gphoto / libgphoto2

The libgphoto2 camera access and control library.
GNU Lesser General Public License v2.1
1.06k stars 325 forks source link

Segmentation fault in print-camera-list #777

Open Keruspe opened 2 years ago

Keruspe commented 2 years ago

Describe the bug

No matter how print-camera-list is invoked, it will segfault.

Name the camera

No camera involved

libgphoto2 and gphoto2 version

2.5.29

To Reproduce Steps to reproduce the behavior:

Launch e.g. /usr/lib/libgphoto2/print-camera-list human-readable Expected output appears, then Segmentation fault (core dumped)

Backtrace is not really helpful:

(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007f974caacd24 in _dl_fini () from /usr/x86_64-pc-linux-gnu/lib/ld-linux-x86-64.so.2
#2  0x00007f974c848c78 in __run_exit_handlers () from /usr/x86_64-pc-linux-gnu/lib/libc.so.6
#3  0x00007f974c848d7e in exit () from /usr/x86_64-pc-linux-gnu/lib/libc.so.6
#4  0x00007f974c831655 in __libc_start_call_main () from /usr/x86_64-pc-linux-gnu/lib/libc.so.6
#5  0x00007f974c831709 in __libc_start_main () from /usr/x86_64-pc-linux-gnu/lib/libc.so.6
#6  0x0000000000204c05 in _start ()

Removing the latest call to lt_dlexit and the cal to lt_dlclose withing the valgrind check inside libgphoto2/gphoto2-abilities-list.c "fixes" the problem. (both are needed, removing only one of those two doesn't change a thing)

msmeissn commented 2 years ago

it kind of weird, i cannot reproduce this on my side.

is it outputting cameras, or just crashing?

is gphoto2 --list-cameras working?

Keruspe commented 2 years ago

It prints the cameras then crashes, when glibc calls all the cleanup stuff at the end of execution, from what I get

Keruspe commented 2 years ago

I do not have gphoto2 installed but I can try.

I also can try adding some kind of sleep right at the end of print-camera-list to make sure it crashes after that indeed

msmeissn commented 2 years ago

its weird, it is a NULL pointer dereference on exit, but its not clear where it might come from.

run LD_DEBUG=all /usr/lib/libgphoto2/print-camera-list human-readable >logfile 2>&1

so we can see in which destructor it crashes

Keruspe commented 2 years ago

End of output without LD_DEBUG:

2606|ptp2                |PTP                 |Zuk Z2 Pro
---+--------------------+--------------------+-------------------------------------------
No.|camlib              |driver name         |camera model
zsh: segmentation fault (core dumped)  /usr/lib/libgphoto2/print-camera-list human-readable

With what you asked:

keruspe@Lou ~ % LD_DEBUG=all /usr/lib/libgphoto2/print-camera-list human-readable >logfile 2>&1                     
zsh: segmentation fault (core dumped)  LD_DEBUG=all /usr/lib/libgphoto2/print-camera-list human-readable > logfile 2

End of logfile:

2592|ptp2                |PTP                 |ZiiLABS Zii EGG
2593|digigr8              229798:       symbol=gp_abilities_list_free;  lookup in file=/usr/lib/libgphoto2/print-camera-list [0]
    229798:     symbol=gp_abilities_list_free;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]
    229798:     binding file /usr/lib/libgphoto2/print-camera-list [0] to /usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]: normal symbol `gp_abilities_list_free'
    229798:
    229798:     calling fini: /usr/lib/libgphoto2/print-camera-list [0]
    229798:
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/lib/libgphoto2/print-camera-list [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2_port.so.12 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]
    229798:     binding file /usr/lib/libgphoto2/print-camera-list [0] to /usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]: normal symbol `__cxa_finalize' [GLIBC_2.2.5]
    229798:
    229798:     calling fini: /usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]
    229798:
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/lib/libgphoto2/print-camera-list [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2_port.so.12 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]
    229798:     binding file /usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0] to /usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]: normal symbol `__cxa_finalize' [GLIBC_2.2.5]
    229798:
    229798:     calling fini: /usr/x86_64-pc-linux-gnu/lib/libgphoto2_port.so.12 [0]
    229798:
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/lib/libgphoto2/print-camera-list [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2_port.so.12 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]
    229798:     binding file /usr/x86_64-pc-linux-gnu/lib/libgphoto2_port.so.12 [0] to /usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]: normal symbol `__cxa_finalize' [GLIBC_2.2.5]
    229798:
    229798:     calling fini: /usr/x86_64-pc-linux-gnu/lib/libltdl.so.7 [0]
    229798:
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/lib/libgphoto2/print-camera-list [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2_port.so.12 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]
    229798:     binding file /usr/x86_64-pc-linux-gnu/lib/libltdl.so.7 [0] to /usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]: normal symbol `__cxa_finalize' [GLIBC_2.2.5]
    229798:
    229798:     calling fini: /usr/x86_64-pc-linux-gnu/lib/libexif.so.12 [0]
    229798:
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/lib/libgphoto2/print-camera-list [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2_port.so.12 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]
    229798:     binding file /usr/x86_64-pc-linux-gnu/lib/libexif.so.12 [0] to /usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]: normal symbol `__cxa_finalize' [GLIBC_2.2.5]
    229798:
    229798:     calling fini: /usr/x86_64-pc-linux-gnu/lib/libm.so.6 [0]
    229798:
    229798:
    229798:     calling fini: /usr/x86_64-pc-linux-gnu/lib/libdl.so.2 [0]
    229798:
    229798:
    229798:     calling fini: /usr/x86_64-pc-linux-gnu/lib/libglib-2.0.so.0 [0]
    229798:
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/lib/libgphoto2/print-camera-list [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2_port.so.12 [0]
    229798:     symbol=__cxa_finalize;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]
    229798:     binding file /usr/x86_64-pc-linux-gnu/lib/libglib-2.0.so.0 [0] to /usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]: normal symbol `__cxa_finalize' [GLIBC_2.2.5]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/lib/libgphoto2/print-camera-list [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2.so.6 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libgphoto2_port.so.12 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libltdl.so.7 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libexif.so.12 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libm.so.6 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/ld-linux-x86-64.so.2 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libdl.so.2 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libglib-2.0.so.0 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libpcre.so.1 [0]
    229798:     symbol=__deregister_frame_info;  lookup in file=/usr/x86_64-pc-linux-gnu/lib/libc.so.6 [0]
Keruspe commented 2 years ago

Just to double confirm I added a sleep after the call to iterate_camera_list, before returning. I crashes after the sleep, so it really is during final cleanup

Keruspe commented 2 years ago

Valgrind take on this:

==269402== Jump to the invalid address stated on the next line
==269402==    at 0x0: ???
==269402==    by 0x493AC77: __run_exit_handlers (in /usr/x86_64-pc-linux-gnu/lib/libc.so.6)
==269402==    by 0x493AD7D: exit (in /usr/x86_64-pc-linux-gnu/lib/libc.so.6)
==269402==    by 0x4923654: (below main) (in /usr/x86_64-pc-linux-gnu/lib/libc.so.6)
==269402==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==269402== 
==269402== 
==269402== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==269402==  Bad permissions for mapped region at address 0x0
==269402==    at 0x0: ???
==269402==    by 0x493AC77: __run_exit_handlers (in /usr/x86_64-pc-linux-gnu/lib/libc.so.6)
==269402==    by 0x493AD7D: exit (in /usr/x86_64-pc-linux-gnu/lib/libc.so.6)
==269402==    by 0x4923654: (below main) (in /usr/x86_64-pc-linux-gnu/lib/libc.so.6)
==269402== 
==269402== HEAP SUMMARY:
==269402==     in use at exit: 33,207 bytes in 44 blocks
==269402==   total heap usage: 1,471 allocs, 1,427 frees, 95,060,022 bytes allocated
==269402== 
==269402== LEAK SUMMARY:
==269402==    definitely lost: 0 bytes in 0 blocks
==269402==    indirectly lost: 0 bytes in 0 blocks
==269402==      possibly lost: 4,608 bytes in 2 blocks
==269402==    still reachable: 28,599 bytes in 42 blocks
==269402==         suppressed: 0 bytes in 0 blocks
==269402== Rerun with --leak-check=full to see details of leaked memory
==269402== 
==269402== For lists of detected and suppressed errors, rerun with: -s
==269402== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
msmeissn commented 2 years ago

one ting for me is that I am not linking against glib2 on my system, and this is the last destructor chain to get called

229798:     calling fini: /usr/x86_64-pc-linux-gnu/lib/libglib-2.0.so.0 [0]

any idea how you get libglib2 linked and by which component of libgphoto2?

Keruspe commented 2 years ago

Oh, interresting! Let's go up the chain of dependencies

file=libglib-2.0.so.0 [0];  needed by /usr/x86_64-pc-linux-gnu/lib/libharfbuzz.so.0 [0] 
file=libharfbuzz.so.0 [0];  needed by /usr/x86_64-pc-linux-gnu/lib/libfreetype.so.6 [0]
file=libfreetype.so.6 [0];  needed by /usr/x86_64-pc-linux-gnu/lib/libgd.so.3 [0]
file=libgd.so.3 [0];  needed by /usr/x86_64-pc-linux-gnu/lib/libgphoto2/2.5.29/ax203.so [0] 
Keruspe commented 2 years ago

Rebuilding freetype with harfbuzz disabled for testing, the last fini called is now from libssl, because of curl, because of the lumix module, and still the same problem, so glib wasn't the culprit

Keruspe commented 2 years ago

Just tried out gphoto2 --list-cameras and it hits the same thing

msmeissn commented 2 years ago

hmm, my libgd is not linked against harfbuzz and glib2 , this is probably why it so far does not reproduce for me. i will need to try this on my side :/ until then you could remove the ax203.so file if you do not use this picture frame to make your setup work as a workaround

archerallstars commented 2 years ago

I am also having this issue on Fedora 36 (libgphoto2 2.5.30).

gphoto2 --auto-detect detect my camera model correctly (Olympus E-M1)

gphoto2 --abilities run fine. But gphoto2 --summary returns Segmentation fault (core dumped).

