* bluetoothd crasher
@ 2008-09-24 23:09 Bastien Nocera
2008-09-24 23:18 ` Bastien Nocera
0 siblings, 1 reply; 4+ messages in thread
From: Bastien Nocera @ 2008-09-24 23:09 UTC (permalink / raw)
To: linux-bluetooth@vger.kernel.org
Heya,
The current bluetoothd crashes on resume from suspend. Here's the valgrind output:
==10147==
==10147== Invalid read of size 4
==10147== at 0x74B739: g_atomic_int_exchange_and_add (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x769011: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x969E: stop_security_manager (security.c:1022)
==10147== by 0x8A83: io_stack_event (main.c:567)
==10147== by 0x7A81CC: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7711F7: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147== Address 0x487bcc8 is 0 bytes inside a block of size 64 free'd
==10147== at 0x480590A: free (vg_replace_malloc.c:323)
==10147== by 0x779725: g_free (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7690BC: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x770BBE: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7712C0: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147==
==10147== Invalid read of size 4
==10147== at 0x74B73B: g_atomic_int_exchange_and_add (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x769011: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x969E: stop_security_manager (security.c:1022)
==10147== by 0x8A83: io_stack_event (main.c:567)
==10147== by 0x7A81CC: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7711F7: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147== Address 0x487bcc8 is 0 bytes inside a block of size 64 free'd
==10147== at 0x480590A: free (vg_replace_malloc.c:323)
==10147== by 0x779725: g_free (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7690BC: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x770BBE: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7712C0: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147==
==10147== Invalid write of size 4
==10147== at 0x74B740: g_atomic_int_exchange_and_add (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x769011: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x969E: stop_security_manager (security.c:1022)
==10147== by 0x8A83: io_stack_event (main.c:567)
==10147== by 0x7A81CC: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7711F7: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
==10147== Address 0x487bcc8 is 0 bytes inside a block of size 64 free'd
==10147== at 0x480590A: free (vg_replace_malloc.c:323)
==10147== by 0x779725: g_free (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7690BC: g_io_channel_unref (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x770BBE: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7712C0: g_main_context_dispatch (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x7748A2: (within /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x774DC1: g_main_loop_run (in /lib/libglib-2.0.so.0.1800.0)
==10147== by 0x9238: main (main.c:761)
bluetoothd[10147]: HCI dev 0 unregistered
bluetoothd[10147]: Unregister path: /org/bluez/hci0
bluetoothd[10147]: HCI dev 0 registered
bluetoothd[10328]: Can't set link policy on hci0: Connection timed out (110)
bluetoothd[10147]: HCI dev 0 up
bluetoothd[10147]: Unable to start SCO server socket
Looks like a double-free on the event channel.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: bluetoothd crasher
2008-09-24 23:09 bluetoothd crasher Bastien Nocera
@ 2008-09-24 23:18 ` Bastien Nocera
2008-09-24 23:55 ` Bastien Nocera
0 siblings, 1 reply; 4+ messages in thread
From: Bastien Nocera @ 2008-09-24 23:18 UTC (permalink / raw)
To: linux-bluetooth@vger.kernel.org
On Wed, 2008-09-24 at 16:09 -0700, Bastien Nocera wrote:
> Heya,
>
> The current bluetoothd crashes on resume from suspend. Here's the valgrind output:
And the crash itself:
#0 malloc_consolidate (av=<value optimized out>) at malloc.c:4841
#1 0x002e1b2d in _int_malloc (av=<value optimized out>, bytes=<value optimized out>) at malloc.c:4184
#2 0x002e368f in __libc_calloc (n=<value optimized out>, elem_size=<value optimized out>) at malloc.c:3901
#3 0x002d7a7d in open_memstream (bufloc=Could not find the frame base for "open_memstream".
) at memstream.c:86
#4 0x00350088 in __vsyslog_chk (pri=<value optimized out>, flag=<value optimized out>, fmt=<value optimized out>, ap=<value optimized out>) at ../misc/syslog.c:169
#5 0x003505d7 in __vsyslog (pri=Could not find the frame base for "__vsyslog".
