bluetoothd got SEGV with bt 4.0 keyboard

[Robert Liu]

I have connected the bluez interface. When testing bluez snap with bt 4.0 keyboard, the keyboard is not usable.

Test with the following commands:
  $ sudo bluez.bluetoothctl -a
  # inside bluetoothctl
  $ power on
  $ agent KeyboardOnly
  $ default-agent
  $ scan on
  # wait for BT 4.0 keyboard to show up in scan list
  $ scan off
  $ pair [BT 4.0 keyboard MAC]
  # insert 6 digit code in BT 4.0 keyboard when prompted and press enter
  $ trust [BT 4.0 keyboard MAC]
  $ connect [BT 4.0 keyboard MAC]
=> Failed to connect: org.bluez.Error.Failed

I found this bug : https://bugs.launchpad.net/snappy/+bug/1613572
It is like a similar symptom. I am wondering if the bluetooth-control interface is necessary for BT 4.0.

related logs are here:
Oct 19 10:31:32 localhost.localdomain audit[1260]: AVC apparmor="DENIED" operation="create" profile="snap.bluez.bluez" pid=1260 comm="bluetoothd" family="alg" sock_type="seqpacket" protocol=0 requested_mask="create" denied_mask="create"
Oct 19 10:31:32 localhost.localdomain bluetoothd[1260]: No cache for E1:8F:E8:E0:78:97
Oct 19 10:31:32 localhost.localdomain kernel: audit: type=1400 audit(1476873092.787:51): apparmor="DENIED" operation="create" profile="snap.bluez.bluez" pid=1260 comm="bluetoothd" family="alg" sock_type="seqpacket" protocol=0 requested_mask="create" denied_mask="create"
Oct 19 10:31:37 localhost.localdomain audit[1260]: AVC apparmor="DENIED" operation="open" profile="snap.bluez.bluez" name="/dev/uhid" pid=1260 comm="bluetoothd" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0
Oct 19 10:31:37 localhost.localdomain kernel: audit: type=1400 audit(1476873097.575:52): apparmor="DENIED" operation="open" profile="snap.bluez.bluez" name="/dev/uhid" pid=1260 comm="bluetoothd" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0
Oct 19 10:31:37 localhost.localdomain systemd[1]: snap.bluez.bluez.service: Main process exited, code=killed, status=11/SEGV
Oct 19 10:31:37 localhost.localdomain systemd[1]: snap.bluez.bluez.service: Unit entered failed state.
Oct 19 10:31:37 localhost.localdomain systemd[1]: snap.bluez.bluez.service: Failed with result 'signal'.
Oct 19 10:31:37 localhost.localdomain kernel: bluetoothd[1260]: segfault at 20 ip 0000000000432872 sp 00007ffd0f1977f8 error 4 in bluetoothd[400000+fb000]
Oct 19 10:31:37 localhost.localdomain systemd[1]: snap.bluez.bluez.service: Service hold-off time over, scheduling restart.

[Robert Liu (robertliu)]

The version info of snaps used in the test:
Name Version Rev Developer Notes
bluez 5.37-1 6 canonical -
core 16.04.1 211 canonical -
intel-nuc-kernel 4.4.0-43-3 x1 -
modem-manager 1.4.0-1 1 canonical -
network-manager 1.2.2-7 35 canonical -
pc 16.04-0.8 9 canonical -
tpm 1.2-3 9 canonical -

We have test bluetooth 3.0 keyboard as well. the bluetooth 3.0 keyboard works well and does not meet this issue.

[Simon Fels (morphis)]

@Konrad: can you triage this one?

[Konrad Zapałowicz (kzapalowicz)]

Will do

[Konrad Zapałowicz (kzapalowicz)]

It seems that the interfaces do not allow access to the /dev/uhid which in this case is used in conjunction with BlueZ.

[Konrad Zapałowicz (kzapalowicz)]

PR against snapd https://github.com/snapcore/snapd/pull/2399

[Konrad Zapałowicz (kzapalowicz)]

Previous one rejected, now contributing a new interface. PR: https://github.com/snapcore/snapd/pull/2417

[Konrad Zapałowicz (kzapalowicz)]

The uhid interface is merged to snapd as of today https://github.com/snapcore/snapd/pull/2417. This should help for this issue.

[Konrad Zapałowicz (kzapalowicz)]

@Robert, are you able to test with upstream snapd and verify?

[Konrad Zapałowicz (kzapalowicz)]

@Robert, forget my previous comment. bluez snap must be modified too to include uhid plug-slot binding.

[Robert Liu (robertliu)]

@Konrad,
Sure, I could help. Let me know when the bluez snap has been modified.

[Konrad Zapałowicz (kzapalowicz)]

This fix is now released