Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <6704ebbea9d1bb64e54b45b1b3d6cd321b28971b.camel@infinera.com>
 <CABBYNZ+5ToeenijZkpRSrQ+wyLPjFSD5S7LWwCWXVoT=m-9Y3g@mail.gmail.com> <da4df669a540a395eec5a596a9594bea73be404d.camel@infinera.com>
In-Reply-To: <da4df669a540a395eec5a596a9594bea73be404d.camel@infinera.com>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Wed, 14 Jun 2023 09:53:54 -0700
Message-ID: <CABBYNZKhf0Ve5P+N9zhAuUwU5O-e5JcifcxE-0=o+X_hRdPtyA@mail.gmail.com>
Subject: Re: bluez SEGV in current master
To:     Joakim Tjernlund <Joakim.Tjernlund@infinera.com>
Cc:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Joakim,

On Wed, Jun 14, 2023 at 9:32=E2=80=AFAM Joakim Tjernlund
<Joakim.Tjernlund@infinera.com> wrote:
>
> On Wed, 2023-06-14 at 09:25 -0700, Luiz Augusto von Dentz wrote:
> > Hi Joakim,
> >
> > On Wed, Jun 14, 2023 at 5:36=E2=80=AFAM Joakim Tjernlund
> > <Joakim.Tjernlund@infinera.com> wrote:
> > >
> > > commit bap: Add broadcast source support, 3030883, in bluez.git
> > >
> > > A co-worker see this SEGV when connecting a headset:
> > >
> > > Jun 13 13:38:15 systemd-coredump[3941]: Process 1897 (bluetoothd) of =
user 0 dumped core.
> > >                                         Module bluetoothd without bui=
ld-id.
> > >                                         #0  0x0000556bea93277a a2dp_r=
esume_complete (bluetoothd + 0x3e77a)
> > >                                         #1  0x0000556bea9210a2 finali=
ze_resume (bluetoothd + 0x2d0a2)
> > >                                         #2  0x0000556bea92afaf avdtp_=
start_resp (bluetoothd + 0x36faf)
> > >                                         #6  0x0000556bea9dcc85 mainlo=
op_run (bluetoothd + 0xe8c85)
> > >                                         #7  0x0000556bea9dd0dc mainlo=
op_run_with_signal (bluetoothd + 0xe90dc)
> > >                                         #8  0x0000556bea91a4ef main (=
bluetoothd + 0x264ef)
> > >                                         #11 0x0000556bea91ace1 _start=
 (bluetoothd + 0x26ce1)
> > > Jun 13 13:38:15 systemd[1]: bluetooth.service: Main process exited, c=
ode=3Ddumped, status=3D11/SEGV
> > >
> > >
> > > Crash seems to be at:
> > >
> > > 342     static void a2dp_resume_complete(struct avdtp *session, int e=
rr,
> > > 343                                                             void =
*user_data)
> > > 344     {
> > > 345             struct media_owner *owner =3D user_data;
> > > 346             struct media_request *req =3D owner->pending;
> > > 347             struct media_transport *transport =3D owner->transpor=
t;
> > > 348             struct a2dp_sep *sep =3D media_endpoint_get_sep(trans=
port->endpoint);
> > >
> > > A good start(but does NOT fix the problem) might be:
> > >
> > > --- bluez-9999/profiles/audio/transport.c.org   2023-06-13 18:38:14.5=
42137531 +0200
> > > +++ bluez-9999/profiles/audio/transport.c       2023-06-13 18:48:32.5=
42527882 +0200
> > > @@ -345,7 +345,7 @@
> > >         struct media_owner *owner =3D user_data;
> > >         struct media_request *req =3D owner->pending;
> > >         struct media_transport *transport =3D owner->transport;
> > > -       struct a2dp_sep *sep =3D media_endpoint_get_sep(transport->en=
dpoint);
> > > +       struct a2dp_sep *sep;
> > >         struct avdtp_stream *stream;
> > >         int fd;
> > >         uint16_t imtu, omtu;
> > > @@ -355,7 +355,10 @@
> > >
> > >         if (err)
> > >                 goto fail;
> > > +       if (!transport)
> > > +               goto fail;
> > >
> > > +       sep =3D media_endpoint_get_sep(transport->endpoint);
> > >         stream =3D a2dp_sep_get_stream(sep);
> > >         if (stream =3D=3D NULL)
> > >                 goto fail;
> > >
> > > bluez-5.66 Works fine though.
> > >
> > > Headset: WH-1000XM3
> > >
> > >   Jocke
> >
> > Weird, I don't think much has changed for A2DP, but perhaps there is
> > some BAP related changes affecting A2DP for some reason, any chance to
> > bisect the patch that introduces this problem? Or it is not always
> > reproducible?
>
> It is reproducible but on an remote laptop used for daily work so would d=
isturb quite a lot.
> Can I turn off BAP somehow to see if it is interfering ?
>
> Any chance it is related to https://github.com/bluez/bluez/issues/533 ?

Right, yeah that is possible since it appears to be some unbalanced
reference count issue, that said that was a very old version, not sure
if we haven't fixed that.

>  Jocke


--=20
Luiz Augusto von Dentz