Bug 1159610

Summary: [abrt] gvfs-mtp: g_mutex_clear(): gvfsd-mtp killed by SIGABRT
Product: [Fedora] Fedora Reporter: 汪明衡 <ifoolb>
Component: gvfsAssignee: Ondrej Holy <oholy>
Status: CLOSED NEXTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: alexl, bnocera, ifoolb, oholy
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/9abf961022192a417c0344f4b72f250094ce1eb3
Whiteboard: abrt_hash:d61e0b5fc526c71468213f12e94b516df8589dbd
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-11-04 12:52:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages
none
required additional debug info
none
nautilus freeze none

Description 汪明衡 2014-11-02 08:42:08 UTC
Description of problem:
Not every time it crashes following these steps, but sometimes it does happen:
1. Leave nautilus opened;
2. connect HTC one in media sharing mode to the laptop;
3. click 'Open with Files' button of gnome shell pop-up;
4. nautilus then freezes.

Version-Release number of selected component:
gvfs-mtp-1.22.1-2.fc21

Additional info:
reporter:       libreport-2.3.0
backtrace_rating: 4
cmdline:        /usr/libexec/gvfsd-mtp --spawner :1.5 /org/gtk/gvfs/exec_spaw/3
crash_function: g_mutex_clear
executable:     /usr/libexec/gvfsd-mtp
kernel:         3.17.2-300.fc21.x86_64
runlevel:       N 5
type:           CCpp
uid:            1001

Truncated backtrace:
Thread no. 1 (10 frames)
 #2 g_mutex_clear at gthread-posix.c:1295
 #3 g_vfs_backend_mtp_finalize at gvfsbackendmtp.c:429
 #5 g_value_unset at gvalue.c:272
 #8 g_vfs_job_source_closed at gvfsjobsource.c:107
 #9 forced_unregister_mount_callback at gvfsbackend.c:1032
 #10 g_simple_async_result_complete at gsimpleasyncresult.c:763
 #11 reply_cb at gdbusproxy.c:2623
 #12 g_simple_async_result_complete at gsimpleasyncresult.c:763
 #13 g_dbus_connection_call_done at gdbusconnection.c:5508
 #14 g_simple_async_result_complete at gsimpleasyncresult.c:763

Comment 1 汪明衡 2014-11-02 08:42:25 UTC
Created attachment 952856 [details]
File: backtrace

Comment 2 汪明衡 2014-11-02 08:42:27 UTC
Created attachment 952857 [details]
File: cgroup

Comment 3 汪明衡 2014-11-02 08:42:32 UTC
Created attachment 952858 [details]
File: core_backtrace

Comment 4 汪明衡 2014-11-02 08:42:35 UTC
Created attachment 952859 [details]
File: dso_list

Comment 5 汪明衡 2014-11-02 08:42:37 UTC
Created attachment 952860 [details]
File: environ

Comment 6 汪明衡 2014-11-02 08:42:38 UTC
Created attachment 952861 [details]
File: limits

Comment 7 汪明衡 2014-11-02 08:42:44 UTC
Created attachment 952862 [details]
File: maps

Comment 8 汪明衡 2014-11-02 08:42:45 UTC
Created attachment 952863 [details]
File: open_fds

Comment 9 汪明衡 2014-11-02 08:42:47 UTC
Created attachment 952864 [details]
File: proc_pid_status

Comment 10 汪明衡 2014-11-02 08:42:48 UTC
Created attachment 952865 [details]
File: var_log_messages

Comment 11 Ondrej Holy 2014-11-03 10:18:53 UTC
Thanks for your bugreport. It seems to me backend is unmounting immediately after it is shown in Nautilus. The unmount is caused probably because "remove" uevent is detected. This happens when cable is unplugged. It crashes consequently, because g_mutex_clear is called on locked mutex probably. This has undefined behavioral according the gio documentation. 

There is not much what we can do if backend is unmounting, but it is weird why the unmount is executed... It crashes only when nautilus is already opened?

Could you execute:
pkill gvfs; GVFS_DEBUG=1 /usr/libexec/gvfsd --replace &> ~/gvfsd.log
reproduce the bug and upload gvfsd.log please?

Comment 12 汪明衡 2014-11-03 14:44:55 UTC
(In reply to Ondrej Holy from comment #11)
> Thanks for your bugreport. It seems to me backend is unmounting immediately
> after it is shown in Nautilus. The unmount is caused probably because
> "remove" uevent is detected. This happens when cable is unplugged. It
> crashes consequently, because g_mutex_clear is called on locked mutex
> probably. This has undefined behavioral according the gio documentation. 
> 
> There is not much what we can do if backend is unmounting, but it is weird
> why the unmount is executed... It crashes only when nautilus is already
> opened?
> 
> Could you execute:
> pkill gvfs; GVFS_DEBUG=1 /usr/libexec/gvfsd --replace &> ~/gvfsd.log
> reproduce the bug and upload gvfsd.log please?

Hi there, sorry for delayed replay. This bug is not very reproduceable and after spent quite some time I did make it appear again(ABRT took me here again). The log file is long because I kept it being logged while testing, so it could contain multiple records. Now I'm not sure what exact steps to triger the problem because the situation varies a bit: Nautilus still hang but this time after I removed the cable and then gvfs crashed, while the last time I issued 'pkill nautilus' preceeded the crash. And I neither can determine whether nautilus must be open since if its window isn't present then I won't know whether it hangs or not, or perform any file manipulation. The only thing I noticed is that when the problem is likely appearing nautilus can't launch if it's not already openned.

Comment 13 汪明衡 2014-11-03 14:46:50 UTC
Created attachment 953132 [details]
required additional debug info

Comment 14 汪明衡 2014-11-03 14:54:10 UTC
Created attachment 953146 [details]
nautilus freeze

There might be something related to the cable, but I'm sure it works properly and I didn't touch it during the connection. Anyway nautilus freezed first though this time the bug appeared after cable was removed.

Comment 15 Ondrej Holy 2014-11-03 16:25:08 UTC
Thanks for quick response and for the log. There is in the log what I was talking about:

Queued new job 0x1468180 (GVfsJobQueryInfo)
(I) do_query_info (filename = /)
(I) on_uevent (action remove, device (null))
(I) on_uevent (action remove, device (null))
(I) on_uevent (action remove, device (null))
(I) on_uevent (action remove, device (null))
(I) on_uevent (action remove, device (null))
(I) on_uevent (action remove, device /dev/bus/usb/003/005)
(I) on_uevent: Quiting after remove event on device /dev/bus/usb/003/005
(I) on_uevent done.
forced_unregister_mount_callback
(I) g_vfs_backend_mtp_finalize
g_mutex_clear() called on uninitialised or locked mutex

The mutex is cleared, when it is locked, thus abort() is called...

Comment 16 Ondrej Holy 2014-11-03 16:40:57 UTC
I've filed it upstream since we have reproducer now, see:
https://bugzilla.gnome.org/show_bug.cgi?id=739575

Comment 17 Ondrej Holy 2014-11-04 12:52:29 UTC
It will be fixed in gvfs-mtp-1.22.2 which should be there next week...