Can you try if downgrading
libsoci-core4.0 and libsoci-sqlite3-4.0 to 4.0.1-5 from bullseye stops
the crashes or at least makes them less frequent for you? I have not
been able to reproduce any crashes with those versions, neither with a
fresh profile nor with my own. soci had an upgrade to 4.0.3-1 which
entered unstable on 2022-09-25 and testing on 2022-09-27. If you are
certain that you observed crashes before those dates the cause might
lie elsewhere, or there might be multiple issues at play.

My current suspicion is that soci 4.0.3-1 had an ABI break from
upstream commit 1b1b5621f5abc40bd76a54a779455e8b9c0892ff (adding the
private backendRef_ member changed the layouts of the classes
soci::connection_parameters and soci::session and liblinphone.so.10
instantiates the latter).

Regards.

[Dennis Filder]

Control: reassign -1 linphone 5.0.37-5
Control: retitle -1 linphone: std::logic_error in src/account/account.cpp:LinphonePrivate::Account::notifyPublishStateChanged()

X-Debbugs-Cc: Daniel Kahn Gillmor <d...@fifthhorseman.net>

On Sat, Oct 01, 2022 at 03:15:10PM -0400, Daniel Kahn Gillmor wrote:

> However, after restoring my configuration, and trying to place a single
> call (to myself, which of course i didn't expect to work) the app
> crashed again.
>
> now, even with libsoci* from bullseye, it is crashing again at startup,
> with this stderr log and backtrace:
>
> ...
> #9 0x00007ffff7868d34 in LinphonePrivate::Account::notifyPublishStateChanged(_LinphonePublishState) () at /lib/x86_64-linux-gnu/liblinphone.so.10
> ...

Yeah, this is a different issue. Upstream commit
a6ca93ec62b66dfcc0fe41783beeab4a471c95dc looks like it fixed this.
I'll look into preparing an update. That should then also take care
of the soci breakage.

Regards.

[Bernhard Schmidt]

Hi,

I think this Bug can be downgraded and/or closed.

We've rebuilt both dependencies in Debian (liblime and linphone). Since
soci is not using shlibs the generated dependency is on the 4.0.3 anyway.

I don't see a way to fix this without breaking lime/linphone again.

Bernhard