Bug 628

Summary: Libusb crashes when MTP is used to access to a device
Product: Mageia Reporter: Lucien XU <sfietkonstantin>
Component: RPM PackagesAssignee: Thierry Vignaud <thierry.vignaud>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Normal CC: balcaen.john, dmorganec, mageia, marja11, thierry.vignaud
Version: CauldronKeywords: NEEDINFO, PATCH
Target Milestone: ---   
Hardware: i586   
OS: Linux   
Whiteboard: OK
Source RPM: libusb-compat CVE:
Status comment:
Bug Depends on:    
Bug Blocks: 720    
Attachments: try to fix segfault

Description Lucien XU 2011-04-03 17:29:58 CEST
Description of problem:
When I use Amarok (with MTP plugin enabled) or MTP command lines directly, libusb crash with segmentation fault.

I used GDB to get a trace.

Version-Release number of selected component (if applicable):
libusb 1.0.8-1

How reproducible:
Every time

Steps to Reproduce:
1. Plug a Walkman (for example)
2. Execute mtp-files
3. Get a Crash

OR 
1. Connect a USB device (even a mouse)
2. Start Amarok with MTP enabled

---------------------
Traces :

Without GDB :
> mtp-files

libmtp version: 1.0.4

libusb couldn't open USB device /dev/bus/usb/005/003: Permission denied.
libusb requires write access to USB device nodes.
libusb couldn't open USB device /dev/bus/usb/006/002: Permission denied.
libusb requires write access to USB device nodes.
Device 0 (VID=054c and PID=03fd) is a Sony Walkman NWZ-E445.
libusb couldn't open USB device /dev/bus/usb/002/005: Permission denied.
libusb requires write access to USB device nodes.
Erreur de segmentation

With GDB :
Starting program: /usr/bin/mtp-files 
[Thread debugging using libthread_db enabled]
libmtp version: 1.0.4

libusb couldn't open USB device /dev/bus/usb/005/003: Permission denied.
libusb requires write access to USB device nodes.
libusb couldn't open USB device /dev/bus/usb/006/002: Permission denied.
libusb requires write access to USB device nodes.
Device 0 (VID=054c and PID=03fd) is a Sony Walkman NWZ-E445.
libusb couldn't open USB device /dev/bus/usb/002/005: Permission denied.
libusb requires write access to USB device nodes.

Program received signal SIGSEGV, Segmentation fault.
0xb7e19957 in usb_bulk_io (dev=0x0, ep=2, bytes=0x8073050 "\020", size=16, timeout=10000) at core.c:751
751             r = libusb_bulk_transfer(dev->handle, ep & 0xff, bytes, size,

With Amarok :
ibusb couldn't open USB device /dev/bus/usb/005/003: Permission denied.
libusb requires write access to USB device nodes.
libusb couldn't open USB device /dev/bus/usb/006/002: Permission denied.
libusb requires write access to USB device nodes.
Device 0 (VID=054c and PID=03fd) is a Sony Walkman NWZ-E445.
libusb couldn't open USB device /dev/bus/usb/002/005: Permission denied.
libusb requires write access to USB device nodes.
KCrash: Application 'amarok' crashing...


Reproducible: 

Steps to Reproduce:
D Morgan 2011-04-04 15:57:14 CEST

CC: (none) => dmorganec
Source RPM: (none) => libmtp-utils

Comment 1 Thierry Vignaud 2011-04-04 22:30:39 CEST
classic NULL pointer dereference...

CC: (none) => thierry.vignaud

Comment 2 Thierry Vignaud 2011-04-08 15:49:02 CEST
Probably b/c of the missing rights.

There're two bugs here:
- udev not giving the proper rights
- libmtp not giving up early enough and trying to dereference NULL pointer
Thierry Vignaud 2011-04-08 15:49:53 CEST

Blocks: (none) => 720

Thierry Vignaud 2011-04-08 15:58:37 CEST

Source RPM: libmtp-utils => libusb-compat

Comment 3 Thierry Vignaud 2011-04-08 16:01:43 CEST
Created attachment 212 [details]
try to fix segfault

The following patch tries to fix this segfault.
Can you try rebuilding libusb-compat with this patch and see if it fixes for you?
Thierry Vignaud 2011-04-08 16:01:58 CEST

Keywords: (none) => NEEDINFO, PATCH
Assignee: bugsquad => thierry.vignaud

Comment 4 Lucien XU 2011-04-08 20:23:29 CEST
Haha, applying a patch (I ve never done it before).
Let's compile libusb :)
Comment 5 Lucien XU 2011-04-08 21:10:46 CEST
Well, I have compiled it but I'm quite afraid to break the distro.
Can someone generate a package and place it into testing ?