And downgrading to the latest working version (libgphoto2 2.5.27) is not possible on fedora, since only libgphoto2 2.5.29 is available for downgrading. Therefore, I can't use my camera as my webcam in Fedora 36 at all. On Ubuntu 22.04 LTS, libgphoto2 is still at 2.5.27, so it's working fine.

Please fix this, thanks.

msmeissn commented 2 years ago

This crash might be unrelated

can you try this in gdb?

gdb gphoto2 r --summary (should crash) bt

archerallstars commented 2 years ago

This is my return from running the gdb:

$ gdb gphoto2
GNU gdb (GDB) Fedora 12.1-1.fc36
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from gphoto2...

This GDB supports auto-downloading debuginfo from the following URLs:
https://debuginfod.fedoraproject.org/ 
Enable debuginfod for this session? (y or [n]) y
Debuginfod has been enabled.
To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit.
Downloading 0.35 MB separate debug info for /home/archerallstars/gphoto2
Reading symbols from /home/archerallstars/.cache/debuginfod_client/c9e7df8eeb36c2179106eb32d978d83698cd9884/debuginfo...
(gdb) r --summary
Starting program: /usr/bin/gphoto2 --summary
Downloading 0.03 MB separate debug info for system-supplied DSO at 0x7ffff7fc4000
Downloading 0.38 MB separate debug info for /lib64/libgphoto2.so.6             
Downloading 0.07 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/ed48b0ecf0bedcf6f2a4fe2e5d2e107d62cec66f/debuginfo
Downloading 0.11 MB separate debug info for /lib64/libgphoto2_port.so.12       
Downloading 0.49 MB separate debug info for /lib64/libexif.so.12               
Downloading 0.95 MB separate debug info for /lib64/libreadline.so.8            
Downloading 0.02 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/524a24317a37b45b87ba67e30845656ef9ce3476/debuginfo
Downloading 0.18 MB separate debug info for /lib64/libpopt.so.0                
Downloading 0.39 MB separate debug info for /lib64/libgcc_s.so.1               
Downloading 40.56 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/1e82df1fa0e0de4d8382b75c0fa730e0672f1a47/debuginfo
Downloading 7.41 MB separate debug info for /lib64/libc.so.6                   
[Thread debugging using libthread_db enabled]                                  
Using host libthread_db library "/lib64/libthread_db.so.1".
Downloading 0.12 MB separate debug info for /lib64/libltdl.so.7
Downloading 2.25 MB separate debug info for /lib64/libm.so.6                   
Downloading 0.38 MB separate debug info for /lib64/libtinfo.so.6               
Downloading 0.20 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/954d12f7d8216fde821db122a4768ee255382a63/debuginfo
Downloading 0.03 MB separate debug info for /usr/lib64/libgphoto2_port/0.12.1/disk.so
Downloading 0.01 MB separate debug info for /usr/lib64/libgphoto2_port/0.12.1/ptpip.so
Downloading 0.04 MB separate debug info for /usr/lib64/libgphoto2_port/0.12.1/serial.so
Downloading 0.05 MB separate debug info for /lib64/liblockdev.so.1             
Downloading 0.01 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/70e1cbaa5f99ef4b1c4442bcaac954dd5bc82121/debuginfo
Downloading 0.09 MB separate debug info for /usr/lib64/libgphoto2_port/0.12.1/usb1.so
Downloading 0.40 MB separate debug info for /lib64/libusb-1.0.so.0             
Downloading 0.01 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/d2c387b3f8505ddfc3c28f3e495f5d633c179cb4/debuginfo
Downloading 1.15 MB separate debug info for /lib64/libudev.so.1                
Downloading 2.98 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/002cce667c466b2f92130c99f55d21afa5669636/debuginfo
[New Thread 0x7fffea4fd640 (LWP 15841)]                                        
[Thread 0x7fffea4fd640 (LWP 15841) exited]
Downloading 0.04 MB separate debug info for /usr/lib64/libgphoto2_port/0.12.1/usbdiskdirect.so
Downloading 0.04 MB separate debug info for /usr/lib64/libgphoto2_port/0.12.1/usbscsi.so
Downloading 0.17 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/ax203.so
Downloading 0.90 MB separate debug info for /lib64/libgd.so.3                  
Downloading 0.91 MB separate debug info for /lib64/libjpeg.so.62               
Downloading 0.15 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/efe241196bd7d87a220b593b4aac911a1245eaa0/debuginfo
Downloading 0.83 MB separate debug info for /lib64/libpng16.so.16              
Downloading 0.24 MB separate debug info for /lib64/libz.so.1                   
Downloading 1.19 MB separate debug info for /lib64/libfontconfig.so.1          
Downloading 3.16 MB separate debug info for /lib64/libfreetype.so.6            
Downloading 0.09 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/2ca382240234988782dd8feef8b2a177967910f7/debuginfo
Downloading 0.26 MB separate debug info for /lib64/libimagequant.so.0          
Downloading 0.25 MB separate debug info for /lib64/libXpm.so.4                 
Downloading 0.00 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/55b8f1686b61b8d72ad1d4c2e9af481efb49dea7/debuginfo
Downloading 3.69 MB separate debug info for /lib64/libX11.so.6
Downloading 1.18 MB separate debug info for /lib64/libtiff.so.5                
Downloading 0.02 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/f02cf1e6081a6eb6c45c79daa283db3ada4c3801/debuginfo
Downloading 2.66 MB separate debug info for /lib64/libwebp.so.7                
Downloading 0.19 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/2c54c9e8f4698afb2a100e7ade767f48442eefde/debuginfo
Downloading 0.60 MB separate debug info for /lib64/libavif.so.13               
Downloading 0.04 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/5378d6eebff66b7270524fe25ec8fa4ed80607fa/debuginfo
Downloading 4.77 MB separate debug info for /lib64/libxml2.so.2                
Downloading 0.17 MB separate debug info for /lib64/libbz2.so.1                 
Downloading 0.00 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/c2d7b7c31b12cc8cccfbd50e47b99a6be56a764a/debuginfo
Downloading 13.91 MB separate debug info for /lib64/libharfbuzz.so.0           
Downloading 2.75 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/96e1e9d7ccc1f33228faa8703a1f0e21de81140b/debuginfo
Downloading 0.18 MB separate debug info for /lib64/libbrotlidec.so.1           
Downloading 1.06 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/2b6d234b851d7a75196b6e8895a24830a14f2f9c/debuginfo
Downloading 0.87 MB separate debug info for /lib64/libgomp.so.1                
Downloading 0.80 MB separate debug info for /lib64/libxcb.so.1                 
Downloading 4.38 MB separate debug info for /lib64/libzstd.so.1                
Downloading 0.25 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/e9ef04083d00304da3a4e6638d4d21cf65518077/debuginfo
Downloading 0.04 MB separate debug info for /lib64/libjbig.so.2.1              
Downloading 0.01 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/208c20ec20c71e7cce019a94027f0c811f89fdba/debuginfo
Downloading 2.73 MB separate debug info for /lib64/libdav1d.so.5               
Downloading 22.95 MB separate debug info for /lib64/librav1e.so.0              
Downloading 1.33 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/57d619231c0442571076f460b0154466a0599882/debuginfo
Downloading 28.53 MB separate debug info for /lib64/libSvtAv1Enc.so.0          
Downloading 0.97 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/c21f1687122e58efa148717300f02c0d5b6fc1e7/debuginfo
Downloading 29.81 MB separate debug info for /lib64/libaom.so.3                
Error while reading shared library symbols for /lib64/libaom.so.3:             
could not find '.gnu_debugaltlink' file for /home/archerallstars/.cache/debuginfod_client/4c3490eb29665a78fe6cdecd447e28068a183e8d/debuginfo
Downloading 0.68 MB separate debug info for /lib64/liblzma.so.5
Downloading 3.37 MB separate debug info for /lib64/libglib-2.0.so.0            
Downloading 0.30 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/8a4c270219135729dff508e4bb3cc03099af40e8/debuginfo
Downloading 1.13 MB separate debug info for /lib64/libgraphite2.so.3           
Downloading 0.03 MB separate debug info for /lib64/libbrotlicommon.so.1        
Downloading 0.01 MB separate debug info for /lib64/libXau.so.6                 
Downloading 31.50 MB separate debug info for /lib64/libjxl.so.0.6              
Downloading 13.92 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/fca42c2b5d2803e4eaf4bd81b332eb534f134b00/debuginfo
Downloading 1.49 MB separate debug info for /lib64/libvmaf.so.1                
Downloading 1.23 MB separate debug info for /lib64/libpcre.so.1                
Downloading 0.05 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/f43c7764ef0aee86ce7adf313b31abe6d80d9c84/debuginfo
Downloading 1.44 MB separate debug info for /lib64/libbrotlienc.so.1           
Downloading 14.72 MB separate debug info for /lib64/libstdc++.so.6             
Error while reading shared library symbols for /lib64/libaom.so.3:             
could not find '.gnu_debugaltlink' file for /home/archerallstars/.cache/debuginfod_client/4c3490eb29665a78fe6cdecd447e28068a183e8d/debuginfo
Downloading 0.30 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/canon.so
Downloading 0.06 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/digigr8.so
Downloading 0.10 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/dimagev.so
Downloading 0.06 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/directory.so
Downloading 0.08 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/docupen.so
Error while reading shared library symbols for /lib64/libaom.so.3:             
could not find '.gnu_debugaltlink' file for /home/archerallstars/.cache/debuginfod_client/4c3490eb29665a78fe6cdecd447e28068a183e8d/debuginfo
Error while reading shared library symbols for /lib64/libaom.so.3:
could not find '.gnu_debugaltlink' file for /home/archerallstars/.cache/debuginfod_client/4c3490eb29665a78fe6cdecd447e28068a183e8d/debuginfo
Downloading 0.05 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/jl2005a.so
Downloading 0.07 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/jl2005c.so
Downloading 0.07 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/kodak_dc240.so
Downloading 0.10 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/lumix.so
Downloading 2.49 MB separate debug info for /lib64/libcurl.so.4                
Downloading 0.24 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/862436e30cb8efb8cf021190ac99fc7793b01aed/debuginfo
Downloading 0.63 MB separate debug info for /lib64/libnghttp2.so.14            
Downloading 0.79 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/51af3b22005a7056f631c4e4ea18cd85b8db1da5/debuginfo
Downloading 0.13 MB separate debug info for /lib64/libidn2.so.0                
Downloading 0.02 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/31116a5550f05753b609b4d16b7cce7807396e14/debuginfo
Downloading 1.66 MB separate debug info for /lib64/libssh.so.4                 
Downloading 0.08 MB separate debug info for /lib64/libpsl.so.5                 
Downloading 0.00 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/6c0cf7ed0ae68dfd766f9b51f0fafec148f26f48/debuginfo
Downloading 1.80 MB separate debug info for /lib64/libssl.so.3                 
Downloading 0.57 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/6579b77c6bcb99daa252d7c651fff63e3d12217d/debuginfo
Downloading 12.12 MB separate debug info for /lib64/libcrypto.so.3             
Downloading 1.33 MB separate debug info for /lib64/libgssapi_krb5.so.2         
Downloading 0.19 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/b44232cdad1cf5e75b4a40b06fd589cf08365891/debuginfo
Downloading 1.03 MB separate debug info for /lib64/libldap.so.2                
Downloading 0.18 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/049c2def9cbc09bea339c5a737ba0574a636ffbf/debuginfo
Downloading 0.15 MB separate debug info for /lib64/liblber.so.2                
Downloading 1.74 MB separate debug info for /lib64/libunistring.so.2           
Downloading 2.64 MB separate debug info for /lib64/libkrb5.so.3                
Downloading 0.34 MB separate debug info for /lib64/libk5crypto.so.3            
Downloading 0.04 MB separate debug info for /lib64/libcom_err.so.2             
Downloading 0.13 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/c980b4303c51332b16b98f799a158445eae81aa0/debuginfo
Downloading 0.19 MB separate debug info for /lib64/libkrb5support.so.0         
Downloading 0.06 MB separate debug info for /lib64/libkeyutils.so.1            
Downloading 0.00 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/da9c7ac09e992ba7c560d8fda4279f6d29a62022/debuginfo
Downloading 0.18 MB separate debug info for /lib64/libresolv.so.2
Downloading 0.43 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/713ba3f926c7871b63a0792640f046ff51837297/debuginfo
Downloading 1.20 MB separate debug info for /lib64/libevent-2.1.so.7           
Downloading 0.17 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/f6e4e70b6ca6ab522b59e089c865e1a33d3760bf/debuginfo
Downloading 0.37 MB separate debug info for /lib64/libsasl2.so.3               
Downloading 0.04 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/db4b190f8f8dc222aebeb2b42905d93204f8aeb8/debuginfo
Downloading 0.65 MB separate debug info for /lib64/libselinux.so.1             
Downloading 0.08 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/9ee47929aa5779a0fe6469346be26bfa6426a516/debuginfo
Downloading 0.46 MB separate debug info for /lib64/libcrypt.so.2               
Downloading 0.06 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/9924d3a82ca8fa6b94bc574a6520bcf84ccf831f/debuginfo
Downloading 1.40 MB separate debug info for /lib64/libpcre2-8.so.0             
Downloading 0.07 MB separate debug info for /home/archerallstars/.cache/debuginfod_client/0d207ce0c9db9ba59d4a8264b95c5ebf3ddec190/debuginfo
Downloading 0.06 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/mars.so
Downloading 0.20 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/pentax.so
Downloading 1.88 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/ptp2.so
Downloading 0.02 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/ricoh_g3.so
Downloading 0.22 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/sierra.so
Downloading 0.07 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/sonix.so
Downloading 0.06 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/sq905.so
Downloading 0.11 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/st2205.so
Error while reading shared library symbols for /lib64/libaom.so.3:             
could not find '.gnu_debugaltlink' file for /home/archerallstars/.cache/debuginfod_client/4c3490eb29665a78fe6cdecd447e28068a183e8d/debuginfo
Error while reading shared library symbols for /lib64/libaom.so.3:
could not find '.gnu_debugaltlink' file for /home/archerallstars/.cache/debuginfod_client/4c3490eb29665a78fe6cdecd447e28068a183e8d/debuginfo
Downloading 0.09 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/topfield.so
Downloading 0.03 MB separate debug info for /usr/lib64/libgphoto2/2.5.30/tp6801.so
Error while reading shared library symbols for /lib64/libaom.so.3:             
could not find '.gnu_debugaltlink' file for /home/archerallstars/.cache/debuginfod_client/4c3490eb29665a78fe6cdecd447e28068a183e8d/debuginfo
Error while reading shared library symbols for /lib64/libaom.so.3:
could not find '.gnu_debugaltlink' file for /home/archerallstars/.cache/debuginfod_client/4c3490eb29665a78fe6cdecd447e28068a183e8d/debuginfo
[New Thread 0x7fffea4fd640 (LWP 16157)]                                         
[Thread 0x7fffea4fd640 (LWP 16157) exited]
[New Thread 0x7fffea4fd640 (LWP 16158)]
[Thread 0x7fffea4fd640 (LWP 16158) exited]
[New Thread 0x7fffea4fd640 (LWP 16159)]
[Thread 0x7fffea4fd640 (LWP 16159) exited]
[New Thread 0x7fffea4fd640 (LWP 16160)]
[Thread 0x7fffea4fd640 (LWP 16160) exited]
[New Thread 0x7fffea4fd640 (LWP 16161)]

