Bug 1774319 - Crash when scanning with docketport 467
Summary: Crash when scanning with docketport 467
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: sane-backends
Version: 31
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Nils Philippsen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-11-20 02:26 UTC by Link Dupont
Modified: 2023-09-14 05:47 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-11-24 18:12:24 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Link Dupont 2019-11-20 02:26:34 UTC
Description of problem:

simple-scan and skanlite crash when attempting to scan with sane-backends 1.0.28-5.

#0  0x00007ffff6e8d625 in raise () at /lib64/libc.so.6
#1  0x00007ffff6e768d9 in abort () at /lib64/libc.so.6
#2  0x00007fffcbbf00e8 in std::__replacement_assert(char const*, int, char const*, char const*)
    (__file=__file@entry=0x7fffcbc553e0 "/usr/include/c++/9/bits/stl_vector.h", __line=__line@entry=1042, __function=__function@entry=0x7fffcbc55938 "std::vector<_Tp, _Alloc>::reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) [with _Tp = Genesys_Motor_Slope; _Alloc = std::allocator<Genesys_Motor_Slope>; std::vector"..., __condition=__condition@entry=0x7fffcbc55290 "__builtin_expect(__n < this->size(), true)") at /usr/include/c++/9/x86_64-redhat-linux/bits/c++config.h:2533
#3  0x00007fffcbbcf45f in std::vector<Genesys_Motor_Slope, std::allocator<Genesys_Motor_Slope> >::operator[](unsigned long)
    (__n=18446744072905574032, this=<optimized out>) at genesys.cc:825
#4  sanei_genesys_exposure_time2(Genesys_Device*, float, int, int, int, int)
    (dev=dev@entry=0x7fffd0100450, ydpi=ydpi@entry=600, step_type=step_type@entry=2, endpixel=endpixel@entry=5225, exposure_by_led=exposure_by_led@entry=5524, power_mode=<optimized out>) at genesys.cc:812
#5  0x00007fffcbc0a882 in gl841_exposure_time(Genesys_Device*, Genesys_Sensor const&, float, int, int, int, int*)
    (dev=dev@entry=0x7fffd0100450, sensor=..., slope_dpi=slope_dpi@entry=600, scan_step_type=scan_step_type@entry=2, start=start@entry=29, used_pixels=used_pixels@entry=5196, scan_power_mode=scan_power_mode@entry=0x7fffe1438904) at genesys_gl841.cc:2060
#6  0x00007fffcbc0dc71 in gl841_init_scan_regs(Genesys_Device*, Genesys_Sensor const&, Genesys_Register_Set*, SetupParams&)
    (dev=0x7fffd0100450, sensor=..., reg=0x7fffd01004c0, params=...) at genesys_gl841.cc:2305
#7  0x00007fffcbc0ee2a in gl841_init_regs_for_scan(Genesys_Device*, Genesys_Sensor const&) (dev=0x7fffd0100450, sensor=...)
    at genesys_gl841.cc:3904
#8  0x00007fffcbbe8e21 in genesys_start_scan (lamp_off=0, dev=0x7fffd0100450) at genesys.cc:3914
#9  sane_start_impl(void*) (handle=0x7fffd01682f0) at genesys.cc:7236
#10 sane_start_impl(void*) (handle=0x7fffd01682f0) at genesys.cc:7214
#11 0x00007fffcbbea42e in <lambda()>::operator() (__closure=<optimized out>) at genesys.cc:7301
#12 wrap_exceptions_to_status_code<sane_genesys_start(SANE_Handle)::<lambda()> > (func=0x7fffcbc58953 "sane_genesys_start", function=...)
    at genesys_error.h:165
#13 sane_genesys_start(SANE_Handle) (handle=<optimized out>) at genesys.cc:7299
#14 0x000055555558b3d5 in _scanner_scan_thread_gthread_func ()
#15 0x00007ffff7db2f52 in g_thread_proxy () at /lib64/libglib-2.0.so.0
#16 0x00007ffff6dc44e2 in start_thread () at /lib64/libpthread.so.0
#17 0x00007ffff6f52643 in clone () at /lib64/libc.so.6



Version-Release number of selected component (if applicable): sane-backends-1.0.28-5

How reproducible: Always


Steps to Reproduce:
1. run simple-scan with a docketport 467 connected
2. scan

Actual results: Crash, see stacktrace


Expected results: scan


Additional info:

abrt report: https://retrace.fedoraproject.org/faf/reports/2762226/

I have an asic_type value of 841.

