nvidia-settings --load-config-only segfault

[sclarkson]

When running nvidia-settings --load-config-only on a multiple monitor setup I get a segfault.

double free or corruption (!prev)
Aborted (core dumped)

Running under gdb isn't particularly helpful.

$ gdb --args nvidia-settings --load-config-only
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.2) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from nvidia-settings...
(gdb) run
Starting program: /usr/local/bin/nvidia-settings --load-config-only
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ffff5800640 (LWP 23869)]
[New Thread 0x7ffff4e00640 (LWP 23870)]
[New Thread 0x7fffeea00640 (LWP 23871)]
double free or corruption (!prev)

Thread 1 "nvidia-settings" received signal SIGABRT, Aborted.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=140737350984960) at ./nptl/pthread_kill.c:44
44	./nptl/pthread_kill.c: No such file or directory.
(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737350984960) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=140737350984960) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=140737350984960, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7a42476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7a287f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff7a89677 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7bdbb77 "%s\n") at ../sysdeps/posix/libc_fatal.c:156
#6  0x00007ffff7aa0cfc in malloc_printerr (str=str@entry=0x7ffff7bde7b0 "double free or corruption (!prev)") at ./malloc/malloc.c:5664
#7  0x00007ffff7aa2e7c in _int_free (av=0x7ffff7c1ac80 <main_arena>, p=0x555555ac4180, have_lock=<optimized out>) at ./malloc/malloc.c:4591
#8  0x00007ffff7aa5453 in __GI___libc_free (mem=<optimized out>) at ./malloc/malloc.c:3391
#9  0x00007ffff587f60a in eglReleaseThread () at /lib/x86_64-linux-gnu/libEGL.so.1
#10 0x00007ffff45754ac in  () at /lib/x86_64-linux-gnu/libGLX_nvidia.so.0
#11 0x00007ffff4574054 in  () at /lib/x86_64-linux-gnu/libGLX_nvidia.so.0
#12 0x00007ffff4527edf in  () at /lib/x86_64-linux-gnu/libGLX_nvidia.so.0
#13 0x00007ffff7ffd040 in _rtld_global () at /lib64/ld-linux-x86-64.so.2
#14 0x0000000000000000 in  ()

I tried various versions, and it appears to have started with the 560 series. Issue #109 seems similar.

I tried the following diff and do not get a segfault. Looking through the code, here, it looks like very few of the code paths here are properly cleaning up the resources.

diff --git a/src/nvidia-settings.c b/src/nvidia-settings.c
index af1a4d8..2da6f08 100644
--- a/src/nvidia-settings.c
+++ b/src/nvidia-settings.c
@@ -421,6 +421,10 @@ int main(int argc, char **argv)
      */
 
     if (op->only_load || op->list_targets) {
+        NvCtrlFreeAllSystems(&systems);
         return ret ? 0 : 1;
     }