Bug 869974

Summary: [abrt] xsane-0.998-12.fc17: get_interface: Process /usr/bin/xsane was killed by signal 11 (SIGSEGV)
Product: [Fedora] Fedora Reporter: Yann Droneaud <yann>
Component: hplipAssignee: Tim Waugh <twaugh>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: jpopelka, nphilipp, twaugh
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:802b5ea6d58bb0037e137a2cb6d1366276b47368
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-12-12 00:19:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: core_backtrace
none
File: environ
none
File: backtrace
none
File: limits
none
File: cgroup
none
File: smolt_data
none
File: maps
none
File: dso_list
none
File: proc_pid_status
none
File: build_ids
none
File: open_fds
none
File: var_log_messages none

Description Yann Droneaud 2012-10-25 09:32:29 UTC 
Description of problem:
After trying to get a preview from the multipage loader of my HP OfficeJet Pro 8600 Pro, the scanner block and XSane report an I/O error.
I restarted the scanner (switch off/on), then retried to get a preview with no document in the feeder. Then XSane window disappeared.



Version-Release number of selected component:
xsane-0.998-12.fc17

Additional info:
libreport version: 2.0.16
abrt_version:   2.0.16
backtrace_rating: 4
cmdline:        xsane
crash_function: get_interface
kernel:         3.6.2-4.fc17.x86_64

truncated backtrace:
:Thread no. 1 (10 frames)
: #0 get_interface at io/hpmud/musb.c:407
: #1 musb_comp_channel_open at io/hpmud/musb.c:1540
: #2 musb_channel_open at io/hpmud/musb.c:1357
: #3 http_open at scan/sane/http.c:298
: #4 bb_is_paper_in_adf at scan/sane/bb_ledm.c:811
: #5 ledm_start at scan/sane/ledm.c:800
: #6 preview_scan_start at ../../src/xsane-preview.c:2000
: #7 preview_scan at ../../src/xsane-preview.c:5125
: #8 _g_closure_invoke_va at gclosure.c:840
: #11 gtk_real_button_released at gtkbutton.c:1725
Comment 1 Yann Droneaud 2012-10-25 09:32:32 UTC 
Created attachment 633237 [details]
File: core_backtrace
Comment 2 Yann Droneaud 2012-10-25 09:32:34 UTC 
Created attachment 633238 [details]
File: environ
Comment 3 Yann Droneaud 2012-10-25 09:32:36 UTC 
Created attachment 633239 [details]
File: backtrace
Comment 4 Yann Droneaud 2012-10-25 09:32:38 UTC 
Created attachment 633240 [details]
File: limits
Comment 5 Yann Droneaud 2012-10-25 09:32:39 UTC 
Created attachment 633241 [details]
File: cgroup
Comment 6 Yann Droneaud 2012-10-25 09:32:41 UTC 
Created attachment 633242 [details]
File: smolt_data
Comment 7 Yann Droneaud 2012-10-25 09:32:44 UTC 
Created attachment 633243 [details]
File: maps
Comment 8 Yann Droneaud 2012-10-25 09:32:46 UTC 
Created attachment 633244 [details]
File: dso_list
Comment 9 Yann Droneaud 2012-10-25 09:32:48 UTC 
Created attachment 633245 [details]
File: proc_pid_status
Comment 10 Yann Droneaud 2012-10-25 09:32:50 UTC 
Created attachment 633246 [details]
File: build_ids
Comment 11 Yann Droneaud 2012-10-25 09:32:52 UTC 
Created attachment 633247 [details]
File: open_fds
Comment 12 Yann Droneaud 2012-10-25 09:32:53 UTC 
Created attachment 633248 [details]
File: var_log_messages
Comment 13 Nils Philippsen 2012-10-26 09:49:51 UTC 
The crash happens in libhpmud.so at io/hpmud/musb.c:407:

--- 8< ---
   libusb_get_device_descriptor (dev, &device_desc);
   for (conf = 0 ; conf < device_desc.bNumConfigurations; conf++)
   {
      libusb_get_config_descriptor(dev, conf, &confptr);
      for (iface = 0, ifaceptr = confptr->interface; iface < confptr->bNumInterfaces; iface++, ifaceptr++)
--- >8 ---

--> confptr which is NULL gets dereferenced. According to libusb API documentation[1], libusb_get_config_descriptor() doesn't write confptr if an error occurs which is indicated by a non-zero return code (which isn't checked, likewise for libusb_get_device_descriptor() 3 lines above).

Changing component to hplip.

[1]: http://libusb.sourceforge.net/api-1.0/group__desc.html
Comment 14 Jiri Popelka 2012-10-31 17:11:14 UTC 
reported upstream as https://bugs.launchpad.net/hplip/+bug/1073650
Comment 15 Jiri Popelka 2012-11-02 08:33:07 UTC 
Fix has been commited upstream.
Comment 16 Fedora Update System 2012-11-27 15:25:59 UTC 
hplip-3.12.11-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/hplip-3.12.11-1.fc18
Comment 17 Fedora Update System 2012-11-27 15:27:12 UTC 
hplip-3.12.11-1.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/hplip-3.12.11-1.fc17
Comment 18 Fedora Update System 2012-11-28 02:10:23 UTC 
Package hplip-3.12.11-1.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing hplip-3.12.11-1.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-19173/hplip-3.12.11-1.fc18
then log in and leave karma (feedback).
Comment 19 Fedora Update System 2012-12-12 00:19:25 UTC 
hplip-3.12.11-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 20 Fedora Update System 2012-12-21 11:58:47 UTC 
hplip-3.12.11-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.