DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1FAB320832
MIME-Version: 1.0
References: <20181025004210.177441-1-yunhanw@google.com>
In-Reply-To: <20181025004210.177441-1-yunhanw@google.com>
From:   Yunhan Wang <yunhanw@google.com>
Date:   Wed, 24 Oct 2018 18:47:20 -0700
Message-ID: <CALvjcs83c2B0aq7Vz8WU4DC=ikQfB5W_XfYh+S_rkydi=6agMw@mail.gmail.com>
Subject: Re: [PATCH] gatt: Fix double att_disconnected issue on disconnection
To:     linux-bluetooth@vger.kernel.org,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi, Luiz

I am observing the multiple crashes when doing BLE disconnection using
latest bluez master..It looks like the two att_disconnect are
triggered from your last gatt commit.. Please help take a look at this
workaround and comments.. the better solution might be to figure out
how to handle the disconnection along with random address and public
address together regarding the previous issue, Gatt: Subscriptions are
not cleared after disconnection from a temporary device

Thanks
Best wishes
Yunhan
On Wed, Oct 24, 2018 at 5:42 PM yunhanw <yunhanw@google.com> wrote:
>
> When BLE disconnection happens, att_disconnect is triggered from two loca=
tions, the new added location is gatt_server_cleanup, it would cause severa=
l blueetoothd crashes. This bus is introduced from commit 634f0a6e1125af8d5=
959bff119d9336a8d81c028, where gatt fix, gatt subscriptions are not cleared=
 after disconnection from a temporary device with private/random address. I=
n order to workaround this issue, btd_gatt_database_att_disconnected can on=
ly be triggered when address type is random, and for others, it can continu=
e to use original disconnect code path.
>
>     crash 1
>     Program received signal SIGSEGV, Segmentation fault.
>     queue_remove (queue=3D0x30, data=3Ddata@entry=3D0x555555872a40) at /r=
epo/src/shared/queue.c:256
>     256     for (entry =3D queue->head, prev =3D NULL; entry;
>     (gdb) backtrace
>         at /bluez/repo/src/gatt-database.c:350
>         at bluez/repo/src/shared/queue.c:220
>         at bluez/repo/src/shared/att.c:592
>         at bluez/repo/src/shared/io-glib.c:170
>
>     crash 2
>         at bluez/repo/src/shared/queue.c:220
>         at bluez/repo/src/shared/att.c:592
>         at bluez/repo/src/shared/io-glib.c:170
>
>     (gdb) print state->db->adapter
>     Cannot access memory at address 0x61672f6269727474
> ---
>  src/gatt-database.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/src/gatt-database.c b/src/gatt-database.c
> index 783b692d5..2f0eb83b5 100644
> --- a/src/gatt-database.c
> +++ b/src/gatt-database.c
> @@ -3365,6 +3365,8 @@ void btd_gatt_database_att_disconnected(struct btd_=
gatt_database *database,
>
>         addr =3D device_get_address(device);
>         type =3D btd_device_get_bdaddr_type(device);
> +    if (type !=3D BDADDR_LE_RANDOM)
> +        return;
>
>         state =3D find_device_state(database, addr, type);
>         if (!state)
> --
> 2.19.1.568.g152ad8e336-goog
>