Thread 1 "gphoto2" received signal SIGSEGV, Segmentation fault.
0x00007ffff7cbcd15 in __GI__IO_default_xsputn (n=<optimized out>, data=<optimized out>, f=<optimized out>) at genops.c:394
Downloading 0.01 MB source file /usr/src/debug/glibc-2.35-15.fc36.x86_64/libio/genops.c
394         *p++ = *s++;
(gdb) bt
#0  0x00007ffff7cbcd15 in __GI__IO_default_xsputn (n=<optimized out>, data=<optimized out>, f=<optimized out>) at genops.c:394
#1  __GI__IO_default_xsputn (f=0x7fffffff2b00, data=<optimized out>, n=3) at genops.c:370
#2  0x00007ffff7ca66d2 in outstring_func (done=0, length=<optimized out>, string=<optimized out>, s=0x7fffffff2b00) at ../libio/libioP.h:947
#3  __vfprintf_internal (s=s@entry=0x7fffffff2b00, format=format@entry=0x7fffe9c90bc5 "%u", ap=ap@entry=0x7fffffff2c80, mode_flags=mode_flags@entry=2)
    at vfprintf-internal.c:1516
#4  0x00007ffff7cb806c in __vsnprintf_internal (string=0x7fffffffeffe "14"<error: Cannot access memory at address 0x7ffffffff000>, maxlen=<optimized out>, 
    format=0x7fffe9c90bc5 "%u", args=args@entry=0x7fffffff2c80, mode_flags=2) at vsnprintf.c:114
#5  0x00007ffff7d55434 in ___snprintf_chk (s=<optimized out>, maxlen=<optimized out>, flag=<optimized out>, slen=<optimized out>, format=<optimized out>)
    at snprintf_chk.c:38
#6  0x00007fffe9c48542 in snprintf_ptp_property (txt=0x7fffffffeffe "14"<error: Cannot access memory at address 0x7ffffffff000>, spaceleft=<optimized out>, 
    data=0x7fffffff2de8, dt=<optimized out>) at ptp2/library.c:7323
#7  0x00007fffe9c49c75 in camera_summary (camera=<optimized out>, summary=<optimized out>, context=0x55555557b1d0) at ptp2/library.c:7819
#8  0x00007ffff7f2afcb in gp_camera_get_summary (camera=0x555555579460, summary=summary@entry=0x7fffffff2f50, context=0x55555557b1d0)
    at /usr/src/debug/libgphoto2-2.5.30-2.fc36.x86_64/libgphoto2/gphoto2-camera.c:1228
#9  0x000055555556ab94 in action_camera_summary.isra.0 (params=<optimized out>) at /usr/src/debug/gphoto2-2.5.27-3.fc36.x86_64/gphoto2/actions.c:827
#10 0x3334322c3639312c in ?? ()
#11 0x2c3337312c37352c in ?? ()
#12 0x2c3630312c393431 in ?? ()
#13 0x2c3533312c303831 in ?? ()
#14 0x322c39322c393231 in ?? ()
#15 0x33312c39392c3732 in ?? ()
#16 0x322c312c38352c36 in ?? ()
#17 0x3239312c33382c39 in ?? ()
#18 0x2c38342c3132312c in ?? ()
#19 0x2c3733322c313332 in ?? ()
#20 0x39312c34342c3039 in ?? ()
#21 0x32332c3135312c38 in ?? ()
#22 0x37312c30332c352c in ?? ()
#23 0x3332322c3035322c in ?? ()
#24 0x3035322c3935312c in ?? ()
#25 0x2c3930322c31362c in ?? ()
#26 0x312c32382c343432 in ?? ()
#27 0x34352c32352c3030 in ?? ()
#28 0x2c3230312c32342c in ?? ()
msmeissn commented 2 years ago

can you in this backtrace, do

frame 8 print *summary

(Likely crash reason is that there is a static buffer, we have some buffer overflow checking, but here it seems to be buggy and the buffer actually overflows.)

archerallstars commented 2 years ago

Hi, here is my returns:

(gdb) frame 8
#8  0x00007ffff7f2afcb in gp_camera_get_summary (camera=0x555555579460, summary=summary@entry=0x7fffffff2f50, context=0x55555557b1d0)
    at /usr/src/debug/libgphoto2-2.5.30-2.fc36.x86_64/libgphoto2/gphoto2-camera.c:1228
Downloading 0.05 MB source file /usr/src/debug/libgphoto2-2.5.30-2.fc36.x86_64/libgphoto2/gphoto2-camera.c
1228            CHECK_RESULT_OPEN_CLOSE (camera, camera->functions->summary (camera,                                                                         
(gdb) print *summary
$1 = {
  text = "Manufacturer: OLYMPUS\nModel: E-M1\n  Version: 1.00\n  Serial Number: BFJ211600\nVendor Extension ID: 0xfffd (1.0)\nVendor Extension Description: \n\nCapture Formats: MS Wave MS AVI Unknown(b980) Defined Typ"...}

EDIT: I also tested by downgrading libgphoto2 to 2.5.27-2.fc35.x86_64, which I got from here. It's belonged to Fedora 35, but I can use it without any issue.