Thread 8 "scan-thread" hit Breakpoint 1, get_gamma_table (dev=0x7fffd0100450, sensor=..., color=0) at genesys_low.cc:1169
1169	{
(gdb) p dev
$2 = (Genesys_Device *) 0x7fffd0100450
(gdb) p dev->model
$3 = (Genesys_Model *) 0x7fffcbc72c40 <syscan_docketport_467_model>
(gdb) p dev->model->asic_type
$4 = 841

Comment 1 Link Dupont 2019-11-20 03:24:40 UTC
I patched genesys.cc to include GENESYS_GL841 in the list of types that set size = 257 (updating sane-genesys-vector-glibcxxassert.patch)

diff --git a/backend/genesys.cc b/backend/genesys.cc
index 0368e21..5ec37bc 100644
--- a/backend/genesys.cc
+++ b/backend/genesys.cc
@@ -778,6 +778,13 @@ void sanei_genesys_create_default_gamma_table(Genesys_Device* dev,
             size = 4096;
         }
         max = size - 1;
+    } else if (dev->model->asic_type == GENESYS_GL846
+               || dev->model->asic_type == GENESYS_GL847
+               || dev->model->asic_type == GENESYS_GL841
+               || dev->model->asic_type == GENESYS_GL848
+               || dev->model->asic_type == GENESYS_GL124) {
+        size = 257;
+        max = 65535;
     } else {
         size = 256;
         max = 65535;


But it still crashes with the same stack trace.

Comment 2 Zdenek Dohnal 2019-11-20 09:35:51 UTC
Hi Link,

thank you for reporting the issue!

Your device - docketport 467 - is not on the list of SANE supported devices http://www.sane-project.org/sane-mfgs.html - did the device work with previous versions of sane-backends?

Comment 3 Link Dupont 2019-11-20 13:56:25 UTC
Yes, it has worked for years. I never thought to look at the list of supported devices because it all worked. It was de facto supported. Versions early in Fedora 30's lifecycle worked fine, but from what I gathered from reading the previous bug report, 1.0.28 even in Fedora 30 would exhibit the same problem.

Comment 4 Link Dupont 2019-11-20 13:59:50 UTC
Scans produced using scanimage and xsane don't crash like this, but they don't scan an image (the produced image is solid black). So it seems like this has something to do with the way simple-scan is using the sane API.

Comment 5 Link Dupont 2019-11-20 18:13:44 UTC
Well, I can't seem to let this alone... Using upstream master and loading it into my library path, I'm able to avoid the crash simply by using unpatched upstream. However, produced images are all solid black. So it sounds like my scanner now falls squarely in the unsupported camp. :(

Comment 6 Zdenek Dohnal 2019-11-21 10:48:33 UTC
I'll just post your upstream issue here - https://gitlab.com/sane-project/backends/issues/171 .

I looked into the code a little - genesys gl841 did not change at all from brief look, so there is something different in general genesys (though it again look similar). I'll copy the backtrace to upstream issue and see if Povilas will know what to do.

Comment 7 Ben Cotton 2020-11-03 15:51:51 UTC
This message is a reminder that Fedora 31 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora 31 on 2020-11-24.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
Fedora 'version' of '31'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 31 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 8 Zdenek Dohnal 2020-11-04 06:58:30 UTC
Hi Link,

I don't see any further communication on the upstream ticket, what is the current status of the issue?

Thank you in advance for the update!

Comment 9 Link Dupont 2020-11-05 14:09:10 UTC
I haven't chased this any further. I bought a different scanner, partly to avoid this issue, but partly to upgrade the scanner quality. I do still have the DocketPort scanners, so I can test this out, but it's pretty low priority for me.

Comment 10 Zdenek Dohnal 2020-11-06 05:56:58 UTC
IIRC the crash doesn't happen with the latest sane-backends, but the scanned image is black, right?

Would you mind attaching the logs obtained by:

$ SANE_DEBUG_DLL=255 SANE_DEBUG_GENESYS=255 SANE_DEBUG_SANEI_USB=255 scanimage -d <device_uri_from_scanimage_-L> > out.pnm 2> log

?

And (if the size allows) please attach out.pnm too.

Comment 11 Ben Cotton 2020-11-24 18:12:24 UTC
Fedora 31 changed to end-of-life (EOL) status on 2020-11-24. Fedora 31 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Comment 12 Red Hat Bugzilla 2023-09-14 05:47:14 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days


Note You need to log in before you can comment on or make changes to this bug.