BUG: Segfault when using with tw68

When using motion with tw68, it segment faults around 95% of the time at start. When it starts, it seems to work (but not tested for very long), but it segfaults almost all the time at start.

This is the v4l driver: http://gitorious.org/tw68/tw68-v2

root@KalinkaDVR:~/version2/dist/motion/motion-stable# gdb /usr/local/bin/motion /tmp/core.motion.1583 
GNU gdb (GDB) 7.0-ubuntu
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/local/bin/motion...done.
[New Thread 1585]
[New Thread 1583]

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/libm.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libpthread.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /usr/lib/libjpeg.so.62...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libjpeg.so.62
Reading symbols from /usr/lib/libavformat.so.52...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavformat.so.52
Reading symbols from /usr/lib/libavcodec.so.52...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavcodec.so.52
Reading symbols from /usr/lib/libavutil.so.49...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libavutil.so.49
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /usr/lib/libsqlite3.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libsqlite3.so.0
Reading symbols from /usr/lib/libmysqlclient.so.16...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libmysqlclient.so.16
Reading symbols from /usr/lib/libpq.so.5...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpq.so.5
Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /lib/libbz2.so.1.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libbz2.so.1.0
Reading symbols from /usr/lib/libgsm.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgsm.so.1
Reading symbols from /usr/lib/libschroedinger-1.0.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libschroedinger-1.0.so.0
Reading symbols from /usr/lib/libspeex.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libspeex.so.1
Reading symbols from /usr/lib/libtheora.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtheora.so.0
Reading symbols from /usr/lib/libvorbisenc.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libvorbisenc.so.2
Reading symbols from /usr/lib/libvorbis.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libvorbis.so.0
Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libnsl.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libssl.so.0.9.8...(no debugging symbols found)...done.
Loaded symbols for /lib/libssl.so.0.9.8
Reading symbols from /lib/libcrypto.so.0.9.8...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypto.so.0.9.8
Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5.so.3
Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgssapi_krb5.so.2
Reading symbols from /usr/lib/libldap_r-2.4.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libldap_r-2.4.so.2
Reading symbols from /usr/lib/liboil-0.3.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/liboil-0.3.so.0
Reading symbols from /usr/lib/libogg.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libogg.so.0
Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libk5crypto.so.3
Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5support.so.0
Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libkeyutils.so.1
Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /usr/lib/liblber-2.4.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/liblber-2.4.so.2
Reading symbols from /usr/lib/libsasl2.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libsasl2.so.2
Reading symbols from /usr/lib/libgnutls.so.26...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgnutls.so.26
Reading symbols from /lib/librt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/librt.so.1
Reading symbols from /usr/lib/libtasn1.so.3...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libtasn1.so.3
Reading symbols from /lib/libgcrypt.so.11...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcrypt.so.11
Reading symbols from /lib/libgpg-error.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libgpg-error.so.0
Reading symbols from /lib/libnss_files.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libnss_files.so.2
Core was generated by `motion -d 9 -c /tmp/xanview/thread7.conf'.
Program terminated with signal 11, Segmentation fault.
#0  conv_uyvyto420p (map=0x7f34118acb10 "", cap_map=0x7f341989d600 <Address 0x7f341989d600 out of bounds>, width=640, height=480) at video_common.c:305
305                     calc += *(cap_map + uv_offset);
(gdb) 
(gdb) bt full
#0  conv_uyvyto420p (map=0x7f34118acb10 "", cap_map=0x7f341989d600 <Address 0x7f341989d600 out of bounds>, width=640, height=480) at video_common.c:305
        calc = <value optimised out>
        pY = 0x7f34118acb10 ""
        pU = 0x7f34118bfad0 ""
        pV = 0x7f34118d26d0 ""
        uv_offset = 2560
        ix = 478
        jx = 0
#1  0x000000000040f9f1 in v4l2_next (cnt=0x2042060, viddev=0x204b740, 
    map=0x7f3411862010 "\035\035\036\035\034\036\034\036\036\036\036\036\036\036\035\036\035\036\035\036\035\036\034\036\034\034\035\036\035\035\035\036\036\035\035\036\036\036\036\036\035\036\036\036\036\035\034\035\035\035\036\035\036\036\035\035\035\036\035\036\035\036\036\036\035\035\036\036\035\035\036\035\036\035\034\035\035\034\034\036\036\036\035\035\036\036\035\036\035\036\035\035\036\035\034\035\034\035\035\036\036\035\036\036\036\036\035\035\035\036\036\036\035\036\036\035\036\035\035\037\037\036\035\036\035\036\036\036\036\035\035\036\035\036\035\037\034\035\035\036\035\036\037\037\037\037\036\036\036\036\036\036\036\035\034\035\033\037\035\037\035\034\034\035\036\036\036\036\036\036\035\036\035\036\034\036\035\036\036\035\035\036\035\036\034\034\035", '\036' <repeats 13 times>..., width=640, height=480) at video2.c:915