I did sudo dnf install ./libgphoto2-2.5.27-2.fc35.x86_64.rpm in my download location.

It seems this issue is really from libgphoto2's version. This is also reported in Darktable issue #11656. Anything above 2.5.28 will crash.

viviicat commented 2 years ago

I am still having this issue. I attempted to do a git-bisect to figure out what commit caused the issue, but had difficulty doing so. And unfortunately debugging with GDB did not prove very useful due to the aforementioned issues.

This is causing me a lot of problems here on Gentoo.

ndim commented 1 year ago

I have tried to reproduce the segfault on Fedora 37 by running print-camera-list from git HEAD. My libgd.so.3 is linked against libfreetype.so.6, libharfbuzz.so.0, and libglib-2.0.so.0 - but I cannot see any segfaults. What I do see, however, is when I run

valgrind --leak-check=full --show-leak-kinds=all -s /prefix/lib/libgphoto2/print-camera-list human-readable

there are a few memory leaks:

=443413== LEAK SUMMARY:
==443413==    definitely lost: 512 bytes in 16 blocks
==443413==    indirectly lost: 0 bytes in 0 blocks
==443413==      possibly lost: 0 bytes in 0 blocks
==443413==    still reachable: 108,415 bytes in 42 blocks
==443413==         suppressed: 0 bytes in 0 blocks
==443413== 
==443413== ERROR SUMMARY: 12 errors from 12 contexts (suppressed: 0 from 0)

Note that this is libgphoto2 compiled with --with-camlibs=everything, so there are more camlibs being loaded than in a default build.

Maybe I need to set up a VM running Gentoo. But then I am running Fedora 37, and there are reports from F35 and F36 with segfaults, so perhaps I should see the segfaults here as well?

viviicat commented 1 year ago

When I have a moment, I will try to provide the full log including compile flags and link details, in case that helps.

Please let me know if there is any specific additional info I can provide, debugging operations to perform, or a better way to nail down a repro.

msmeissn commented 1 year ago

we might have overrun the fixed length buffer in the summary code still. The logic seems fine in the code.

This part seems to underline it: (there is no leading \0 but we cross a page boundary which is not allocated. (txt=0x7fffffffeffe "14"<error: Cannot access memory at address 0x7ffffffff000>

viviicat commented 1 year ago

I get this too when running --camera="Canon EOS 90D" --capture-image-and-download.

So I wonder if it really is the summary code, does that code path get run with this set of args as well?

viviicat commented 1 year ago

Good news. If I force the CAMERAS flags to be just "canon", I am able to build successfully. This suggests to me that it is one of the cameras. I will try to do a binary search to figure out which camera it might be.

viviicat commented 1 year ago

This is strange. If I enable all cameras, I get the crash. If I remove one camera (and it doesn't seem to matter which!) it does not crash.

Perhaps there is a buffer affected by the number of cameras that is overflowing.

viviicat commented 1 year ago

I was able to reproduce this with both gcc and clang. However when I enabled ASAN -fsanitize=address in an attempt to catch the error in action, it no longer produced an error at all. So that's a bit odd.

Let me know if someone has an idea for further experiements to narrow this down.

msmeissn commented 1 year ago

fwiw the crash was in the ptp2 driver. anything if you run it with valgrind build with -DVALGRIND in cflags before

msmeissn commented 1 year ago

if you get a crash with the --camera "Canon ..." line, can you also get this in gdb?

this definitely is weird.

viviicat commented 1 year ago

Note that the error about "the camera cannot capture" is what I would expect as the camera is not actually attached right now (that doesn't seem to make a difference on whether the crash happens)

My valgrind with the canon options and built with -DVALGRIND

└─⦅ valgrind --leak-check=full gphoto2 --debug --debug-logfile=my-logfile.txt --camera="Canon EOS 90D" --capture-image-and-download
==1366703== Memcheck, a memory error detector
==1366703== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==1366703== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info
==1366703== Command: gphoto2 --debug --debug-logfile=my-logfile.txt --camera=Canon\ EOS\ 90D --capture-image-and-download
==1366703== 

*** Error ***              
This camera can not capture.
ERROR: Could not capture image.
ERROR: Could not capture.
*** Error (-6: 'Unsupported operation') ***       

==1366703== Jump to the invalid address stated on the next line
==1366703==    at 0x0: ???
==1366703==    by 0x4C7F677: __run_exit_handlers (in /lib64/libc.so.6)
==1366703==    by 0x4C7F779: exit (in /lib64/libc.so.6)
==1366703==    by 0x4C68358: (below main) (in /lib64/libc.so.6)
==1366703==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==1366703== 
==1366703== 
==1366703== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==1366703==  Bad permissions for mapped region at address 0x0
==1366703==    at 0x0: ???
==1366703==    by 0x4C7F677: __run_exit_handlers (in /lib64/libc.so.6)
==1366703==    by 0x4C7F779: exit (in /lib64/libc.so.6)
==1366703==    by 0x4C68358: (below main) (in /lib64/libc.so.6)
==1366703== 
==1366703== HEAP SUMMARY:
==1366703==     in use at exit: 131,150 bytes in 189 blocks
==1366703==   total heap usage: 39,798 allocs, 39,609 frees, 116,918,302 bytes allocated
==1366703== 
==1366703== 15 bytes in 1 blocks are definitely lost in loss record 8 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4B5BC22: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.1)
==1366703==    by 0x11D45D: main (main.c:2239)
==1366703== 
==1366703== 15 bytes in 1 blocks are definitely lost in loss record 9 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4B5BC22: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.1)
==1366703==    by 0x11D557: main (main.c:2277)
==1366703== 
==1366703== 15 bytes in 1 blocks are definitely lost in loss record 10 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4B5BC22: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.1)
==1366703==    by 0x11D586: main (main.c:2283)
==1366703== 
==1366703== 15 bytes in 1 blocks are definitely lost in loss record 11 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4B5BC22: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.1)
==1366703==    by 0x11D60C: main (main.c:2322)
==1366703== 
==1366703== 15 bytes in 1 blocks are definitely lost in loss record 12 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4B5BC22: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.1)
==1366703==    by 0x11DB1A: main (main.c:2323)
==1366703== 
==1366703== 15 bytes in 1 blocks are definitely lost in loss record 13 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4B5BC22: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.1)
==1366703==    by 0x11DB41: main (main.c:2324)
==1366703== 
==1366703== 15 bytes in 1 blocks are definitely lost in loss record 14 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4B5BC22: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.1)
==1366703==    by 0x11E596: main (main.c:2514)
==1366703== 
==1366703== 15 bytes in 1 blocks are definitely lost in loss record 15 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4B5BC22: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.1)
==1366703==    by 0x11EB88: main (main.c:2518)
==1366703== 
==1366703== 15 bytes in 1 blocks are definitely lost in loss record 16 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4B5BC22: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.1)
==1366703==    by 0x11EBF0: main (main.c:2550)
==1366703== 
==1366703== 320 bytes in 1 blocks are possibly lost in loss record 72 of 87
==1366703==    at 0x4848795: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x4010A92: allocate_dtv (in /lib64/ld-linux-x86-64.so.2)
==1366703==    by 0x401147D: _dl_allocate_tls (in /lib64/ld-linux-x86-64.so.2)
==1366703==    by 0x4CC9932: pthread_create@@GLIBC_2.34 (in /lib64/libc.so.6)
==1366703==    by 0x5598DD4: libusb_handle_events_timeout_completed (in /lib64/libusb-1.0.so.0.3.0)
==1366703==    by 0x5595818: libusb_get_config_descriptor (in /lib64/libusb-1.0.so.0.3.0)
==1366703==    by 0x558D5EB: ??? (in /lib64/libusb-1.0.so.0.3.0)
==1366703==    by 0x4903EA8: gp_port_library_list (libusb1.c:189)
==1366703==    by 0x48E5583: foreach_func (gphoto2-port-info-list.c:269)
==1366703==    by 0x491B710: ??? (in /usr/lib64/libltdl.so.7.3.2)
==1366703==    by 0x491BEF6: ??? (in /usr/lib64/libltdl.so.7.3.2)
==1366703==    by 0x491C2CB: lt_dlforeachfile (in /usr/lib64/libltdl.so.7.3.2)
==1366703== 
==1366703== 13,760 bytes in 4 blocks are possibly lost in loss record 86 of 87
==1366703==    at 0x4843724: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1366703==    by 0x400443B: _dl_find_object_update (in /lib64/ld-linux-x86-64.so.2)
==1366703==    by 0x400BBBF: dl_open_worker_begin (in /lib64/ld-linux-x86-64.so.2)
==1366703==    by 0x4D8DE67: _dl_catch_exception (in /lib64/libc.so.6)
==1366703==    by 0x400B05E: dl_open_worker (in /lib64/ld-linux-x86-64.so.2)
==1366703==    by 0x4D8DE67: _dl_catch_exception (in /lib64/libc.so.6)
==1366703==    by 0x400B45D: _dl_open (in /lib64/ld-linux-x86-64.so.2)
==1366703==    by 0x4CC4DB7: dlopen_doit (in /lib64/libc.so.6)
==1366703==    by 0x4D8DE67: _dl_catch_exception (in /lib64/libc.so.6)
==1366703==    by 0x4D8DF37: _dl_catch_error (in /lib64/libc.so.6)
==1366703==    by 0x4CC4885: _dlerror_run (in /lib64/libc.so.6)
==1366703==    by 0x4CC4E6F: dlopen@@GLIBC_2.34 (in /lib64/libc.so.6)
==1366703== 
==1366703== LEAK SUMMARY:
==1366703==    definitely lost: 135 bytes in 9 blocks
==1366703==    indirectly lost: 0 bytes in 0 blocks
==1366703==      possibly lost: 14,080 bytes in 5 blocks
==1366703==    still reachable: 116,923 bytes in 174 blocks
==1366703==         suppressed: 12 bytes in 1 blocks
==1366703== Reachable blocks (those to which a pointer was found) are not shown.
==1366703== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==1366703== 
==1366703== For lists of detected and suppressed errors, rerun with: -s
==1366703== ERROR SUMMARY: 12 errors from 12 contexts (suppressed: 0 from 0)
fish: Job 1, 'valgrind --leak-check=full gpho…' terminated by signal SIGSEGV (Address boundary error)

And here is the gdb output. I can try rebuilding glibc with debug symbols but currently do not have that.

(gdb) run
Starting program: /home/vv/.local/bin/gphoto2 --debug --debug-logfile=my-logfile.txt --camera=Canon\ EOS\ 90D --capture-image-and-download
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7ffff76466c0 (LWP 1367122)]                                                                                                     
[Thread 0x7ffff76466c0 (LWP 1367122) exited]
[New Thread 0x7ffff76466c0 (LWP 1367123)]
[Thread 0x7ffff76466c0 (LWP 1367123) exited]
[New Thread 0x7ffff76466c0 (LWP 1367124)]
[Thread 0x7ffff76466c0 (LWP 1367124) exited]
[New Thread 0x7ffff76466c0 (LWP 1367125)]
[Thread 0x7ffff76466c0 (LWP 1367125) exited]
[New Thread 0x7ffff76466c0 (LWP 1367126)]
[Thread 0x7ffff76466c0 (LWP 1367126) exited]

*** Error ***              
This camera can not capture.
ERROR: Could not capture image.
ERROR: Could not capture.
*** Error (-6: 'Unsupported operation') ***       

Thread 1 "gphoto2" received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff7fcf8a3 in _dl_fini () from /lib64/ld-linux-x86-64.so.2
#2  0x00007ffff7a3d678 in __run_exit_handlers () from /lib64/libc.so.6
#3  0x00007ffff7a3d77a in exit () from /lib64/libc.so.6
#4  0x00007ffff7a26359 in __libc_start_call_main () from /lib64/libc.so.6
#5  0x00007ffff7a2640c in __libc_start_main () from /lib64/libc.so.6
#6  0x000055555555aeb1 in _start ()
msmeissn commented 1 year ago

Ok, i got a bit confused between users. The issue from @viviicat is a atexit handler that is NULL.

The issue from @kreaninw is likely a buffer overrun due to Olympus having a very long MTP summary.

viviicat commented 1 year ago

And I believe my crash matches this particular issue's description, right?

msmeissn commented 1 year ago

yes, NULL ptr deref in atexit is the description one too. :/ need to think of more debugging ways

msmeissn commented 1 year ago

ok, bigger hammer. We run it in gdb, break at the atexit registering function and see what is getting registered

gdb gphoto2

break atexit break on_exit r --list-cameras run

use "continue" when you hit a break point until the program finishes.

we need all entries looking like: Breakpoint 1, atexit (func=func@entry=0x7ffff7174d7e ) at atexit.c:45 45 {

for me on openSUSE Tumbleweed it is only this one.

viviicat commented 1 year ago

I'm currently having trouble breaking at atexit and/or on_exit -- even though I've rebuilt glibc with debugging symbols it doesn't seem to be finding those functions to break at. Trying to figure out how to do that properly on Gentoo

viviicat commented 1 year ago

Okay if I break at __internal_atexit that works (presumably optimization happening).

However the function pointers passed in unfortunately do not have symbols, they're just raw function pointers:

(gdb) break __internal_atexit
Function "__internal_atexit" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 2 (__internal_atexit) pending.
(gdb) break __on_exit
Function "__on_exit" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 3 (__on_exit) pending.
(gdb) r --list-cameras
Starting program: /usr/bin/gphoto2 --list-cameras
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Breakpoint 2, __internal_atexit (func=0x7ffff7fce6e0 <_dl_fini>, arg=arg@entry=0x0, d=d@entry=0x0, listp=listp@entry=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) continue
Continuing.
Loading camera drivers from '/usr/lib64/libgphoto2/2.5.30'... |--------------------------------                                               \  40.0%          
Breakpoint 2, __internal_atexit (func=0x7ffff4e63450, arg=0x7ffff4fc7210, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) 
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4e63420, arg=0x7ffff4fc7208, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) 
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4e8ec00, arg=0x7ffff4fc71b0, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) 
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4e90c20, arg=0x7ffff4fc71c8, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) 
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4e90c30, arg=0x7ffff4fc71c0, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) 
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4f322e0, arg=0x7ffff4fc71e8, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) 
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4f322f0, arg=0x7ffff4fc71e0, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) 
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4f32300, arg=0x7ffff4fc71d8, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) 
Continuing.
Number of supported cameras: 2629                                                                                                                               
Supported cameras:
    " JL2005B/C/D camera" (EXPERIMENTAL)
    "A&K SE180"
    "A&K SR15"
    ...
viviicat commented 1 year ago

Here it is with me running a backtrace each time:

(gdb) r --list-cameras
Starting program: /usr/bin/gphoto2 --list-cameras
\[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Breakpoint 2, __internal_atexit (func=0x7ffff7fce6e0 <_dl_fini>, arg=arg@entry=0x0, d=d@entry=0x0, listp=listp@entry=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) bt
#0  __internal_atexit (func=0x7ffff7fce6e0 <_dl_fini>, arg=arg@entry=0x0, d=d@entry=0x0, listp=listp@entry=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
#1  0x00007ffff7af691c in __GI___cxa_atexit (func=<optimized out>, arg=arg@entry=0x0, d=d@entry=0x0) at cxa_atexit.c:70
#2  0x00007ffff7ae03aa in __libc_start_main_impl (main=0x55555556b37e <main>, argc=2, argv=0x7fffffffde18, init=0x0, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffffffde08) at ../csu/libc-start.c:333
#3  0x000055555555ae91 in _start ()
(gdb) continue
Continuing.
Loading camera drivers from '/usr/lib64/libgphoto2/2.5.30'... |--------------------------------                                               \  40.0%        5s
Breakpoint 2, __internal_atexit (func=0x7ffff4e63450, arg=0x7ffff4fc7210, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) bt
#0  __internal_atexit (func=0x7ffff4e63450, arg=0x7ffff4fc7210, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
#1  0x00007ffff4e61c9f in ?? () from /usr/lib/gcc/x86_64-pc-linux-gnu/11.3.0/libstdc++.so.6
#2  0x00007ffff7fceb2e in call_init (env=0x7fffffffde30, argv=0x7fffffffde18, argc=2, l=<optimized out>) at dl-init.c:70
#3  call_init (l=<optimized out>, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:26
#4  0x00007ffff7fcec14 in _dl_init (main_map=0x55555558b700, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:117
#5  0x00007ffff7bfeaad in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:182
#6  0x00007ffff7fd4e96 in dl_open_worker (a=a@entry=0x7fffffff13b0) at dl-open.c:808
#7  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#8  0x00007ffff7fd521b in _dl_open (file=<optimized out>, mode=-2147483647, caller_dlopen=0x7ffff7ab7457, nsid=-2, argc=2, argv=0x7fffffffde18, 
    env=0x7fffffffde30) at dl-open.c:884
#9  0x00007ffff7b3a9d8 in dlopen_doit (a=a@entry=0x7fffffff1620) at dlopen.c:56
#10 0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=exception@entry=0x7fffffff1580, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#11 0x00007ffff7bfeb0f in __GI__dl_catch_error (objname=0x7fffffff15d8, errstring=0x7fffffff15e0, mallocedp=0x7fffffff15d7, operate=<optimized out>, 
    args=<optimized out>) at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:227
#12 0x00007ffff7b3a4b6 in _dlerror_run (operate=operate@entry=0x7ffff7b3a980 <dlopen_doit>, args=args@entry=0x7fffffff1620) at dlerror.c:138
#13 0x00007ffff7b3aa91 in dlopen_implementation (dl_caller=<optimized out>, mode=<optimized out>, file=<optimized out>) at dlopen.c:71
#14 ___dlopen (file=<optimized out>, mode=<optimized out>) at dlopen.c:81
#15 0x00007ffff7ab7457 in ?? () from /usr/lib64/libltdl.so.7
#16 0x00007ffff7ab4098 in ?? () from /usr/lib64/libltdl.so.7
#17 0x00007ffff7ab5eb1 in ?? () from /usr/lib64/libltdl.so.7
#18 0x00007ffff7ab65cc in lt_dlopenadvise () from /usr/lib64/libltdl.so.7
#19 0x00007ffff7ab6691 in lt_dlopenext () from /usr/lib64/libltdl.so.7
#20 0x00007ffff7f0f33a in gp_abilities_list_load_dir (list=0x555555585830, dir=0x7ffff7f2f346 "/usr/lib64/libgphoto2/2.5.30", context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:243
#21 0x00007ffff7f0f736 in gp_abilities_list_load (list=0x555555585830, context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:341
#22 0x0000555555566358 in gp_params_abilities_list (p=0x555555580be0 <gp_params>) at gp-params.c:303
#23 0x000055555555e651 in list_cameras_action (p=0x555555580be0 <gp_params>) at actions.c:570
#24 0x000055555556a8f9 in cb_arg_run (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, params=0x7fffffffa634)
    at main.c:1672
#25 0x000055555556b174 in cb_arg (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, data=0x7fffffffa634) at main.c:1873
#26 0x00007ffff7d69de7 in ?? () from /usr/lib64/libpopt.so.0
#27 0x00007ffff7d69e76 in ?? () from /usr/lib64/libpopt.so.0
#28 0x00007ffff7d6b5e7 in poptGetNextOpt () from /usr/lib64/libpopt.so.0
#29 0x000055555556f5b7 in main (argc=2, argv=0x7fffffffde18, envp=0x7fffffffde30) at main.c:2550
(gdb) continue
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4e63420, arg=0x7ffff4fc7208, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) bt
#0  __internal_atexit (func=0x7ffff4e63420, arg=0x7ffff4fc7208, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
#1  0x00007ffff7fceb2e in call_init (env=0x7fffffffde30, argv=0x7fffffffde18, argc=2, l=<optimized out>) at dl-init.c:70
#2  call_init (l=<optimized out>, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:26
#3  0x00007ffff7fcec14 in _dl_init (main_map=0x55555558b700, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:117
#4  0x00007ffff7bfeaad in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:182
#5  0x00007ffff7fd4e96 in dl_open_worker (a=a@entry=0x7fffffff13b0) at dl-open.c:808
#6  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#7  0x00007ffff7fd521b in _dl_open (file=<optimized out>, mode=-2147483647, caller_dlopen=0x7ffff7ab7457, nsid=-2, argc=2, argv=0x7fffffffde18, 
    env=0x7fffffffde30) at dl-open.c:884
#8  0x00007ffff7b3a9d8 in dlopen_doit (a=a@entry=0x7fffffff1620) at dlopen.c:56
#9  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=exception@entry=0x7fffffff1580, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#10 0x00007ffff7bfeb0f in __GI__dl_catch_error (objname=0x7fffffff15d8, errstring=0x7fffffff15e0, mallocedp=0x7fffffff15d7, operate=<optimized out>, 
    args=<optimized out>) at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:227
#11 0x00007ffff7b3a4b6 in _dlerror_run (operate=operate@entry=0x7ffff7b3a980 <dlopen_doit>, args=args@entry=0x7fffffff1620) at dlerror.c:138
#12 0x00007ffff7b3aa91 in dlopen_implementation (dl_caller=<optimized out>, mode=<optimized out>, file=<optimized out>) at dlopen.c:71
#13 ___dlopen (file=<optimized out>, mode=<optimized out>) at dlopen.c:81
#14 0x00007ffff7ab7457 in ?? () from /usr/lib64/libltdl.so.7
#15 0x00007ffff7ab4098 in ?? () from /usr/lib64/libltdl.so.7
#16 0x00007ffff7ab5eb1 in ?? () from /usr/lib64/libltdl.so.7
#17 0x00007ffff7ab65cc in lt_dlopenadvise () from /usr/lib64/libltdl.so.7
#18 0x00007ffff7ab6691 in lt_dlopenext () from /usr/lib64/libltdl.so.7
#19 0x00007ffff7f0f33a in gp_abilities_list_load_dir (list=0x555555585830, dir=0x7ffff7f2f346 "/usr/lib64/libgphoto2/2.5.30", context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:243
#20 0x00007ffff7f0f736 in gp_abilities_list_load (list=0x555555585830, context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:341
#21 0x0000555555566358 in gp_params_abilities_list (p=0x555555580be0 <gp_params>) at gp-params.c:303
#22 0x000055555555e651 in list_cameras_action (p=0x555555580be0 <gp_params>) at actions.c:570
#23 0x000055555556a8f9 in cb_arg_run (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, params=0x7fffffffa634)
    at main.c:1672
#24 0x000055555556b174 in cb_arg (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, data=0x7fffffffa634) at main.c:1873
#25 0x00007ffff7d69de7 in ?? () from /usr/lib64/libpopt.so.0
#26 0x00007ffff7d69e76 in ?? () from /usr/lib64/libpopt.so.0
#27 0x00007ffff7d6b5e7 in poptGetNextOpt () from /usr/lib64/libpopt.so.0
#28 0x000055555556f5b7 in main (argc=2, argv=0x7fffffffde18, envp=0x7fffffffde30) at main.c:2550
(gdb) continue
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4e8ec00, arg=0x7ffff4fc71b0, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) bt
#0  __internal_atexit (func=0x7ffff4e8ec00, arg=0x7ffff4fc71b0, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
#1  0x00007ffff4e8f008 in std::future_category() () from /usr/lib/gcc/x86_64-pc-linux-gnu/11.3.0/libstdc++.so.6
#2  0x00007ffff4e61ce9 in ?? () from /usr/lib/gcc/x86_64-pc-linux-gnu/11.3.0/libstdc++.so.6
#3  0x00007ffff7fceb2e in call_init (env=0x7fffffffde30, argv=0x7fffffffde18, argc=2, l=<optimized out>) at dl-init.c:70
#4  call_init (l=<optimized out>, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:26
#5  0x00007ffff7fcec14 in _dl_init (main_map=0x55555558b700, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:117
#6  0x00007ffff7bfeaad in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:182
#7  0x00007ffff7fd4e96 in dl_open_worker (a=a@entry=0x7fffffff13b0) at dl-open.c:808
#8  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#9  0x00007ffff7fd521b in _dl_open (file=<optimized out>, mode=-2147483647, caller_dlopen=0x7ffff7ab7457, nsid=-2, argc=2, argv=0x7fffffffde18, 
    env=0x7fffffffde30) at dl-open.c:884
#10 0x00007ffff7b3a9d8 in dlopen_doit (a=a@entry=0x7fffffff1620) at dlopen.c:56
#11 0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=exception@entry=0x7fffffff1580, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#12 0x00007ffff7bfeb0f in __GI__dl_catch_error (objname=0x7fffffff15d8, errstring=0x7fffffff15e0, mallocedp=0x7fffffff15d7, operate=<optimized out>, 
    args=<optimized out>) at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:227
#13 0x00007ffff7b3a4b6 in _dlerror_run (operate=operate@entry=0x7ffff7b3a980 <dlopen_doit>, args=args@entry=0x7fffffff1620) at dlerror.c:138
#14 0x00007ffff7b3aa91 in dlopen_implementation (dl_caller=<optimized out>, mode=<optimized out>, file=<optimized out>) at dlopen.c:71
#15 ___dlopen (file=<optimized out>, mode=<optimized out>) at dlopen.c:81
#16 0x00007ffff7ab7457 in ?? () from /usr/lib64/libltdl.so.7
#17 0x00007ffff7ab4098 in ?? () from /usr/lib64/libltdl.so.7
#18 0x00007ffff7ab5eb1 in ?? () from /usr/lib64/libltdl.so.7
#19 0x00007ffff7ab65cc in lt_dlopenadvise () from /usr/lib64/libltdl.so.7
#20 0x00007ffff7ab6691 in lt_dlopenext () from /usr/lib64/libltdl.so.7
#21 0x00007ffff7f0f33a in gp_abilities_list_load_dir (list=0x555555585830, dir=0x7ffff7f2f346 "/usr/lib64/libgphoto2/2.5.30", context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:243
#22 0x00007ffff7f0f736 in gp_abilities_list_load (list=0x555555585830, context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:341
#23 0x0000555555566358 in gp_params_abilities_list (p=0x555555580be0 <gp_params>) at gp-params.c:303
#24 0x000055555555e651 in list_cameras_action (p=0x555555580be0 <gp_params>) at actions.c:570
#25 0x000055555556a8f9 in cb_arg_run (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, params=0x7fffffffa634)
    at main.c:1672
#26 0x000055555556b174 in cb_arg (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, data=0x7fffffffa634) at main.c:1873
#27 0x00007ffff7d69de7 in ?? () from /usr/lib64/libpopt.so.0
#28 0x00007ffff7d69e76 in ?? () from /usr/lib64/libpopt.so.0
#29 0x00007ffff7d6b5e7 in poptGetNextOpt () from /usr/lib64/libpopt.so.0
#30 0x000055555556f5b7 in main (argc=2, argv=0x7fffffffde18, envp=0x7fffffffde30) at main.c:2550
(gdb) continue
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4e90c20, arg=0x7ffff4fc71c8, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) bt
#0  __internal_atexit (func=0x7ffff4e90c20, arg=0x7ffff4fc71c8, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
#1  0x00007ffff4e6210f in ?? () from /usr/lib/gcc/x86_64-pc-linux-gnu/11.3.0/libstdc++.so.6
#2  0x00007ffff7fceb2e in call_init (env=0x7fffffffde30, argv=0x7fffffffde18, argc=2, l=<optimized out>) at dl-init.c:70
#3  call_init (l=<optimized out>, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:26
#4  0x00007ffff7fcec14 in _dl_init (main_map=0x55555558b700, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:117
#5  0x00007ffff7bfeaad in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:182
#6  0x00007ffff7fd4e96 in dl_open_worker (a=a@entry=0x7fffffff13b0) at dl-open.c:808
#7  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#8  0x00007ffff7fd521b in _dl_open (file=<optimized out>, mode=-2147483647, caller_dlopen=0x7ffff7ab7457, nsid=-2, argc=2, argv=0x7fffffffde18, 
    env=0x7fffffffde30) at dl-open.c:884
#9  0x00007ffff7b3a9d8 in dlopen_doit (a=a@entry=0x7fffffff1620) at dlopen.c:56
#10 0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=exception@entry=0x7fffffff1580, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#11 0x00007ffff7bfeb0f in __GI__dl_catch_error (objname=0x7fffffff15d8, errstring=0x7fffffff15e0, mallocedp=0x7fffffff15d7, operate=<optimized out>, 
    args=<optimized out>) at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:227
#12 0x00007ffff7b3a4b6 in _dlerror_run (operate=operate@entry=0x7ffff7b3a980 <dlopen_doit>, args=args@entry=0x7fffffff1620) at dlerror.c:138
#13 0x00007ffff7b3aa91 in dlopen_implementation (dl_caller=<optimized out>, mode=<optimized out>, file=<optimized out>) at dlopen.c:71
#14 ___dlopen (file=<optimized out>, mode=<optimized out>) at dlopen.c:81
#15 0x00007ffff7ab7457 in ?? () from /usr/lib64/libltdl.so.7
#16 0x00007ffff7ab4098 in ?? () from /usr/lib64/libltdl.so.7
#17 0x00007ffff7ab5eb1 in ?? () from /usr/lib64/libltdl.so.7
#18 0x00007ffff7ab65cc in lt_dlopenadvise () from /usr/lib64/libltdl.so.7
#19 0x00007ffff7ab6691 in lt_dlopenext () from /usr/lib64/libltdl.so.7
#20 0x00007ffff7f0f33a in gp_abilities_list_load_dir (list=0x555555585830, dir=0x7ffff7f2f346 "/usr/lib64/libgphoto2/2.5.30", context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:243
#21 0x00007ffff7f0f736 in gp_abilities_list_load (list=0x555555585830, context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:341
#22 0x0000555555566358 in gp_params_abilities_list (p=0x555555580be0 <gp_params>) at gp-params.c:303
#23 0x000055555555e651 in list_cameras_action (p=0x555555580be0 <gp_params>) at actions.c:570
#24 0x000055555556a8f9 in cb_arg_run (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, params=0x7fffffffa634)
    at main.c:1672
#25 0x000055555556b174 in cb_arg (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, data=0x7fffffffa634) at main.c:1873
#26 0x00007ffff7d69de7 in ?? () from /usr/lib64/libpopt.so.0
#27 0x00007ffff7d69e76 in ?? () from /usr/lib64/libpopt.so.0
#28 0x00007ffff7d6b5e7 in poptGetNextOpt () from /usr/lib64/libpopt.so.0
#29 0x000055555556f5b7 in main (argc=2, argv=0x7fffffffde18, envp=0x7fffffffde30) at main.c:2550
(gdb) continue
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4e90c30, arg=0x7ffff4fc71c0, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) bt
#0  __internal_atexit (func=0x7ffff4e90c30, arg=0x7ffff4fc71c0, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
#1  0x00007ffff7fceb2e in call_init (env=0x7fffffffde30, argv=0x7fffffffde18, argc=2, l=<optimized out>) at dl-init.c:70
#2  call_init (l=<optimized out>, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:26
#3  0x00007ffff7fcec14 in _dl_init (main_map=0x55555558b700, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:117
#4  0x00007ffff7bfeaad in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:182
#5  0x00007ffff7fd4e96 in dl_open_worker (a=a@entry=0x7fffffff13b0) at dl-open.c:808
#6  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#7  0x00007ffff7fd521b in _dl_open (file=<optimized out>, mode=-2147483647, caller_dlopen=0x7ffff7ab7457, nsid=-2, argc=2, argv=0x7fffffffde18, 
    env=0x7fffffffde30) at dl-open.c:884
#8  0x00007ffff7b3a9d8 in dlopen_doit (a=a@entry=0x7fffffff1620) at dlopen.c:56
#9  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=exception@entry=0x7fffffff1580, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#10 0x00007ffff7bfeb0f in __GI__dl_catch_error (objname=0x7fffffff15d8, errstring=0x7fffffff15e0, mallocedp=0x7fffffff15d7, operate=<optimized out>, 
    args=<optimized out>) at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:227
#11 0x00007ffff7b3a4b6 in _dlerror_run (operate=operate@entry=0x7ffff7b3a980 <dlopen_doit>, args=args@entry=0x7fffffff1620) at dlerror.c:138
#12 0x00007ffff7b3aa91 in dlopen_implementation (dl_caller=<optimized out>, mode=<optimized out>, file=<optimized out>) at dlopen.c:71
#13 ___dlopen (file=<optimized out>, mode=<optimized out>) at dlopen.c:81
#14 0x00007ffff7ab7457 in ?? () from /usr/lib64/libltdl.so.7
#15 0x00007ffff7ab4098 in ?? () from /usr/lib64/libltdl.so.7
#16 0x00007ffff7ab5eb1 in ?? () from /usr/lib64/libltdl.so.7
#17 0x00007ffff7ab65cc in lt_dlopenadvise () from /usr/lib64/libltdl.so.7
#18 0x00007ffff7ab6691 in lt_dlopenext () from /usr/lib64/libltdl.so.7
#19 0x00007ffff7f0f33a in gp_abilities_list_load_dir (list=0x555555585830, dir=0x7ffff7f2f346 "/usr/lib64/libgphoto2/2.5.30", context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:243
#20 0x00007ffff7f0f736 in gp_abilities_list_load (list=0x555555585830, context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:341
#21 0x0000555555566358 in gp_params_abilities_list (p=0x555555580be0 <gp_params>) at gp-params.c:303
#22 0x000055555555e651 in list_cameras_action (p=0x555555580be0 <gp_params>) at actions.c:570
#23 0x000055555556a8f9 in cb_arg_run (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, params=0x7fffffffa634)
    at main.c:1672
#24 0x000055555556b174 in cb_arg (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, data=0x7fffffffa634) at main.c:1873
#25 0x00007ffff7d69de7 in ?? () from /usr/lib64/libpopt.so.0
#26 0x00007ffff7d69e76 in ?? () from /usr/lib64/libpopt.so.0
#27 0x00007ffff7d6b5e7 in poptGetNextOpt () from /usr/lib64/libpopt.so.0
#28 0x000055555556f5b7 in main (argc=2, argv=0x7fffffffde18, envp=0x7fffffffde30) at main.c:2550
(gdb) continue
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4f322e0, arg=0x7ffff4fc71e8, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) bt
#0  __internal_atexit (func=0x7ffff4f322e0, arg=0x7ffff4fc71e8, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
#1  0x00007ffff4e623cf in ?? () from /usr/lib/gcc/x86_64-pc-linux-gnu/11.3.0/libstdc++.so.6
#2  0x00007ffff7fceb2e in call_init (env=0x7fffffffde30, argv=0x7fffffffde18, argc=2, l=<optimized out>) at dl-init.c:70
#3  call_init (l=<optimized out>, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:26
#4  0x00007ffff7fcec14 in _dl_init (main_map=0x55555558b700, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:117
#5  0x00007ffff7bfeaad in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:182
#6  0x00007ffff7fd4e96 in dl_open_worker (a=a@entry=0x7fffffff13b0) at dl-open.c:808
#7  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#8  0x00007ffff7fd521b in _dl_open (file=<optimized out>, mode=-2147483647, caller_dlopen=0x7ffff7ab7457, nsid=-2, argc=2, argv=0x7fffffffde18, 
    env=0x7fffffffde30) at dl-open.c:884
#9  0x00007ffff7b3a9d8 in dlopen_doit (a=a@entry=0x7fffffff1620) at dlopen.c:56
#10 0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=exception@entry=0x7fffffff1580, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#11 0x00007ffff7bfeb0f in __GI__dl_catch_error (objname=0x7fffffff15d8, errstring=0x7fffffff15e0, mallocedp=0x7fffffff15d7, operate=<optimized out>, 
    args=<optimized out>) at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:227
#12 0x00007ffff7b3a4b6 in _dlerror_run (operate=operate@entry=0x7ffff7b3a980 <dlopen_doit>, args=args@entry=0x7fffffff1620) at dlerror.c:138
#13 0x00007ffff7b3aa91 in dlopen_implementation (dl_caller=<optimized out>, mode=<optimized out>, file=<optimized out>) at dlopen.c:71
#14 ___dlopen (file=<optimized out>, mode=<optimized out>) at dlopen.c:81
#15 0x00007ffff7ab7457 in ?? () from /usr/lib64/libltdl.so.7
#16 0x00007ffff7ab4098 in ?? () from /usr/lib64/libltdl.so.7
#17 0x00007ffff7ab5eb1 in ?? () from /usr/lib64/libltdl.so.7
#18 0x00007ffff7ab65cc in lt_dlopenadvise () from /usr/lib64/libltdl.so.7
#19 0x00007ffff7ab6691 in lt_dlopenext () from /usr/lib64/libltdl.so.7
#20 0x00007ffff7f0f33a in gp_abilities_list_load_dir (list=0x555555585830, dir=0x7ffff7f2f346 "/usr/lib64/libgphoto2/2.5.30", context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:243
#21 0x00007ffff7f0f736 in gp_abilities_list_load (list=0x555555585830, context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:341
#22 0x0000555555566358 in gp_params_abilities_list (p=0x555555580be0 <gp_params>) at gp-params.c:303
#23 0x000055555555e651 in list_cameras_action (p=0x555555580be0 <gp_params>) at actions.c:570
#24 0x000055555556a8f9 in cb_arg_run (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, params=0x7fffffffa634)
    at main.c:1672
#25 0x000055555556b174 in cb_arg (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, data=0x7fffffffa634) at main.c:1873
#26 0x00007ffff7d69de7 in ?? () from /usr/lib64/libpopt.so.0
#27 0x00007ffff7d69e76 in ?? () from /usr/lib64/libpopt.so.0
#28 0x00007ffff7d6b5e7 in poptGetNextOpt () from /usr/lib64/libpopt.so.0
#29 0x000055555556f5b7 in main (argc=2, argv=0x7fffffffde18, envp=0x7fffffffde30) at main.c:2550
(gdb) continue
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4f322f0, arg=0x7ffff4fc71e0, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) bt
#0  __internal_atexit (func=0x7ffff4f322f0, arg=0x7ffff4fc71e0, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
#1  0x00007ffff4e623e5 in ?? () from /usr/lib/gcc/x86_64-pc-linux-gnu/11.3.0/libstdc++.so.6
#2  0x00007ffff7fceb2e in call_init (env=0x7fffffffde30, argv=0x7fffffffde18, argc=2, l=<optimized out>) at dl-init.c:70
#3  call_init (l=<optimized out>, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:26
#4  0x00007ffff7fcec14 in _dl_init (main_map=0x55555558b700, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:117
#5  0x00007ffff7bfeaad in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:182
#6  0x00007ffff7fd4e96 in dl_open_worker (a=a@entry=0x7fffffff13b0) at dl-open.c:808
#7  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#8  0x00007ffff7fd521b in _dl_open (file=<optimized out>, mode=-2147483647, caller_dlopen=0x7ffff7ab7457, nsid=-2, argc=2, argv=0x7fffffffde18, 
    env=0x7fffffffde30) at dl-open.c:884
#9  0x00007ffff7b3a9d8 in dlopen_doit (a=a@entry=0x7fffffff1620) at dlopen.c:56
#10 0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=exception@entry=0x7fffffff1580, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#11 0x00007ffff7bfeb0f in __GI__dl_catch_error (objname=0x7fffffff15d8, errstring=0x7fffffff15e0, mallocedp=0x7fffffff15d7, operate=<optimized out>, 
    args=<optimized out>) at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:227
#12 0x00007ffff7b3a4b6 in _dlerror_run (operate=operate@entry=0x7ffff7b3a980 <dlopen_doit>, args=args@entry=0x7fffffff1620) at dlerror.c:138
#13 0x00007ffff7b3aa91 in dlopen_implementation (dl_caller=<optimized out>, mode=<optimized out>, file=<optimized out>) at dlopen.c:71
#14 ___dlopen (file=<optimized out>, mode=<optimized out>) at dlopen.c:81
#15 0x00007ffff7ab7457 in ?? () from /usr/lib64/libltdl.so.7
#16 0x00007ffff7ab4098 in ?? () from /usr/lib64/libltdl.so.7
#17 0x00007ffff7ab5eb1 in ?? () from /usr/lib64/libltdl.so.7
#18 0x00007ffff7ab65cc in lt_dlopenadvise () from /usr/lib64/libltdl.so.7
#19 0x00007ffff7ab6691 in lt_dlopenext () from /usr/lib64/libltdl.so.7
#20 0x00007ffff7f0f33a in gp_abilities_list_load_dir (list=0x555555585830, dir=0x7ffff7f2f346 "/usr/lib64/libgphoto2/2.5.30", context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:243
#21 0x00007ffff7f0f736 in gp_abilities_list_load (list=0x555555585830, context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:341
#22 0x0000555555566358 in gp_params_abilities_list (p=0x555555580be0 <gp_params>) at gp-params.c:303
#23 0x000055555555e651 in list_cameras_action (p=0x555555580be0 <gp_params>) at actions.c:570
#24 0x000055555556a8f9 in cb_arg_run (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, params=0x7fffffffa634)
    at main.c:1672
#25 0x000055555556b174 in cb_arg (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, data=0x7fffffffa634) at main.c:1873
#26 0x00007ffff7d69de7 in ?? () from /usr/lib64/libpopt.so.0
#27 0x00007ffff7d69e76 in ?? () from /usr/lib64/libpopt.so.0
#28 0x00007ffff7d6b5e7 in poptGetNextOpt () from /usr/lib64/libpopt.so.0
#29 0x000055555556f5b7 in main (argc=2, argv=0x7fffffffde18, envp=0x7fffffffde30) at main.c:2550
(gdb) continue
Continuing.

