Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Cause: Gvfs volume monitor didn't verify whether optional callback function was provided when ejecting drive and used invalid pointer.
Consequence: It caused client applications (e.g. Totem) crashes, when drives were being ejected.
Fix: Currently, gvfs volume monitor verifies whether the callback function is provided.
Result: Client applications doesn't crash anymore if eject operation is executed without callback function.
DescriptionSiteshwar Vashisht
2015-01-14 08:59:11 UTC
Description of problem:
User is running media from a detachable disk :
totem /run/media/chiefj/RIP_60_WEEK_3
This is the backtrace of the crash :
(gdb) bt
#0 0x0000000000000000 in ?? ()
#1 0x00007f8747deddae in eject_wrapper_callback (source_object=<optimized out>, res=<optimized out>, user_data=0x2104dd0) at gproxymount.c:389
#2 0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f8748014d50) at gsimpleasyncresult.c:777
#3 0x00007f8747deafce in eject_cb (proxy=<optimized out>, res=<optimized out>, user_data=0x1ed09b0) at gproxydrive.c:599
#4 0x00007f8762451947 in g_simple_async_result_complete (simple=0x2670f10) at gsimpleasyncresult.c:777
#5 0x00007f87624ac8d1 in reply_cb (connection=<optimized out>, res=<optimized out>, user_data=0x2670f10) at gdbusproxy.c:2632
#6 0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f8748014ae0) at gsimpleasyncresult.c:777
#7 0x00007f87624a1c5a in g_dbus_connection_call_done (source=<optimized out>, result=<optimized out>, user_data=0x2813c00) at gdbusconnection.c:5339
#8 0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f874801a5f0) at gsimpleasyncresult.c:777
#9 0x00007f87624519a9 in complete_in_idle_cb (data=<optimized out>) at gsimpleasyncresult.c:789
#10 0x00007f8761c82ac6 in g_main_dispatch (context=0x66d4d0) at gmain.c:3058
#11 g_main_context_dispatch (context=context@entry=0x66d4d0) at gmain.c:3634
#12 0x00007f8761c82e48 in g_main_context_iterate (context=context@entry=0x66d4d0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3705
#13 0x00007f8761c82efc in g_main_context_iteration (context=0x66d4d0, context@entry=0x0, may_block=may_block@entry=1) at gmain.c:3766
#14 0x00007f876247db84 in g_application_run (application=0x66a100, argc=argc@entry=2, argv=argv@entry=0x7fff4ed59f68) at gapplication.c:1623
#15 0x000000000040271a in main (argc=2, argv=0x7fff4ed59f68) at totem.c:273
Application crashed at line 389 :
(gdb) frame 1
#1 0x00007f8747deddae in eject_wrapper_callback (source_object=<optimized out>, res=<optimized out>, user_data=0x2104dd0) at gproxymount.c:389
389 data->callback (data->object, res, data->user_data);
(gdb) l
384 eject_wrapper_callback (GObject *source_object,
385 GAsyncResult *res,
386 gpointer user_data)
387 {
388 EjectWrapperOp *data = user_data;
389 data->callback (data->object, res, data->user_data);
390 g_object_unref (data->object);
391 g_free (data);
392 }
393
data->callback is NULL, that caused a crash :
(gdb) p data
$1 = (EjectWrapperOp *) 0x2104dd0
(gdb) p *data
$2 = {object = 0x1e9a2e0, callback = 0x0, user_data = 0x0}
Version-Release number of selected component (if applicable):
totem-3.8.2-5.el7
Comment 1Siteshwar Vashisht
2015-01-14 09:13:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://rhn.redhat.com/errata/RHBA-2015-2106.html
Description of problem: User is running media from a detachable disk : totem /run/media/chiefj/RIP_60_WEEK_3 This is the backtrace of the crash : (gdb) bt #0 0x0000000000000000 in ?? () #1 0x00007f8747deddae in eject_wrapper_callback (source_object=<optimized out>, res=<optimized out>, user_data=0x2104dd0) at gproxymount.c:389 #2 0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f8748014d50) at gsimpleasyncresult.c:777 #3 0x00007f8747deafce in eject_cb (proxy=<optimized out>, res=<optimized out>, user_data=0x1ed09b0) at gproxydrive.c:599 #4 0x00007f8762451947 in g_simple_async_result_complete (simple=0x2670f10) at gsimpleasyncresult.c:777 #5 0x00007f87624ac8d1 in reply_cb (connection=<optimized out>, res=<optimized out>, user_data=0x2670f10) at gdbusproxy.c:2632 #6 0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f8748014ae0) at gsimpleasyncresult.c:777 #7 0x00007f87624a1c5a in g_dbus_connection_call_done (source=<optimized out>, result=<optimized out>, user_data=0x2813c00) at gdbusconnection.c:5339 #8 0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f874801a5f0) at gsimpleasyncresult.c:777 #9 0x00007f87624519a9 in complete_in_idle_cb (data=<optimized out>) at gsimpleasyncresult.c:789 #10 0x00007f8761c82ac6 in g_main_dispatch (context=0x66d4d0) at gmain.c:3058 #11 g_main_context_dispatch (context=context@entry=0x66d4d0) at gmain.c:3634 #12 0x00007f8761c82e48 in g_main_context_iterate (context=context@entry=0x66d4d0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3705 #13 0x00007f8761c82efc in g_main_context_iteration (context=0x66d4d0, context@entry=0x0, may_block=may_block@entry=1) at gmain.c:3766 #14 0x00007f876247db84 in g_application_run (application=0x66a100, argc=argc@entry=2, argv=argv@entry=0x7fff4ed59f68) at gapplication.c:1623 #15 0x000000000040271a in main (argc=2, argv=0x7fff4ed59f68) at totem.c:273 Application crashed at line 389 : (gdb) frame 1 #1 0x00007f8747deddae in eject_wrapper_callback (source_object=<optimized out>, res=<optimized out>, user_data=0x2104dd0) at gproxymount.c:389 389 data->callback (data->object, res, data->user_data); (gdb) l 384 eject_wrapper_callback (GObject *source_object, 385 GAsyncResult *res, 386 gpointer user_data) 387 { 388 EjectWrapperOp *data = user_data; 389 data->callback (data->object, res, data->user_data); 390 g_object_unref (data->object); 391 g_free (data); 392 } 393 data->callback is NULL, that caused a crash : (gdb) p data $1 = (EjectWrapperOp *) 0x2104dd0 (gdb) p *data $2 = {object = 0x1e9a2e0, callback = 0x0, user_data = 0x0} Version-Release number of selected component (if applicable): totem-3.8.2-5.el7