bluetoothd dies with glibc malloc memory corruption when used with brcm_patchram

Bug #1070770 reported by Oliver Grawert on 2012-10-24
26
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Bluez Utilities
New
Undecided
Unassigned
ubuntu-nexus7
Medium
Jani Monoses
linux-nexus7 (Ubuntu)
Undecided
Unassigned
Raring
Undecided
Unassigned

Bug Description

compiling brcm_patchram from upstream source and adding the attached upstart bluetooth.override job to /etc/init/ makes bluetooth work, you can see all devices and pair with them, but shortly after pairing bluetoothd dies with:

ubuntu@nexus7-condemning:~$ sudo bluetoothd -n
[sudo] password for ubuntu:
bluetoothd[1729]: Bluetooth daemon 4.101
bluetoothd[1729]: Starting SDP server
bluetoothd[1729]: DIS cannot start: GATT is disabled
bluetoothd[1729]: Failed to init deviceinfo plugin
bluetoothd[1729]: Failed to init proximity plugin
bluetoothd[1729]: Failed to init time plugin
bluetoothd[1729]: Failed to init alert plugin
bluetoothd[1729]: Failed to init thermometer plugin
bluetoothd[1729]: Failed to init gatt_example plugin
bluetoothd[1729]: Listening for HCI events on hci0
bluetoothd[1729]: HCI dev 0 up
bluetoothd[1729]: Could not get the contents of DMI chassis type
bluetoothd[1729]: Unable to load keys to adapter_ops: Function not implemented (38)
bluetoothd[1729]: Adapter /org/bluez/1729/hci0 has been enabled
bluetoothd[1729]: Endpoint registered: sender=:1.32 path=/MediaEndpoint/HFPAG
bluetoothd[1729]: Endpoint registered: sender=:1.32 path=/MediaEndpoint/HFPHS
bluetoothd[1729]: Endpoint registered: sender=:1.32 path=/MediaEndpoint/A2DPSource
bluetoothd[1729]: Endpoint registered: sender=:1.32 path=/MediaEndpoint/A2DPSink
bluetoothd[1729]: Inquiry Cancel Failed with status 0x12
jan *** glibc detected *** bluetoothd: free(): invalid next size (fast): 0x41a299f0 ***
*** glibc detected *** bluetoothd: malloc(): memory corruption: 0x41a29a10 ***

the options used in the brcm_patchram call in the upstart job are copied from the android init script and should work fine.

Oliver Grawert (ogra) wrote :
Alex Chiang (achiang) on 2012-10-24
Changed in newark:
importance: Undecided → High
Alex Chiang (achiang) on 2012-10-24
Changed in newark:
importance: High → Medium
Matt Fischer (mfisch) on 2012-10-25
Changed in newark:
status: New → Confirmed
tags: added: nexus7
Matt Fischer (mfisch) on 2012-10-26
information type: Proprietary → Public
affects: newark → ubuntu-nexus7
Michael Hall (mhall119) on 2012-10-26
tags: added: mobile
Alex Chiang (achiang) on 2012-10-30
Changed in ubuntu-nexus7:
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)

Workaround is to run bluetoothd in valgrind for now; it will prevent the crashes and allow pairing successfully, at which point a bluetooth keyboard (for example) will work.

I'll get the full stack trace "yet again", so that it's recorded in this bug.

Backtrace.

Till Kamppeter (till-kamppeter) wrote :

The workaround of comment #2, running bluetoothd under valgriond can be made automatic, to make the device more usable for the time being until the fix for this bug gets available. Simply follow the instructions on

https://wiki.ubuntu.com/Nexus7/UsingTheDevice#Stabilizing_the_Bluetooth_stack

After that I got my Bluetooth keyboard work using the standard GNOME tools to set it up, with PIN.

tags: added: nexus7-kernel
Andy (ittstudent) wrote :

Bluetooth fully working using 3rd party app " bluetooth manager", including obex transfer and keyboard. Reboot after installation required.

Mursalin Akon (mmakon) wrote :

Commit d4076ae3b7eff09f9d4c1f4193572e27db59dbd9 introduced couple of fields, which are not used in standard bluez user space stack. As a result, the kernel overwrites couple of bytes passed from the user space, when the two functions in the mentioned commit is invoked.

