[Spice-devel] spicy crash while unplug usb strorage

[Hans de Goede]

Hi,

I had already seen your bug-report:
https://bugs.freedesktop.org/show_bug.cgi?id=55619

And I will reply there *when I've time to look into this*,
please be patient.

Regards,

Hans


On 10/06/2012 10:56 AM, 周伟 wrote:
>
> spice-gtk version spice-gtk-0.11
> usb-redir version 0.4.3
> server ubuntu 10.0.4 server
> client  ubuntu 11.10 alternate 64 bit
>
> It can be reproduce,I plug and unplug U storage for about 30 times,and this coredump occured. I guest it crash when logging  below is the coredump info. if you use export SPICE_DEBUG=1, it will crash more frequently.
>
>
> GSpice-Message: main channel: opened
> going to redirect usb device 2
>
> (spicy:1916): GSpice-CRITICAL **: usbredirhost error: resetting device: -5
> libusb:error [_open_sysfs_attr] open /sys/bus/usb/devices/1-3/descriptors failed ret=-1 errno=2
>
> (spicy:1916): GSpice-CRITICAL **: usbredirhost error: resetting device: -5
> libusb:error [_open_sysfs_attr] open /sys/bus/usb/devices/2-3/descriptors failed ret=-1 errno=2
>
> (spicy:1916): GSpice-CRITICAL **: usbredirhost error: resetting device: -5
> libusb:error [_open_sysfs_attr] open /sys/bus/usb/devices/2-3/descriptors failed ret=-1 errno=2
>
> (spicy:1916): GSpice-CRITICAL **: usbredirhost error: submitting bulk transfer on ep 02: -4
>
> (spicy:1916): GSpice-CRITICAL **: usbredirhost error: submitting bulk transfer on ep 02: -4
>
> (spicy:1916): GSpice-CRITICAL **: usbredirhost error: submitting bulk transfer on ep 81: -4
> Segmentation fault (core dumped)
> noc at ubuntu:~$ gdb /usr/local/bin/spicy core
> GNU gdb (Ubuntu/Linaro 7.3-0ubuntu2) 7.3-2011.08
> Copyright (C) 2011 Free Software Foundation, Inc.
> License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
> This is free software: you are free to change and redistribute it.https://bugs.freedesktop.org/show_bug.cgi?id=55619
> There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
> and "show warranty" for details.
> This GDB was configured as "x86_64-linux-gnu".
> For bug reporting instructions, please see:
> <http://bugs.launchpad.net/gdb-linaro/>...
> Reading symbols from /usr/local/bin/spicy...done.
> [New LWP 1916]
> [New LWP 1995]
>
> warning: Can't read pathname for load map: Input/output error.
> [Thread debugging using libthread_db enabled]
> Core was generated by `spicy -h 172.16.0.7 -p 6100'.
> Program terminated with signal 11, Segmentation fault.
> #0  usbredirhost_bulk_packet_complete (libusb_transfer=0x2248880) at usbredirhost.c:1934
> 1934    usbredirhost.c: No such file or directory.
>          in usbredirhost.c
> (gdb) bt
> #0  usbredirhost_bulk_packet_complete (libusb_transfer=0x2248880) at usbredirhost.c:1934
> #1  0x00007fec7e32343a in usbredirparser_call_type_func (parser_pub=0x22492d0) at usbredirparser.c:673
> #2  usbredirparser_do_read (parser_pub=0x22492d0) at usbredirparser.c:777
> #3  0x0000000000439691 in usbredir_handle_msg (c=<optimized out>, in=0x25044a0) at channel-usbredir.c:609
> #4  0x000000000042aa04 in spice_channel_recv_msg (channel=0x2248880, msg_handler=0x4390f0 <spice_usbredir_handle_msg>, data=0x0) at spice-channel.c:1835
> #5  0x000000000042b451 in spice_channel_iterate_read (channel=0x2248880) at spice-channel.c:1997
> #6  spice_channel_iterate_read (channel=0x2248880) at spice-channel.c:1981
> #7  0x00000000004291d4 in spice_channel_iterate (channel=0x2248880) at spice-channel.c:2055
> #8  spice_channel_coroutine (data=0x2248880) at spice-channel.c:2208
> #9  0x00000000004bc65b in coroutine_trampoline (cc=<optimized out>) at coroutine_ucontext.c:56
> #10 0x00000000004c8163 in continuation_trampoline (i0=<optimized out>, i1=<optimized out>) at continuation.c:49
> #11 0x00007fec7bdaf180 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
> #12 0x0000000002248d00 in ?? ()
> #13 0x0000000000000000 in ?? ()
> (gdb) p host
> $1 = <optimized out>
> (gdb) p host->log_func
> value has been optimized out
> (gdb) p host->lock
> value has been optimized out
> (gdb) p libusb_transfer->buffer
> $2 = (unsigned char *) 0x0
> (gdb) p libusb_transfer->actual_length
> $3 = 0
>
> I dont know why the pointer libusb_transfer->buffer is zero, I saw hot->log_func is 0 at previous core dump.
>
> ------------------
> Best Regards
> zhouwei54321 at qq.com
> 周伟
>
>
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/spice-devel
>