[Spice-devel] spicy crash while unplug usb strorage

[周伟]

spice-gtk version spice-gtk-0.11
usb-redir version 0.4.3
server ubuntu 10.0.4 server
client  ubuntu 11.10 alternate 64 bit


It can be reproduce,I plug and unplug U storage for about 30 times,and this coredump occured. I guest it crash when logging  below is the coredump info. if you use export SPICE_DEBUG=1, it will crash more frequently.




GSpice-Message: main channel: opened
going to redirect usb device 2


(spicy:1916): GSpice-CRITICAL **: usbredirhost error: resetting device: -5
libusb:error [_open_sysfs_attr] open /sys/bus/usb/devices/1-3/descriptors failed ret=-1 errno=2


(spicy:1916): GSpice-CRITICAL **: usbredirhost error: resetting device: -5
libusb:error [_open_sysfs_attr] open /sys/bus/usb/devices/2-3/descriptors failed ret=-1 errno=2


(spicy:1916): GSpice-CRITICAL **: usbredirhost error: resetting device: -5
libusb:error [_open_sysfs_attr] open /sys/bus/usb/devices/2-3/descriptors failed ret=-1 errno=2


(spicy:1916): GSpice-CRITICAL **: usbredirhost error: submitting bulk transfer on ep 02: -4


(spicy:1916): GSpice-CRITICAL **: usbredirhost error: submitting bulk transfer on ep 02: -4


(spicy:1916): GSpice-CRITICAL **: usbredirhost error: submitting bulk transfer on ep 81: -4
Segmentation fault (core dumped)
noc at ubuntu:~$ gdb /usr/local/bin/spicy core 
GNU gdb (Ubuntu/Linaro 7.3-0ubuntu2) 7.3-2011.08
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>...
Reading symbols from /usr/local/bin/spicy...done.
[New LWP 1916]
[New LWP 1995]


warning: Can't read pathname for load map: Input/output error.
[Thread debugging using libthread_db enabled]
Core was generated by `spicy -h 172.16.0.7 -p 6100'.
Program terminated with signal 11, Segmentation fault.
#0  usbredirhost_bulk_packet_complete (libusb_transfer=0x2248880) at usbredirhost.c:1934
1934    usbredirhost.c: No such file or directory.
        in usbredirhost.c
(gdb) bt
#0  usbredirhost_bulk_packet_complete (libusb_transfer=0x2248880) at usbredirhost.c:1934
#1  0x00007fec7e32343a in usbredirparser_call_type_func (parser_pub=0x22492d0) at usbredirparser.c:673
#2  usbredirparser_do_read (parser_pub=0x22492d0) at usbredirparser.c:777
#3  0x0000000000439691 in usbredir_handle_msg (c=<optimized out>, in=0x25044a0) at channel-usbredir.c:609
#4  0x000000000042aa04 in spice_channel_recv_msg (channel=0x2248880, msg_handler=0x4390f0 <spice_usbredir_handle_msg>, data=0x0) at spice-channel.c:1835
#5  0x000000000042b451 in spice_channel_iterate_read (channel=0x2248880) at spice-channel.c:1997
#6  spice_channel_iterate_read (channel=0x2248880) at spice-channel.c:1981
#7  0x00000000004291d4 in spice_channel_iterate (channel=0x2248880) at spice-channel.c:2055
#8  spice_channel_coroutine (data=0x2248880) at spice-channel.c:2208
#9  0x00000000004bc65b in coroutine_trampoline (cc=<optimized out>) at coroutine_ucontext.c:56
#10 0x00000000004c8163 in continuation_trampoline (i0=<optimized out>, i1=<optimized out>) at continuation.c:49
#11 0x00007fec7bdaf180 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#12 0x0000000002248d00 in ?? ()
#13 0x0000000000000000 in ?? ()
(gdb) p host
$1 = <optimized out>
(gdb) p host->log_func
value has been optimized out
(gdb) p host->lock
value has been optimized out
(gdb) p libusb_transfer->buffer
$2 = (unsigned char *) 0x0
(gdb) p libusb_transfer->actual_length
$3 = 0


I dont know why the pointer libusb_transfer->buffer is zero, I saw hot->log_func is 0 at previous core dump.


------------------
Best Regards
zhouwei54321 at qq.com
周伟
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/spice-devel/attachments/20121006/70719426/attachment.html>