GNOME Bugzilla – Bug 591660
nautilus crashed with SIGSEGV in gdu_device_get_object_path() on USB device eject
Last modified: 2012-11-12 20:48:31 UTC
The bug has been opened on https://bugs.launchpad.net/bugs/412237 "gnome-disk-utility 0.4-0ubuntu1 after a system restart w/o closing any opened application some of them crashed
+ Trace 216910
Setting the importance to critical because this is a crash
*** Bug 606293 has been marked as a duplicate of this bug. ***
*** Bug 609037 has been marked as a duplicate of this bug. ***
*** Bug 610628 has been marked as a duplicate of this bug. ***
*** Bug 635875 has been marked as a duplicate of this bug. ***
*** Bug 640049 has been marked as a duplicate of this bug. ***
the last dup get a good trace.
*** Bug 643626 has been marked as a duplicate of this bug. ***
Duplicate bug 644366 ?
*** Bug 644366 has been marked as a duplicate of this bug. ***
*** Bug 647716 has been marked as a duplicate of this bug. ***
*** Bug 653452 has been marked as a duplicate of this bug. ***
*** Bug 672704 has been marked as a duplicate of this bug. ***
I'm currently looking at https://launchpad.net/bugs/916892 which exhibits this as well. This happens in particular when using usb-creator, a tool to write iso images to USB sticks. This sets up a loop device. As the loop device is mounted to /tmp/..., what happens is that there is no GVolume during the time it's mounted, as we hide stuff that's not in /media/ by default. On unmounting, the GVolume appears quickly, triggering a volume-added signal. But it disappears immediately again as the underlying loop device is cleaned up. So while the volume-added signal handler is running, it gets to this code: device = _gdu_device_new_from_object_path (pool, object_path); g_hash_table_insert (pool->priv->object_path_to_device, (gpointer) gdu_device_get_object_path (device), device); I suppose at that time the underlying loop device is already history, and thus _gdu_device_new_from_object_path() returns NULL, as the stack trace shows. I looked into several of the dupes, and they all happen on unmount, so I'm fairly sure it's the very same race.
Created attachment 210441 [details] reproducer This is a simple reproducer which just listens to volume-added and calls gdu_pool_new(). gcc -o /tmp/gdu_pool_crash gdu_pool_crash.c -Wall -g -O0 `pkg-config --cflags --libs glib-2.0 gio-2.0 gdu` && gdb /tmp/gdu_pool_crash then run sudo mkdir /tmp/d while true; do sudo mount -o loop some_cd_image.iso /tmp/d; sudo umount /tmp/d; done This reproduces the crash eventually.
Created attachment 210445 [details] [review] reproducer This reproducer is a bit more elaborate.
Created attachment 210454 [details] [review] Fix crash when devices disappear during gdu_pool_new() Another case of "an hour to understand/reproduce the problem, a minute to fix"... With this the extended reproducer with the endless mount/unmount loop now runs indefinitely without crashing, so the followup code in gdu_pool_new() seems to handle this fine.
This bug predates gnome-disk-utility 3.4 where everything was rewritten to use udisks2 and GDBus. Closing.