segfault when CCD are present in two different HOG services

[Mathieu Stephan]

Hello everyone,

We are currently developing a device that contains two HID services.
That device, as it is right now, is properly functioning on Windows & Android.
However, when pairing the device on Linux running bluez 5.50 we do get segfaults (see attached files).
Our bluetooth device has 4 services : 1 battery service, 2 HID Over Gatt services and 1 device information service.
With trial and error, we managed to find that we wouldn't get any crash as long as only 1 HOG service was present.

Here's the interesting part. The two HOG services are made as follows:
- standard keyboard over gatt: protocole mode / report map / 1 INPUT report / boot INPUT + OUTPUT / HID information / HID Control point
- raw HID over gatt : report map / 1 INPUT report / 1 OUTPUT report / HID information / HID control point

Looking at the write_ccc in the call stacks we wondered if the callbacks subscribing to notifications for the INPUT reports were causing this issue.

We therefore changed the raw HID over gatt (and its report map) to remove the INPUT report and change it into 1 OUTPUT report (leading to 2 OUTPUT reports): no crash.

We therefore hypothesize that the segfault occurs when subscribing to notification on a second HOG service...

[Daniel van Vugt (vanvugt)]

Thanks for the bug report.

Please tell us what version of Ubuntu you are using. Then please report the problem to the BlueZ developers at:

  https://bugzilla.kernel.org (Product: Drivers, Component: Bluetooth)

and then tell us the new bug ID.

[mathieu.stephan (mathieu.stephan-linux-kernel-bugs)]

Created attachment 283773
callstacks

Hello everyone,

We are currently developing a device that contains two HID services.
That device, as it is right now, is properly functioning on Windows & Android.
However, when pairing the device on Linux running bluez 5.50 we do get segfaults (see attached files).
Our bluetooth device has 4 services : 1 battery service, 2 HID Over Gatt services and 1 device information service.
With trial and error, we managed to find that we wouldn't get any crash as long as only 1 HOG service was present.

Here's the interesting part. The two HOG services are made as follows:
- standard keyboard over gatt: protocole mode / report map / 1 INPUT report / boot INPUT + OUTPUT / HID information / HID Control point
- raw HID over gatt : report map / 1 INPUT report / 1 OUTPUT report / HID information / HID control point

Looking at the write_ccc in the call stacks we wondered if the callbacks subscribing to notifications for the INPUT reports were causing this issue.

We therefore changed the raw HID over gatt (and its report map) to remove the INPUT report and change it into 1 OUTPUT report (leading to 2 OUTPUT reports): no crash.

We therefore hypothesize that the segfault occurs when subscribing to notification on a second HOG service..

[Mathieu Stephan (limpkin)]

Ubuntu 18.10

bug id 204201

thanks!

[Daniel van Vugt (vanvugt)]

Thanks.

Please note Ubuntu 18.10 reaches end-of-life this month, so please upgrade to 19.04.

[Mathieu Stephan (limpkin)]

Noted! Anyway we already had installed the latest bluez version - 5.50.

[Daniel van Vugt (vanvugt)]

Thank you for reporting this bug to Ubuntu.
Ubuntu 18.10 (cosmic) reached end-of-life on July 18, 2019.

See this document for currently supported Ubuntu releases:
https://wiki.ubuntu.com/Releases

We appreciate that this bug may be old and you might not be interested in discussing it any more. But if you are then please upgrade to the latest Ubuntu version and re-test. If you then find the bug is still present in the newer Ubuntu version, please add a comment here telling us which new version it is in and change the bug status to Confirmed.

[Daniel van Vugt (vanvugt)]

Reopened per bug 1837467.

[Oliver Toth (dexol12)]

Hello,

We have done some further investigation.
During device pairing bluez is crashing.
From debugging I can see the 2 hog services with the correct attributes, then one of the 2 hog services is reaching ref_count 0, hence it is getting freed, but on the next read bluez is trying to use a corrupted hog service and during reading its attributes we are receiving the segfault.
With normal behavior the next step would be "Report characteristic descriptor written: notifications enabled", but crashes right before that.

[Daniel van Vugt (vanvugt)]

Please note that Bluetooth developers do not monitor Launchpad (AFAIK). So if you would like their feedback then please comment in the upstream bug instead:

  https://bugzilla.kernel.org/show_bug.cgi?id=204201

[mathieu.stephan (mathieu.stephan-linux-kernel-bugs)]

Hello,

We have done some further investigation.
During device pairing bluez is crashing.
From debugging I can see the 2 hog services with the correct attributes, then one of the 2 hog services is reaching ref_count 0, hence it is getting freed, but on the next read bluez is trying to use a corrupted hog service and during reading its attributes we are receiving the segfault.
With normal behavior the next step would be "Report characteristic descriptor written: notifications enabled", but crashes right before that.

[Daniel van Vugt (vanvugt)]

Thank you for reporting this bug to Ubuntu.
Ubuntu 19.04 (disco) reached end-of-life on January 23, 2020.

See this document for currently supported Ubuntu releases:
https://wiki.ubuntu.com/Releases

We appreciate that this bug may be old and you might not be interested in discussing it any more. But if you are then please upgrade to the latest Ubuntu version and re-test. If you then find the bug is still present in the newer Ubuntu version, please add a comment here telling us which new version it is in and change the bug status to Confirmed.