Breakpoint 2, __internal_atexit (func=0x7ffff4f32300, arg=0x7ffff4fc71d8, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
41   assert (func != NULL);
(gdb) bt
#0  __internal_atexit (func=0x7ffff4f32300, arg=0x7ffff4fc71d8, d=0x7ffff4fc7060, listp=0x7ffff7c82820 <__exit_funcs>) at cxa_atexit.c:41
#1  0x00007ffff7fceb2e in call_init (env=0x7fffffffde30, argv=0x7fffffffde18, argc=2, l=<optimized out>) at dl-init.c:70
#2  call_init (l=<optimized out>, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:26
#3  0x00007ffff7fcec14 in _dl_init (main_map=0x55555558b700, argc=2, argv=0x7fffffffde18, env=0x7fffffffde30) at dl-init.c:117
#4  0x00007ffff7bfeaad in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:182
#5  0x00007ffff7fd4e96 in dl_open_worker (a=a@entry=0x7fffffff13b0) at dl-open.c:808
#6  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=<optimized out>, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#7  0x00007ffff7fd521b in _dl_open (file=<optimized out>, mode=-2147483647, caller_dlopen=0x7ffff7ab7457, nsid=-2, argc=2, argv=0x7fffffffde18, 
    env=0x7fffffffde30) at dl-open.c:884
#8  0x00007ffff7b3a9d8 in dlopen_doit (a=a@entry=0x7fffffff1620) at dlopen.c:56
#9  0x00007ffff7bfea50 in __GI__dl_catch_exception (exception=exception@entry=0x7fffffff1580, operate=<optimized out>, args=<optimized out>)
    at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:208
#10 0x00007ffff7bfeb0f in __GI__dl_catch_error (objname=0x7fffffff15d8, errstring=0x7fffffff15e0, mallocedp=0x7fffffff15d7, operate=<optimized out>, 
    args=<optimized out>) at /usr/src/debug/sys-libs/glibc-2.36-r5/glibc-2.36/elf/dl-error-skeleton.c:227
#11 0x00007ffff7b3a4b6 in _dlerror_run (operate=operate@entry=0x7ffff7b3a980 <dlopen_doit>, args=args@entry=0x7fffffff1620) at dlerror.c:138
#12 0x00007ffff7b3aa91 in dlopen_implementation (dl_caller=<optimized out>, mode=<optimized out>, file=<optimized out>) at dlopen.c:71
#13 ___dlopen (file=<optimized out>, mode=<optimized out>) at dlopen.c:81
#14 0x00007ffff7ab7457 in ?? () from /usr/lib64/libltdl.so.7
#15 0x00007ffff7ab4098 in ?? () from /usr/lib64/libltdl.so.7
#16 0x00007ffff7ab5eb1 in ?? () from /usr/lib64/libltdl.so.7
#17 0x00007ffff7ab65cc in lt_dlopenadvise () from /usr/lib64/libltdl.so.7
#18 0x00007ffff7ab6691 in lt_dlopenext () from /usr/lib64/libltdl.so.7
#19 0x00007ffff7f0f33a in gp_abilities_list_load_dir (list=0x555555585830, dir=0x7ffff7f2f346 "/usr/lib64/libgphoto2/2.5.30", context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:243
#20 0x00007ffff7f0f736 in gp_abilities_list_load (list=0x555555585830, context=0x5555555851a0)
    at /usr/src/debug/media-libs/libgphoto2-2.5.30/libgphoto2-2.5.30/libgphoto2/gphoto2-abilities-list.c:341
#21 0x0000555555566358 in gp_params_abilities_list (p=0x555555580be0 <gp_params>) at gp-params.c:303
#22 0x000055555555e651 in list_cameras_action (p=0x555555580be0 <gp_params>) at actions.c:570
#23 0x000055555556a8f9 in cb_arg_run (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, params=0x7fffffffa634)
    at main.c:1672
#24 0x000055555556b174 in cb_arg (ctx=0x555555585230, reason=POPT_CALLBACK_REASON_OPTION, opt=0x7fffffffa7c0, arg=0x0, data=0x7fffffffa634) at main.c:1873
#25 0x00007ffff7d69de7 in ?? () from /usr/lib64/libpopt.so.0
#26 0x00007ffff7d69e76 in ?? () from /usr/lib64/libpopt.so.0
#27 0x00007ffff7d6b5e7 in poptGetNextOpt () from /usr/lib64/libpopt.so.0
#28 0x000055555556f5b7 in main (argc=2, argv=0x7fffffffde18, envp=0x7fffffffde30) at main.c:2550
(gdb) continue
Continuing.
Number of supported cameras: 2629                                                                                                                               
Supported cameras:
    " JL2005B/C/D camera" (EXPERIMENTAL)
    "A&K SE180"
    "A&K SR15"
viviicat commented 1 year ago