For reference, standard bluez code can be located here:
http://git.kernel.org/?p=bluetooth/bluez.git;a=blob;f=lib/hci.h;h=2f18ec8155efeab1b9bfc56a1af84a8dfcdea5c1;hb=HEAD#l2342

Attaching a patch .....

Simon Fels (morphis) wrote :

Thats really intersting. You checked wether bluetoothd is still detecting the memory corruption and is dieing?

Mursalin Akon (mmakon) wrote :

I validated the patch on another reference platform.

Mursalin Akon (mmakon) wrote :

Please note that the patch is for standard Linux bluez user space stack. Android does not need it.

Alex Chiang (achiang) on 2012-12-05
Changed in ubuntu-nexus7:
assignee: Mathieu Trudel-Lapierre (mathieu-tl) → Jani Monoses (jani)
Jani Monoses (jani) wrote :

Can someone with BT devices who can reproduce the crash test with this kernel?
It simply reverts commit d4076ae3b7eff09f9d4c1f4193572e27db59dbd9 as suggested by Mursalin in the comments above.
http://people.canonical.com/~jani/linux-image-3.1.10-8-nexus7_3.1.10-8.17_armhf.deb

Sean Feole (sfeole) wrote :

I can take a crack at this tomorrow, will keep you posted

Jani, thank you for the fix. With the fixed kernel installed bluetoothd keeps stable without Valgrind now for me. I can use my Bluetooth keyboard without any workaround.

Jani Monoses (jani) wrote :

Till, thanks for testing so promptly. I sent the patch to the kernel list for inclusion in Raring.

Tim Gardner (timg-tpi) on 2012-12-06
Changed in linux-nexus7 (Ubuntu Raring):
status: New → Fix Committed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux-nexus7 - 3.1.10-8.17

---------------
linux-nexus7 (3.1.10-8.17) raring; urgency=low

  [ Tim Gardner ]

  * [Config] Updated getabis path

  [ Upstream Kernel Changes ]

  * Revert "Bluetooth: Add ACL MTU, available buffers and total buffers to
    hci_conn_info."
    - LP: #1070770
 -- Tim Gardner <email address hidden> Thu, 06 Dec 2012 07:26:05 -0700

Changed in linux-nexus7 (Ubuntu Raring):
status: Fix Committed → Fix Released

Unfortunately, the fix in linux-nexus7 only works for Ubuntu 12.10. In the current Ubuntu 13.04 (daily snapshot from Dec 6, manually downloaded and installed linux-image-3.1.10-8-nexus7_3.1.10-8.17_armhf.deb from Launchpad, rebooted).

To use multirom, I need to install kernel_kexec_42.zip as described here
http://rootingandroid.net/how-to-install-multiple-roms-and-ubuntu-on-a-nexus-7/
(I found out when doing an apt-get upgrade that it wouldn't boot anymore, after the kernel was upgraded)
Then I'm not seeing that there is a bluetooth device. lsusb doesn't find one, hcitool scan says "No such device" and so on. Does there need to be an hci attach somewhere, if this is a serial-attached BT chip? Or is it just a missing driver in that kernel? If so, could someone provide an updated kernel image that has the bluetooth fixes and also the kexec-hardboot patch for multirom?

Oliver Grawert (ogra) wrote :

this was fixed long ago in the official images, closing teh nexus7 task ...

Changed in ubuntu-nexus7:
status: Confirmed → Fix Released

Shawn, you need MultiROM of at least version 7 and after having installed the Ubuntu ROM as one of the alternative ROMs, before you boot Ubuntu for the first time, you have to go in to the ROM list in Recovery, select the freshly added Ubuntu ROM and in the menu for modifying it, select the item to disable flash-kernel. The kernel_kexec_42.zip is only for Android and you have to apply it to the original Android system, by the "Install ZIP" entry of the main menu of Recovery. After having done all that you are able to boot both systems. Boot Ubuntu and follow the steps for the initial configuration. Kernel updates pulled by updating the system will not break the boot sector or the Android kernel and when you reboot into Ubuntu you will get the new kernel which got installed by your update. So you will be able to also test the kernel and make use of all our fixes, and boot back to Android whenever you want.

See also

https://wiki.ubuntu.com/Nexus7/Installation#Having_both_Android_and_Ubuntu_installed_for_dual_boot

Till,
Thanks for the comprehensive explanation. It does indeed work nicely now.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers