Red Hat Bugzilla – Bug 1181981
totem crashes while calling NULL callback in eject_wrapper_callback()
Last modified: 2015-11-19 04:27:31 EST
Description of problem: User is running media from a detachable disk : totem /run/media/chiefj/RIP_60_WEEK_3 This is the backtrace of the crash : (gdb) bt #0 0x0000000000000000 in ?? () #1 0x00007f8747deddae in eject_wrapper_callback (source_object=<optimized out>, res=<optimized out>, user_data=0x2104dd0) at gproxymount.c:389 #2 0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f8748014d50) at gsimpleasyncresult.c:777 #3 0x00007f8747deafce in eject_cb (proxy=<optimized out>, res=<optimized out>, user_data=0x1ed09b0) at gproxydrive.c:599 #4 0x00007f8762451947 in g_simple_async_result_complete (simple=0x2670f10) at gsimpleasyncresult.c:777 #5 0x00007f87624ac8d1 in reply_cb (connection=<optimized out>, res=<optimized out>, user_data=0x2670f10) at gdbusproxy.c:2632 #6 0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f8748014ae0) at gsimpleasyncresult.c:777 #7 0x00007f87624a1c5a in g_dbus_connection_call_done (source=<optimized out>, result=<optimized out>, user_data=0x2813c00) at gdbusconnection.c:5339 #8 0x00007f8762451947 in g_simple_async_result_complete (simple=0x7f874801a5f0) at gsimpleasyncresult.c:777 #9 0x00007f87624519a9 in complete_in_idle_cb (data=<optimized out>) at gsimpleasyncresult.c:789 #10 0x00007f8761c82ac6 in g_main_dispatch (context=0x66d4d0) at gmain.c:3058 #11 g_main_context_dispatch (context=context@entry=0x66d4d0) at gmain.c:3634 #12 0x00007f8761c82e48 in g_main_context_iterate (context=context@entry=0x66d4d0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3705 #13 0x00007f8761c82efc in g_main_context_iteration (context=0x66d4d0, context@entry=0x0, may_block=may_block@entry=1) at gmain.c:3766 #14 0x00007f876247db84 in g_application_run (application=0x66a100, argc=argc@entry=2, argv=argv@entry=0x7fff4ed59f68) at gapplication.c:1623 #15 0x000000000040271a in main (argc=2, argv=0x7fff4ed59f68) at totem.c:273 Application crashed at line 389 : (gdb) frame 1 #1 0x00007f8747deddae in eject_wrapper_callback (source_object=<optimized out>, res=<optimized out>, user_data=0x2104dd0) at gproxymount.c:389 389 data->callback (data->object, res, data->user_data); (gdb) l 384 eject_wrapper_callback (GObject *source_object, 385 GAsyncResult *res, 386 gpointer user_data) 387 { 388 EjectWrapperOp *data = user_data; 389 data->callback (data->object, res, data->user_data); 390 g_object_unref (data->object); 391 g_free (data); 392 } 393 data->callback is NULL, that caused a crash : (gdb) p data $1 = (EjectWrapperOp *) 0x2104dd0 (gdb) p *data $2 = {object = 0x1e9a2e0, callback = 0x0, user_data = 0x0} Version-Release number of selected component (if applicable): totem-3.8.2-5.el7
Created attachment 979900 [details] bz1181981.patch Adding patch to avoid calling NULL callbacks
The patch looks good, I've just pushed it upstream.
The patch from the Comment 1 is already included in the rebased gvfs (Bug 1174716).
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2106.html