SANE vs USB scanner on 8.0

[Hans Petter Selasky]

On Thursday 29 October 2009 13:43:23 Daniel O'Connor wrote:
> On Thu, 29 Oct 2009, Hans Petter Selasky wrote:
> > On Thursday 29 October 2009 04:55:53 Daniel O'Connor wrote:
> > > On Wed, 30 Sep 2009, Daniel O'Connor wrote:
> > > > On Mon, 28 Sep 2009, Hans Petter Selasky wrote:
> > > > > -       if (sscanf(dev, "libusb:%d:%d", &busnum, &devnum) != 2)
> > > > > +       if ((sscanf(dev, "libusb:%d:%d", &busnum, &devnum) !=
> > > > > 2) && +           (sscanf(dev, "libusb:/dev/usb:ugen%d.%d",
> > > > > &busnum, &devnum) != 2)) {
> > > > >             DBG (DL_MAJOR_ERROR, "%s: could not parse device
> > > > > string: %s\n", me, strerror(errno));
> > > > >             return 0;
> > > > >
> > > > > If it works, get the patch sent to the sane developers.
> > > >
> > > > Unfortunately no (I reworked it to match the path it uses) and
> > > > now it segfaults. I rebuilt sane with debugging (is there some
> > > > way to make libtool not strip on install? It's so tedious
> > > > manually editing makefiles to remove -s..) as well as libusb.
> > >
> > > Have you had a chance to look at this? :)
> > >
> > > Thanks.
> > >
> > > PS I'm not subscribed to usb@ so perhaps I missed a reply.
> >
> > No. Please file a bug-report on the sane mailing list.
>
> Hmm, but isn't the crash in libusb?
>
> (I understand that it may be possible that sane is using libusb badly
> however!)

I think it is some freed' libusb memory structure pointers which are passed 
into libusb. There was a similar issue fixed in another sane USB driver 
recently.

Existing drivers have some assumptions about that after a USB bus scan that 
the device nodes are still existing for already existing devices returned in 
previous scans, which is not true for LibUSB under FreeBSD.

The libUSB device pointer usage in sane needs to be audited. Probably it is 
best to figure out where the following functions are called:

 usb_find_busses() usb_find_devices() usb_device()
     usb_get_busses()

And carefully check how the libusb device handle pointers are updated.

--HPS