Going to try to build without optimizations to hopefully get more info here, lots of optimizing happening.

viviicat commented 1 year ago

The filename passed to lt_dlopenext is "/usr/lib64/libgphoto2/2.5.30/lumix" for all of the breakpoints hit.

msmeissn commented 1 year ago

if you do break atexit before run it will say it does not know, but you can still set it:

(gdb) break atexit Function "atexit" not defined. Make breakpoint pending on future shared library load? (y or [n]) y Breakpoint 1 (atexit) pending. (gdb)

does it then crash at the end?

msmeissn commented 1 year ago

also if you move the lumix.so driver away, does that fix the crashes?

msmeissn commented 1 year ago

(your traces itself look good, nowhere NULL is passed in ... but it is a lower level proxy function, the NULL ptr might be hiding in higher layers.)

YangKeao commented 1 year ago

I think I have found the direct cause of this Segmentation Fault. It faults in __do_global_dtors_aux. After loading lumix.so or ptp2.so, which depends on libgcc_s.so, the fini function of libssl.so will try to call __deregister_frame_info:

  if (__deregister_frame_info)
    __deregister_frame_info (__EH_FRAME_BEGIN__);

However, the ld.so (redirected from PLT of __deregister_frame_info) failed to lookup the function __deregister_frame_info and gives an 0, so calling 0 causes the segmentation fault. The backtrace is like the following. It's suggested to (conditionally) break in dl-call_fini.c and use stepi/nexti to reach this step, as it will give a more accurate position:

(gdb) nexti
156             jmp *%r11               # Jump to function address.
(gdb) info registers
r11            0x0                 0
(gdb) bt
#0  _dl_runtime_resolve_xsavec () at ../sysdeps/x86_64/dl-trampoline.h:156
#1  0x00007ffff7fce0e2 in _dl_call_fini (closure_map=closure_map@entry=0x55555555d480) at dl-call_fini.c:43
#2  0x00007ffff7fd1ecd in _dl_fini () at dl-fini.c:114
#3  0x00007ffff7c46375 in ?? () from /usr/lib64/libc.so.6
#4  0x00007ffff7c464ca in exit () from /usr/lib64/libc.so.6
#5  0x00007ffff7c2def1 in ?? () from /usr/lib64/libc.so.6
#6  0x00007ffff7c2dfa5 in __libc_start_main () from /usr/lib64/libc.so.6
#7  0x00005555555556f1 in _start ()

I'm not very familiar with GOT, PLT things, so I still have three uncertain parts:

  1. Why is the __deregister_frame_info in GOT written a weird value, so if (__deregister_frame_info) condition meets and try to call __deregister_frame_info (__EH_FRAME_BEGIN__);. The related GOT entry is weird: 00000009b6f8 000000000008 R_X86_64_RELATIVE 2356d
  2. Why cannot the ld.so see libgcc_s.so and cannot find __deregister_frame_info? Is the order of uninstalling shared library wrong?
  3. Why is libssl.so affected but other libraries linked with crt (nearly every one) are not? I have checked that the __deregister_frame_info in libpcre GOT is still zero, so it doesn't try to find __deregister_frame_info through PLT and doesn't panic when calling the fini_array of libpcre.

I have two workarounds for the end-users:

  1. Use LD_BIND_NOW=1, so that all PLT lookup are done during bootstrap.
  2. Don't compile/install with lumix.so and ptp2.so

I'll need more time to understand deeper about this issue (re-learn about the dynamic-linking) and propose a fix.