From: Bastien Nocera <hadess@hadess.net>
To: "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
Subject: bluetoothd crasher
Date: Wed, 24 Sep 2008 16:09:06 -0700 [thread overview]
Message-ID: <1222297746.10497.186.camel@snoogens.fab.redhat.com> (raw)
Heya,
The current bluetoothd crashes on resume from suspend. Here's the valgrind output:
==10147==
==10147== Invalid read of size 4
==10147== at 0x74B739: g_atomic_int_exchange_and_add (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x769011: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x969E: stop_security_manager (security.c:1022)
==10147== by 0x8A83: io_stack_event (main.c:567)
==10147== by 0x7A81CC: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7711F7: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147== Address 0x487bcc8 is 0 bytes inside a block of size 64 free'd
==10147== at 0x480590A: free (vg_replace_malloc.c:323)
==10147== by 0x779725: g_free (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7690BC: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x770BBE: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7712C0: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147==
==10147== Invalid read of size 4
==10147== at 0x74B73B: g_atomic_int_exchange_and_add (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x769011: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x969E: stop_security_manager (security.c:1022)
==10147== by 0x8A83: io_stack_event (main.c:567)
==10147== by 0x7A81CC: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7711F7: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147== Address 0x487bcc8 is 0 bytes inside a block of size 64 free'd
==10147== at 0x480590A: free (vg_replace_malloc.c:323)
==10147== by 0x779725: g_free (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7690BC: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x770BBE: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7712C0: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147==
==10147== Invalid write of size 4
==10147== at 0x74B740: g_atomic_int_exchange_and_add (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x769011: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x969E: stop_security_manager (security.c:1022)
==10147== by 0x8A83: io_stack_event (main.c:567)
==10147== by 0x7A81CC: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7711F7: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147== Address 0x487bcc8 is 0 bytes inside a block of size 64 free'd
==10147== at 0x480590A: free (vg_replace_malloc.c:323)
==10147== by 0x779725: g_free (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7690BC: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x770BBE: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7712C0: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
bluetoothd[10147]: HCI dev 0 unregistered
bluetoothd[10147]: Unregister path: /org/bluez/hci0
bluetoothd[10147]: HCI dev 0 registered
bluetoothd[10328]: Can't set link policy on hci0: Connection timed out (110)
bluetoothd[10147]: HCI dev 0 up
bluetoothd[10147]: Unable to start SCO server socket
Looks like a double-free on the event channel.
next reply other threads:[~2008-09-24 23:09 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-09-24 23:09 Bastien Nocera [this message]
2008-09-24 23:18 ` bluetoothd crasher Bastien Nocera
2008-09-24 23:55 ` Bastien Nocera
2008-09-25 0:13 ` Marcel Holtmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1222297746.10497.186.camel@snoogens.fab.redhat.com \
--to=hadess@hadess.net \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox