Bug 838573

with debuginfo packages installed:

#0  0x00000035bdc0a902 in sanei_usb_init () at sanei_usb.c:603
#1  0x00007ffff0b49cb5 in sane_xerox_mfp_init (version_code=0x7fffffffb89c, cb=0x4123e0) at xerox_mfp.c:949
#2  0x00000035bdc17560 in init (be=0x9289d0) at dll.c:613
#3  0x00000035bdc1788d in sane_dll_get_devices (device_list=0x69f120, local_only=0) at dll.c:1034

Tested this more, crash only happens when plugged into the docking station.

###
When docked, lsusb prints:
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 003 Device 025: ID 17ef:100a Lenovo ThinkPad Mini Dock Plus Series 3
Bus 001 Device 004: ID 04f2:b217 Chicony Electronics Co., Ltd Lenovo Integrated Camera (0.3MP)
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 026: ID 041e:4088 Creative Technology, Ltd 
Bus 003 Device 027: ID 046d:c03e Logitech, Inc. Premium Optical Wheel Mouse (M-BT58)
Bus 003 Device 028: ID 046d:c316 Logitech, Inc. HID-Compliant Keyboard

###
Undocked the crash doesn't happen, undocked lsusb prints:

Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 004: ID 04f2:b217 Chicony Electronics Co., Ltd Lenovo Integrated Camera (0.3MP)
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub

Further testing shows that the crash only occurs my Creative webcam is connected:
 Bus 003 Device 026: ID 041e:4088 Creative Technology, Ltd 

Why it crashes, I don't know how to debug further.

This crash most likely stems from the backend driver. Does "scanimage -L" crash as well?

testing "scanimage -L" causes also segfault:

Program received signal SIGSEGV, Segmentation fault.
0x0000003a5640a902 in sanei_usb_init () at sanei_usb.c:603
603		      switch (dev->descriptor.bDeviceClass)
Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.80.el6_3.3.x86_64 libexif-0.6.16-4.1.el6.x86_64 libgphoto2-2.4.7-4.el6.x86_64 libieee1284-0.2.11-9.el6.x86_64 libtool-ltdl-2.2.6-15.5.el6.x86_64 libv4l-0.6.3-2.el6.x86_64
(gdb) bt

#0  0x0000003a5640a902 in sanei_usb_init () at sanei_usb.c:603
#1  0x00007ffff7dd8cb5 in sane_xerox_mfp_init (version_code=0x7fffffffc33c, cb=0x405c20 <auth_callback>) at xerox_mfp.c:949
#2  0x0000003a56417560 in init (be=0x60ee20) at dll.c:613
#3  0x0000003a5641788d in sane_dll_get_devices (device_list=0x7fffffffc4d0, local_only=0) at dll.c:1034
#4  0x0000000000403baa in main (argc=2, argv=0x7fffffffe628) at scanimage.c:1771

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.

Sorry for dropping the ball on this.

I have an idea what happens here (libusb returns devices with unset descriptors) and will build a scratch package for you to test while I'm away on vacation.

Um, I was barking up the wrong tree. I'd need to look at the problem when it happens in order to debug this. Can you still reproduce the issue? If yes, I'd like to take a look at it on the affected machine when I return from vacation.

Since Bugzilla started nagging about needinfo I'll comment that I don't have a RHEL6 laptop available to test at this time.

Closing this as CANTFIX then. Please reopen when you have a setup with which you can reproduce the issue.