Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <6704ebbea9d1bb64e54b45b1b3d6cd321b28971b.camel@infinera.com>
In-Reply-To: <6704ebbea9d1bb64e54b45b1b3d6cd321b28971b.camel@infinera.com>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Wed, 14 Jun 2023 09:25:58 -0700
Message-ID: <CABBYNZ+5ToeenijZkpRSrQ+wyLPjFSD5S7LWwCWXVoT=m-9Y3g@mail.gmail.com>
Subject: Re: bluez SEGV in current master
To:     Joakim Tjernlund <Joakim.Tjernlund@infinera.com>
Cc:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Joakim,

On Wed, Jun 14, 2023 at 5:36=E2=80=AFAM Joakim Tjernlund
<Joakim.Tjernlund@infinera.com> wrote:
>
> commit bap: Add broadcast source support, 3030883, in bluez.git
>
> A co-worker see this SEGV when connecting a headset:
>
> Jun 13 13:38:15 systemd-coredump[3941]: Process 1897 (bluetoothd) of user=
 0 dumped core.
>                                         Module bluetoothd without build-i=
d.
>                                         #0  0x0000556bea93277a a2dp_resum=
e_complete (bluetoothd + 0x3e77a)
>                                         #1  0x0000556bea9210a2 finalize_r=
esume (bluetoothd + 0x2d0a2)
>                                         #2  0x0000556bea92afaf avdtp_star=
t_resp (bluetoothd + 0x36faf)
>                                         #6  0x0000556bea9dcc85 mainloop_r=
un (bluetoothd + 0xe8c85)
>                                         #7  0x0000556bea9dd0dc mainloop_r=
un_with_signal (bluetoothd + 0xe90dc)
>                                         #8  0x0000556bea91a4ef main (blue=
toothd + 0x264ef)
>                                         #11 0x0000556bea91ace1 _start (bl=
uetoothd + 0x26ce1)
> Jun 13 13:38:15 systemd[1]: bluetooth.service: Main process exited, code=
=3Ddumped, status=3D11/SEGV
>
>
> Crash seems to be at:
>
> 342     static void a2dp_resume_complete(struct avdtp *session, int err,
> 343                                                             void *use=
r_data)
> 344     {
> 345             struct media_owner *owner =3D user_data;
> 346             struct media_request *req =3D owner->pending;
> 347             struct media_transport *transport =3D owner->transport;
> 348             struct a2dp_sep *sep =3D media_endpoint_get_sep(transport=
->endpoint);
>
> A good start(but does NOT fix the problem) might be:
>
> --- bluez-9999/profiles/audio/transport.c.org   2023-06-13 18:38:14.54213=
7531 +0200
> +++ bluez-9999/profiles/audio/transport.c       2023-06-13 18:48:32.54252=
7882 +0200
> @@ -345,7 +345,7 @@
>         struct media_owner *owner =3D user_data;
>         struct media_request *req =3D owner->pending;
>         struct media_transport *transport =3D owner->transport;
> -       struct a2dp_sep *sep =3D media_endpoint_get_sep(transport->endpoi=
nt);
> +       struct a2dp_sep *sep;
>         struct avdtp_stream *stream;
>         int fd;
>         uint16_t imtu, omtu;
> @@ -355,7 +355,10 @@
>
>         if (err)
>                 goto fail;
> +       if (!transport)
> +               goto fail;
>
> +       sep =3D media_endpoint_get_sep(transport->endpoint);
>         stream =3D a2dp_sep_get_stream(sep);
>         if (stream =3D=3D NULL)
>                 goto fail;
>
> bluez-5.66 Works fine though.
>
> Headset: WH-1000XM3
>
>   Jocke

Weird, I don't think much has changed for A2DP, but perhaps there is
some BAP related changes affecting A2DP for some reason, any chance to
bisect the patch that introduces this problem? Or it is not always
reproducible?


--=20
Luiz Augusto von Dentz