Thanks in advance.
Comment 6 John Balcaen 2011-04-08 22:47:23 CEST
(In reply to comment #5)
> Well, I have compiled it but I'm quite afraid to break the distro.
> Can someone generate a package and place it into testing ?
hum try the package from here :
http://blog.littleboboy.net/~mikala/libusb-compat/

CC: (none) => balcaen.john

Comment 7 Lucien XU 2011-04-08 23:06:23 CEST
Thanks, but it still crashes

[Thread debugging using libthread_db enabled]
libmtp version: 1.0.4

libusb couldn't open USB device /dev/bus/usb/003/002: Permission denied.
libusb requires write access to USB device nodes.
libusb couldn't open USB device /dev/bus/usb/004/002: Permission denied.
libusb requires write access to USB device nodes.
Device 0 (VID=054c and PID=03fd) is a Sony Walkman NWZ-E445.
libusb couldn't open USB device /dev/bus/usb/008/003: Permission denied.
libusb requires write access to USB device nodes.
PTP: request code 0x1002 sending req wrote only 26 bytes instead of 16PTP_ERROR_IO: failed to open session, trying again after resetting USB interface

Program received signal SIGSEGV, Segmentation fault.
0xb7e1a851 in usb_control_msg () from /lib/libusb-0.1.so.4
Missing debug package(s), you should install: libusb-compat-debug-0.1.3-4.1.mga1.i586
Comment 8 Lucien XU 2011-04-08 23:07:21 CEST
Sorry, wrong debug package : 

(gdb) run
Starting program: /usr/bin/mtp-files 
[Thread debugging using libthread_db enabled]
libmtp version: 1.0.4

libusb couldn't open USB device /dev/bus/usb/003/002: Permission denied.
libusb requires write access to USB device nodes.
libusb couldn't open USB device /dev/bus/usb/004/002: Permission denied.
libusb requires write access to USB device nodes.
Device 0 (VID=054c and PID=03fd) is a Sony Walkman NWZ-E445.
libusb couldn't open USB device /dev/bus/usb/008/003: Permission denied.
libusb requires write access to USB device nodes.
PTP: request code 0x1002 sending req wrote only 26 bytes instead of 16PTP_ERROR_IO: failed to open session, trying again after resetting USB interface

Program received signal SIGSEGV, Segmentation fault.
0xb7e1a851 in usb_control_msg (dev=0x0, bmRequestType=130, bRequest=0, wValue=0, wIndex=129, bytes=0xbfffeb8e "", size=2, timeout=10000) at core.c:842
842             r = libusb_control_transfer(dev->handle, bmRequestType & 0xff,
Comment 9 Ahmad Samir 2011-04-11 01:28:59 CEST
libmtp-1.0.6 has been uploaded.
Comment 10 Thierry Vignaud 2011-04-28 14:21:05 CEST
Ping?
What's the status with new libmtp-1.0.6?
Comment 11 Lucien XU 2011-04-28 20:14:06 CEST
Still crashing (sorry)

libmtp version: 1.0.6

libusb couldn't open USB device /dev/bus/usb/003/004: Permission denied.
libusb requires write access to USB device nodes.
libusb couldn't open USB device /dev/bus/usb/004/003: Permission denied.
libusb requires write access to USB device nodes.
Device 0 (VID=054c and PID=03fd) is a Sony Walkman NWZ-E445.
PTP: request code 0x1002 sending req wrote only 26 bytes instead of 16PTP_ERROR_IO: failed to open session, trying again after resetting USB interface
LIBMTP libusb: Attempt to reset device

Program received signal SIGSEGV, Segmentation fault.
0xb7e0e880 in op_reset_device (handle=0x8056898) at os/linux_usbfs.c:1217
1217                    usbi_err(HANDLE_CTX(handle),
Comment 12 Ahmad Samir 2011-04-28 21:39:18 CEST
When you connect the device, look at the log to get the device nodes, then post the output of:
getfacl /dev/bus/usb/00X/00Y

(replace X and Y with the actual numbers according to the logs).
Comment 13 Ahmad Samir 2011-04-28 22:05:15 CEST
blino thinks this is a dupe of bug 314.

Do you have virtualbox installed 'rpm -q virtualbox'? from the Mageia repos or from upstream?
Comment 14 Lucien XU 2011-04-29 09:12:29 CEST
No, I'm not running VB, but indeed it looks like 314.
I will test later.
Comment 15 Ahmad Samir 2011-04-29 18:15:35 CEST
I didn't say running, I said installed. Just virtualbox packages from the Mageia repos older than 4.0.4-5.mga1 or virtualbox from upstream would mean the bad vbox udev rule is installed and bug 314 is affecting your box.
Comment 16 Lucien XU 2011-04-29 20:31:05 CEST
No, Virtualbox is not installed.
Ahmad Samir 2011-04-30 00:13:52 CEST

CC: (none) => mageia

Comment 17 Marja Van Waes 2011-10-07 23:41:25 CEST
@ Lucien 
@ tv

Does this bug still exist in current cauldron?

CC: (none) => marja11

Comment 18 Marja Van Waes 2012-01-11 20:45:51 CET
@ tv

I'm putting OK on the whiteboard because you assigned this bug to yourself and I don't want it to show up again when searching for old New and Open bugs (of course I filter the OK ones away)

Whiteboard: (none) => OK

Comment 19 Lucien XU 2012-02-20 13:13:39 CET
Actually, I tested on a Mageia 1 and it seems to be fixed (the bug was opened before Mageia 1)

I marked it as Fixed then.

Status: NEW => RESOLVED
Resolution: (none) => FIXED