Public bug reported: [Impact]
On tmux 3.4-1ubuntu0.2 (noble), running kill-session on a session whose window is zoomed crashes the tmux server with SIGSEGV. One server normally holds all of a user's sessions, so every session on it ends, along with every process running in them. There is no warning and nothing can be recovered. It reproduces with no configuration file. Zooming a pane (C-b z) is a common action, and ending a session is too. Scripts that manage sessions can reach this without the user doing anything unusual. Upstream fixed this in tmux 3.5. The bug report is https://github.com/tmux/tmux/issues/3857 ("Zoomed windows crash tmux after killing session with `x` on tree mode"), which reproduces it from the keyboard: split with C-b %, zoom with C-b z, open tree mode with C-b s, press x on the session, confirm with y. The fix is https://github.com/tmux/tmux/pull/3860 ("Don't notify when unzooming windows from window_destroy()", by Romain Francoise), whose branch commit is 5363a5475a1dd4158c1ddb23de2da34e88738673. The maintainer applied it through OpenBSD, so the hash on tmux's master may differ; I haven't confirmed it. 3.5's CHANGES lists it as "Do not notify window- layout-changed if the window is about to be destroyed". The pull request says the bug came in with commit 36e1ac6. I've read the 3.5a source but haven't built or run it. Backtrace, from a core dump with tmux-dbgsym 3.4-1ubuntu0.2: #0 options_tree_RB_MINMAX options.c:90 #1 options_free options.c:186 #2 window_destroy window.c:360 #3 window_remove_ref window.c:398 (references now 0) #4 notify_callback notify.c:165 (ne->name "window-layout-changed", ne->window the same window) #5 cmdq_next ... server_loop How it happens, from reading 3.4's window.c and notify.c, and consistent with the core: 1. The last reference to a zoomed window goes, so window_destroy starts. 2. window_destroy calls window_unzoom, which calls notify_window("window-layout-changed", w). That takes a new reference and queues a callback. 3. window_destroy carries on and frees w. 4. The queued callback drops its reference on freed memory, reaches 0, and calls window_destroy again. [Test Plan] As an ordinary user, on a private socket so no existing tmux server is touched: unset TMUX export TMUX_TMPDIR=$(mktemp -d) T="tmux -f /dev/null -L sru" $T new-session -d -s anchor -x 80 -y 24 $T new-session -d -s a -x 80 -y 24 $T split-window -t =a: $T resize-pane -Z -t =a: $T kill-session -t =a sleep 1 $T list-sessions Broken: "server exited unexpectedly" from kill-session, then "no server running on ..." from list-sessions. Fixed: list-sessions prints the "anchor" session. To clean up: $T kill-server; rm -rf "$TMUX_TMPDIR" The same steps without the resize-pane line leave "anchor" alive, on the broken version too. Results on 3.4-1ubuntu0.2, Ubuntu 24.04.5: broken 3 runs of 3 with these exact steps, and 8 of 8 in an earlier scripted run; without the zoom, 0 of 3 and 0 of 8. [Where problems could occur] The fix changes what happens when a zoomed window is destroyed, and whether window-layout-changed fires then. - A regression could appear as a crash or a leak elsewhere in window teardown: kill-window, kill-pane, a pane's last process exiting, or a server shutting down with zoomed windows. - Hooks and control-mode clients listening for window-layout-changed would no longer see that event for a window being destroyed. Anything relying on it would notice. - Unzooming on ordinary paths (resize-pane -Z, select-pane -Z) must keep firing the notification and keep the layout; if the change reaches further than destruction, zoom behaviour would be where it shows. Regression testing should cover zoom and unzoom, kill-window and kill- pane on zoomed windows, and a hook on window-layout-changed. [Other Info] Other routes to the same crash, same setup: an ungrouped session with a zoomed window, with destroy-unattached set, when its last client disconnects. Killing the zoomed window or pane directly (kill-window, kill-pane) did not crash in my runs, 8 of 8. Workaround: unzoom before kill-session. I searched for an existing report and didn't find one. I have not prepared a debdiff. ** Affects: tmux (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172863 Title: tmux server segfaults when the session of a zoomed window is killed To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/tmux/+bug/2172863/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