        the_buffer = 0x7f341989d602
        set = {__val = {90625, 0 <repeats 15 times>}}
        old = {__val = {0, 6380585196730110720, 9963779, 4723583344, 4304931075, 4393624, 139861633354000, 4294967295, 0, 139861706878528, 139861706878528, 460816, 33868256, 33868256, 139861706878632, 
            139861703790329}}
        __FUNCTION__ = "v4l2_next"
#2  0x0000000000411a69 in vid_next (cnt=0x2042060, 
    map=0x7f3411862010 "\035\035\036\035\034\036\034\036\036\036\036\036\036\036\035\036\035\036\035\036\035\036\034\036\034\034\035\036\035\035\035\036\036\035\035\036\036\036\036\036\035\036\036\036\036\035\034\035\035\035\036\035\036\036\035\035\035\036\035\036\035\036\036\036\035\035\036\036\035\035\036\035\036\035\034\035\035\034\034\036\036\036\035\035\036\036\035\036\035\036\035\035\036\035\034\035\034\035\035\036\036\035\036\036\036\036\035\035\035\036\036\036\035\036\036\035\036\035\035\037\037\036\035\036\035\036\036\036\036\035\035\036\035\036\035\037\034\035\035\036\035\036\037\037\037\037\036\036\036\036\036\036\036\035\034\035\033\037\035\037\035\034\034\035\036\036\036\036\036\036\035\036\035\036\034\036\035\036\036\035\035\036\035\036\034\034\035", '\036' <repeats 13 times>...) at video_common.c:914
        dev = 0x204b740
        width = 640
        height = 480
        ret = <value optimised out>
        conf = <value optimised out>
#3  0x00000000004074e2 in motion_init (arg=0x2042060) at motion.c:731
        i = 0
        picture = <value optimised out>
#4  motion_loop (arg=0x2042060) at motion.c:1074
        cnt = 0x2042060
        i = <value optimised out>
        j = <value optimised out>
        z = <value optimised out>
        lastframetime = <value optimised out>
        frame_buffer_size = <value optimised out>
        rate_limit = 0
        area_once = <value optimised out>
        area_minx = {0, 0, 0, 0, 0, 0, 0, 0, 0}
        area_miny = {0, 0, 0, 0, 0, 0, 0, 0, 0}
        area_maxx = {0, 0, 0, 0, 0, 0, 0, 0, 0}
        area_maxy = {0, 0, 0, 0, 0, 0, 0, 0, 0}
        smartmask_ratio = 0
        smartmask_count = 0
        smartmask_lastrate = <value optimised out>
        olddiffs = 0
        previous_diffs = 0
---Type <return> to continue, or q <return> to quit---
        previous_location_x = 0
        previous_location_y = 0
        text_size_factor = 0
        passflag = 0
        required_frame_time = <value optimised out>
        frame_delay = <value optimised out>
        delay_time_nsec = <value optimised out>
        rolling_frame = <value optimised out>
        tv1 = {tv_sec = 0, tv_usec = 0}
        tv2 = {tv_sec = 0, tv_usec = 0}
        rolling_average = <value optimised out>
        timenow = <value optimised out>
        vid_return_code = <value optimised out>
        minimum_frame_time_downcounter = <value optimised out>
        get_image = 0
        old_image = <value optimised out>
        time_last_frame = 0
        time_current_frame = 0
        __FUNCTION__ = "motion_loop"
#5  0x00007f341920ca04 in start_thread () from /lib/libpthread.so.0
No symbol table info available.
#6  0x00007f341732780d in clone () from /lib/libc.so.6
No symbol table info available.
#7  0x0000000000000000 in ?? ()
No symbol table info available.
(gdb) frame 1
#1  0x000000000040f9f1 in v4l2_next (cnt=0x2042060, viddev=0x204b740, 
    map=0x7f3411862010 "\035\035\036\035\034\036\034\036\036\036\036\036\036\036\035\036\035\036\035\036\035\036\034\036\034\034\035\036\035\035\035\036\036\035\035\036\036\036\036\036\035\036\036\036\036\035\034\035\035\035\036\035\036\036\035\035\035\036\035\036\035\036\036\036\035\035\036\036\035\035\036\035\036\035\034\035\035\034\034\036\036\036\035\035\036\036\035\036\035\036\035\035\036\035\034\035\034\035\035\036\036\035\036\036\036\036\035\035\035\036\036\036\035\036\036\035\036\035\035\037\037\036\035\036\035\036\036\036\036\035\035\036\035\036\035\037\034\035\035\036\035\036\037\037\037\037\036\036\036\036\036\036\036\035\034\035\033\037\035\037\035\034\034\035\036\036\036\036\036\036\035\036\035\036\034\036\035\036\036\035\035\036\035\036\034\034\035", '\036' <repeats 13 times>..., width=640, height=480) at video2.c:915
915                 conv_uyvyto420p(map, the_buffer->ptr, (unsigned)width, (unsigned)height);

Environment

Motion version:	trunk
ffmpeg version:
Shared libraries:	ffmpeg, mysql, postgresql
Server OS:

-- RomanGaufman - 22 Feb 2010

Follow up

Driver looks not stable , probably driver fails to fill the buffer but didn't set a flag as is expected in V4L2 ... so probably driver is buggy for VIDIOC_DQBUF/VIDIOC_QBUF

please try to use latest revision of driver.

-- AngelCarpintero - 25 Feb 2010

---

Apply to trunk the patch to allow run motion with debug for V4L2 :

motion -d 6

-- AngelCarpintero 26 Feb 2010

---

Not a problem with the tw68 driver, but rather a small enhancement needed to motion. Fix will be put into SVN shortly.

-- BillBrack - 15 Apr 2010

Fix record

Commited to svn already.

-- AngelCarpintero - 17 Apr 2010