Repository navigation
Conversation
…ils during setup ice_error_handler() closed the connection itself on a fatal ICE error, from inside IceProcessMessages(), while auth_iochannel_watch(), the caller of IceProcessMessages(), closes the same connection on an IO error. When a client connection failed during setup, the connection was closed twice, and the session manager crashed on the freed connection. Leave the close to whoever owns the connection: the error handler only logs, as xfce4-session's does. accept_xsmp_connection() no longer frees the authentication watch while it runs inside that watch's IceProcessMessages(); the watch frees itself afterwards and leaves the connection to the new client. The connection's context is cleared before it is closed, and a second client setup on a connection that was already handed over is refused. Assisted-by: Claude Code:claude-opus-5
NeiroNext
added a commit
to Ubuntu-Unity-LifeSupport/unity-distro
that referenced
this pull request
Oct 13, 2026
…CE connection only once when a client fails during setup; upstream linuxmint/cinnamon-session#220), published 2026-10-13 12:41:10Z Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On Ubuntu Unity 26.04 (cinnamon-session 6.4.2) the session manager crashed at login, and the user was sent back to
the greeter, when a client's XSMP connection failed during setup:
ice_error_handler() closes the connection from inside IceProcessMessages(), and auth_iochannel_watch() then
closes the freed connection again. With this change the error handler only logs, as xfce4-session's does, and
each connection has one owner that closes it. This part of csm-xsmp-server.c is unchanged on master; the patch
applies and builds there.
What was observed. The crash above happened once, on its own, at the first login after a package upgrade,
in a normal session. It is a use-after-free: a connection that failed during setup was closed twice. That part
is proven.
Security impact. Reading libICE 1.1.1, the error handler is called while the connection is still in the
pending state, i.e. before the client has authenticated: IceProcessMessages() dispatches an incoming fatal
ICE_Error with no connection-status check, and IceCloseConnection() frees a pending (not-yet-accepted)
connection in place. The MIT-MAGIC-COOKIE check only runs during connection setup, which this path never
reaches, and the listening socket is a local one any local process can connect to. So a local process of
another user (or a sandboxed app that can reach the socket) can drive the session manager onto the freed
connection and end the user's session. We did not run this against a live session and did not assess whether the
use-after-free allows anything beyond a crash. The same code is in mate-session-manager.
Tested on 6.4.2 in Unity sessions: login, logout, and a client killed with SIGKILL. Each connection is closed and
freed exactly once.
The change was prepared with the help of an AI assistant; I have reviewed it.