) at ../misc/syslog.c:326
#6 0xb7ff5e68 in vinfo (format=0xb7ffcf75 "HCI dev %d unregistered", ap=0xbffff0b4 "") at logging.c:36
#7 0xb7ff5e3a in info (format=0xb7ffcf75 "HCI dev %d unregistered") at logging.c:45
#8 0xb7fdc1a9 in device_event (chan=0xb800a3d0, si=0xbffff10b) at main.c:544
#9 0xb7fdc0ed in io_stack_event (chan=0xb800a3d0, cond=G_IO_IN, data=0x0) at main.c:595
#10 0x001a524d in ?? () from /lib/libglib-2.0.so.0
#11 0x0016e218 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#12 0x001718c3 in ?? () from /lib/libglib-2.0.so.0
#13 0x00171de2 in g_main_loop_run () from /lib/libglib-2.0.so.0
#14 0xb7fdc7a4 in main (argc=1, argv=0xbffff7e4) at main.c:750
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: bluetoothd crasher
2008-09-24 23:18 ` Bastien Nocera
@ 2008-09-24 23:55 ` Bastien Nocera
2008-09-25 0:13 ` Marcel Holtmann
0 siblings, 1 reply; 4+ messages in thread
From: Bastien Nocera @ 2008-09-24 23:55 UTC (permalink / raw)
To: linux-bluetooth@vger.kernel.org
[-- Attachment #1: Type: text/plain, Size: 276 bytes --]
On Wed, 2008-09-24 at 16:18 -0700, Bastien Nocera wrote:
> On Wed, 2008-09-24 at 16:09 -0700, Bastien Nocera wrote:
> > Heya,
> >
> > The current bluetoothd crashes on resume from suspend. Here's the valgrind output:
Patch attached, thanks to Johan for helping out.
Cheers
[-- Attachment #2: bluez-bluetoothd-crasher.patch --]
[-- Type: text/x-patch, Size: 1330 bytes --]
diff --git a/src/security.c b/src/security.c
index fd2535f..6a9a5c4 100644
--- a/src/security.c
+++ b/src/security.c
@@ -46,6 +46,7 @@
#include <dbus/dbus.h>
+#include "hcid.h"
#include "logging.h"
#include "textfile.h"
@@ -789,6 +790,27 @@ static inline void conn_request(int dev, bdaddr_t *sba, void *ptr)
write_remote_class(sba, &evt->bdaddr, class);
}
+static void delete_channel(GIOChannel *chan)
+{
+ gint i, found;
+
+ /* Look for the GIOChannel in the table */
+ found = -1;
+ for (i = 0; i < HCI_MAX_DEV; i++) {
+ if (io_data[i].channel == chan) {
+ found = i;
+ break;
+ }
+ }
+
+ if (found == -1) {
+ g_warning("IO channel not found in the io_data table");
+ return;
+ }
+
+ stop_security_manager(i);
+}
+
static gboolean io_security_event(GIOChannel *chan, GIOCondition cond, gpointer data)
{
unsigned char buf[HCI_MAX_EVENT_SIZE], *ptr = buf;
@@ -799,14 +821,14 @@ static gboolean io_security_event(GIOChannel *chan, GIOCondition cond, gpointer
GIOError err;
if (cond & (G_IO_NVAL | G_IO_HUP | G_IO_ERR)) {
- g_io_channel_unref(chan);
+ delete_channel(chan);
return FALSE;
}
if ((err = g_io_channel_read(chan, (gchar *) buf, sizeof(buf), &len))) {
if (err == G_IO_ERROR_AGAIN)
return TRUE;
- g_io_channel_unref(chan);
+ delete_channel(chan);
return FALSE;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: bluetoothd crasher
2008-09-24 23:55 ` Bastien Nocera
@ 2008-09-25 0:13 ` Marcel Holtmann
0 siblings, 0 replies; 4+ messages in thread
From: Marcel Holtmann @ 2008-09-25 0:13 UTC (permalink / raw)
To: Bastien Nocera; +Cc: linux-bluetooth@vger.kernel.org
Hi Bastien,
> > > The current bluetoothd crashes on resume from suspend. Here's the valgrind output:
>
> Patch attached, thanks to Johan for helping out.
a slight modified patch has been applied. Thanks.
Regards
Marcel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2008-09-25 0:13 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-09-24 23:09 bluetoothd crasher Bastien Nocera
2008-09-24 23:18 ` Bastien Nocera
2008-09-24 23:55 ` Bastien Nocera
2008-09-25 0:13 ` Marcel Holtmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox