#1088681 gnome-system-monitor: strcpy overflow inside glibtop_get_disk_l()

Package:
libgtop-2.0-11
Source:
libgtop-2.0-11
Description:
gtop system monitoring library (shared)
Submitter:
Konomi
Date:
2025-06-19 15:41:04 UTC
Severity:
normal
#1088681#5
Date:
2024-11-29 13:43:47 UTC
From:
To:
Dear Maintainer,

gnome-system-monitor instantly crashes on my system. coredumpctl shows the
following information:

           PID: 28359 (gnome-system-mo)
           UID: 1000 (debian)
           GID: 1000 (debian)
        Signal: 6 (ABRT)
     Timestamp: Sat 2024-11-30 00:32:48 AEDT (9min ago)
  Command Line: /usr/bin/gnome-system-monitor
    Executable: /usr/bin/gnome-system-monitor
 Control Group: /user.slice/user-1000.slice/user@1000.service/app.slice/app-
gnome-org.gnome.SystemMonitor-28359.scope
          Unit: user@1000.service
     User Unit: app-gnome-org.gnome.SystemMonitor-28359.scope
         Slice: user-1000.slice
     Owner UID: 1000 (debian)
       Boot ID: 170ee9a1bb2b408d96ba6aef005a8210
    Machine ID: REMOVED
      Hostname: debian
       Storage: /var/lib/systemd/coredump/core.gnome-system-
mo.1000.170ee9a1bb2b408d96ba6aef005a8210.28359.1732887168000000.zst (present)
  Size on Disk: 6M
       Message: Process 28359 (gnome-system-mo) of user 1000 dumped core.

                Module libudev.so.1 from deb systemd-257~rc3-1.amd64
                Module libzstd.so.1 from deb libzstd-1.5.6+dfsg-1+b1.amd64
                Module libblkid.so.1 from deb util-linux-2.40.2-11.amd64
                Module libmount.so.1 from deb util-linux-2.40.2-11.amd64
                Module libatomic.so.1 from deb gcc-14-14.2.0-8.amd64
                Module libgcc_s.so.1 from deb gcc-14-14.2.0-8.amd64
                Module libstdc++.so.6 from deb gcc-14-14.2.0-8.amd64
                Module libsystemd.so.0 from deb systemd-257~rc3-1.amd64
                Stack trace of thread 28359:
                #0  0x00007f1d5049dc8c __pthread_kill_implementation (libc.so.6
+ 0x93c8c)
                #1  0x00007f1d50449c42 __GI_raise (libc.so.6 + 0x3fc42)
                #2  0x00007f1d504324f0 __GI_abort (libc.so.6 + 0x284f0)
                #3  0x00007f1d5043332d __libc_message_impl (libc.so.6 +
0x2932d)
                #4  0x00007f1d505262f5 __GI___fortify_fail (libc.so.6 +
0x11c2f5)
                #5  0x00007f1d50525d00 __GI___chk_fail (libc.so.6 + 0x11bd00)
                #6  0x00007f1d50527622 __GI___strcpy_chk (libc.so.6 + 0x11d622)
                #7  0x00007f1d52a93304 n/a (libgtop-2.0.so.11 + 0xa304)
                #8  0x00007f1d52a8f92b glibtop_get_disk_l (libgtop-2.0.so.11 +
0x692b)
                #9  0x000055ca3c4ede9b n/a (/usr/bin/gnome-system-monitor +
0x39e9b)
                #10 0x000055ca3c4ee2b5 _Z22load_graph_update_dataP9LoadGraph
(/usr/bin/gnome-system-monitor + 0x3a2b5)
                #11 0x000055ca3c4e8259 n/a (/usr/bin/gnome-system-monitor +
0x34259)
                #12 0x00007f1d52be48ce n/a (libglib-2.0.so.0 + 0x5d8ce)
                #13 0x00007f1d52be181f n/a (libglib-2.0.so.0 + 0x5a81f)
                #14 0x00007f1d52be3a57 n/a (libglib-2.0.so.0 + 0x5ca57)
                #15 0x00007f1d52be41c0 g_main_context_iteration
(libglib-2.0.so.0 + 0x5d1c0)
                #16 0x00007f1d526f4445 g_application_run (libgio-2.0.so.0 +
0xe9445)
                #17 0x000055ca3c4d5bd8 main (/usr/bin/gnome-system-monitor +
0x21bd8)
                #18 0x00007f1d50433d68 __libc_start_call_main (libc.so.6 +
0x29d68)
                #19 0x00007f1d50433e25 __libc_start_main_impl (libc.so.6 +
0x29e25)
                #20 0x000055ca3c4d6981 _start (/usr/bin/gnome-system-monitor +
0x22981)

                Stack trace of thread 28365:
                #0  0x00007f1d505185b9 syscall (libc.so.6 + 0x10e5b9)
                #1  0x00007f1d52c13c04 g_cond_wait (libglib-2.0.so.0 + 0x8cc04)
                #2  0x00007f1d52bab43b n/a (libglib-2.0.so.0 + 0x2443b)
                #3  0x00007f1d52bab8eb g_async_queue_pop (libglib-2.0.so.0 +
0x248eb)
                #4  0x00007f1d508bcae7 n/a (libpangoft2-1.0.so.0 + 0xdae7)
                #5  0x00007f1d52c142e1 n/a (libglib-2.0.so.0 + 0x8d2e1)
                #6  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #7  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28372:
                #0  0x00007f1d505185b9 syscall (libc.so.6 + 0x10e5b9)
                #1  0x00007f1d52c13c04 g_cond_wait (libglib-2.0.so.0 + 0x8cc04)
                #2  0x00007f1d52bab43b n/a (libglib-2.0.so.0 + 0x2443b)
                #3  0x00007f1d52c14582 n/a (libglib-2.0.so.0 + 0x8d582)
                #4  0x00007f1d52c142e1 n/a (libglib-2.0.so.0 + 0x8d2e1)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28373:
                #0  0x00007f1d5050d3f6 __GI_ppoll (libc.so.6 + 0x1033f6)
                #1  0x00007f1d52be3b2c n/a (libglib-2.0.so.0 + 0x5cb2c)
                #2  0x00007f1d52be41c0 g_main_context_iteration
(libglib-2.0.so.0 + 0x5d1c0)
                #3  0x00007f1d52be4211 n/a (libglib-2.0.so.0 + 0x5d211)
                #4  0x00007f1d52c142e1 n/a (libglib-2.0.so.0 + 0x8d2e1)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28374:
                #0  0x00007f1d5050d3f6 __GI_ppoll (libc.so.6 + 0x1033f6)
                #1  0x00007f1d52be3b2c n/a (libglib-2.0.so.0 + 0x5cb2c)
                #2  0x00007f1d52be41c0 g_main_context_iteration
(libglib-2.0.so.0 + 0x5d1c0)
                #3  0x00007f1d52dceadd n/a (libdconfsettings.so + 0xbadd)
                #4  0x00007f1d52c142e1 n/a (libglib-2.0.so.0 + 0x8d2e1)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28396:
                #0  0x00007f1d505185b9 syscall (libc.so.6 + 0x10e5b9)
                #1  0x00007f1d52c140b0 g_cond_wait_until (libglib-2.0.so.0 +
0x8d0b0)
                #2  0x00007f1d52bab413 n/a (libglib-2.0.so.0 + 0x24413)
                #3  0x00007f1d52baba45 g_async_queue_timeout_pop
(libglib-2.0.so.0 + 0x24a45)
                #4  0x00007f1d52c1474d n/a (libglib-2.0.so.0 + 0x8d74d)
                #5  0x00007f1d52c142e1 n/a (libglib-2.0.so.0 + 0x8d2e1)
                #6  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #7  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28391:
                #0  0x00007f1d5049891e __futex_abstimed_wait_common64
(libc.so.6 + 0x8e91e)
                #1  0x00007f1d5049b1c0 __pthread_cond_wait_common (libc.so.6 +
0x911c0)
                #2  0x00007f1d4876601d n/a (libgallium-24.2.8-1.so + 0x16601d)
                #3  0x00007f1d4874309b n/a (libgallium-24.2.8-1.so + 0x14309b)
                #4  0x00007f1d48765f4b n/a (libgallium-24.2.8-1.so + 0x165f4b)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28375:
                #0  0x00007f1d5050d3f6 __GI_ppoll (libc.so.6 + 0x1033f6)
                #1  0x00007f1d52be3b2c n/a (libglib-2.0.so.0 + 0x5cb2c)
                #2  0x00007f1d52be44af g_main_loop_run (libglib-2.0.so.0 +
0x5d4af)
                #3  0x00007f1d52732f1a n/a (libgio-2.0.so.0 + 0x127f1a)
                #4  0x00007f1d52c142e1 n/a (libglib-2.0.so.0 + 0x8d2e1)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28390:
                #0  0x00007f1d5049891e __futex_abstimed_wait_common64
(libc.so.6 + 0x8e91e)
                #1  0x00007f1d5049b1c0 __pthread_cond_wait_common (libc.so.6 +
0x911c0)
                #2  0x00007f1d4876601d n/a (libgallium-24.2.8-1.so + 0x16601d)
                #3  0x00007f1d4874309b n/a (libgallium-24.2.8-1.so + 0x14309b)
                #4  0x00007f1d48765f4b n/a (libgallium-24.2.8-1.so + 0x165f4b)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28393:
                #0  0x00007f1d5049891e __futex_abstimed_wait_common64
(libc.so.6 + 0x8e91e)
                #1  0x00007f1d5049b1c0 __pthread_cond_wait_common (libc.so.6 +
0x911c0)
                #2  0x00007f1d4876601d n/a (libgallium-24.2.8-1.so + 0x16601d)
                #3  0x00007f1d4874309b n/a (libgallium-24.2.8-1.so + 0x14309b)
                #4  0x00007f1d48765f4b n/a (libgallium-24.2.8-1.so + 0x165f4b)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28394:
                #0  0x00007f1d5049891e __futex_abstimed_wait_common64
(libc.so.6 + 0x8e91e)
                #1  0x00007f1d5049b1c0 __pthread_cond_wait_common (libc.so.6 +
0x911c0)
                #2  0x00007f1d4876601d n/a (libgallium-24.2.8-1.so + 0x16601d)
                #3  0x00007f1d4874309b n/a (libgallium-24.2.8-1.so + 0x14309b)
                #4  0x00007f1d48765f4b n/a (libgallium-24.2.8-1.so + 0x165f4b)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28392:
                #0  0x00007f1d5049891e __futex_abstimed_wait_common64
(libc.so.6 + 0x8e91e)
                #1  0x00007f1d5049b1c0 __pthread_cond_wait_common (libc.so.6 +
0x911c0)
                #2  0x00007f1d4876601d n/a (libgallium-24.2.8-1.so + 0x16601d)
                #3  0x00007f1d4874309b n/a (libgallium-24.2.8-1.so + 0x14309b)
                #4  0x00007f1d48765f4b n/a (libgallium-24.2.8-1.so + 0x165f4b)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)

                Stack trace of thread 28395:
                #0  0x00007f1d5049891e __futex_abstimed_wait_common64
(libc.so.6 + 0x8e91e)
                #1  0x00007f1d5049b1c0 __pthread_cond_wait_common (libc.so.6 +
0x911c0)
                #2  0x00007f1d4876601d n/a (libgallium-24.2.8-1.so + 0x16601d)
                #3  0x00007f1d4874309b n/a (libgallium-24.2.8-1.so + 0x14309b)
                #4  0x00007f1d48765f4b n/a (libgallium-24.2.8-1.so + 0x165f4b)
                #5  0x00007f1d5049bf52 start_thread (libc.so.6 + 0x91f52)
                #6  0x00007f1d5051a678 __clone3 (libc.so.6 + 0x110678)
                ELF object binary architecture: AMD x86-64

#1088681#10
Date:
2024-11-29 15:17:44 UTC
From:
To:
Control: retitle -1 gnome-system-monitor: strcpy overflow inside glibtop_get_disk_l()
Control: reassign -1 libgtop-2.0-11 2.41.3-1
Control: affects -1 + gnome-system-monitor
...

You were correct to report this to gnome-system-monitor at first, but
this looks like a string buffer overflow inside libgtop being caught by
glibc's "fortify" hardening, so I'm reassigning this to the version of
libgtop you seem to have been using.

Looking at sysdeps/linux/disk.c, there are some unsafe-looking uses of
strcpy() which could well be the problem here.

If you run 'lsblk --output NAME,TYPE -i -n' in a terminal, do any of the
drives that are listed have unusually long values for the name or type?

    smcv

#1088681#25
Date:
2024-11-29 15:30:42 UTC
From:
To:
No, there's no long disk names. I did however notice that when I open
certain applications that are flatpaks the issue occurs. I'm trying to
figure out which one is causing the problem.

Konomi

#1088681#30
Date:
2024-11-29 15:38:53 UTC
From:
To:
It seems to only crash when I have the flatpak of Tuba open
(https://flathub.org/apps/dev.geopjr.Tuba) but it only crashes at
startup if I have gnome-system-monitor already open then launch tuba
it doesn't crash. If I have tuba open and try to launch
gnome-system-moitor the system monitor crashes.

Konomi

#1088681#35
Date:
2024-11-29 15:50:17 UTC
From:
To:
I've also noticed this error when running gnome-system-monitor from
the terminal:

glibtop(c=2365): [WARNING] statvfs '/run/user/1000/doc' failed:
Operation not permitted

It looks like it's trying to read that path and failing and when I
check that directory it says the date of it and all its containing
files are from Jan 1 1970. Aka the epoch. So I have a feeling that
this glibtop is choking on something flatpaks are doing maybe? Unsure,
hope the extra info helps.

#1088681#40
Date:
2025-06-19 15:37:28 UTC
From:
To:
Hi,

Just wanted to mention this bug is still present and will make it into
trixie unless fixed.

Konomi