Kernel panic when a Motorola S305 Stereo headset requests connection

[Bao Liang]

Binary package hint: pulseaudio-module-bluetooth

Recently we found an almost 100% reproducible issue when using
Motorola S305 stereo headset and Ubuntu 9.10. The Ubuntu system has
auto-update turned on and keeps up with the latest stable release. See the package list at appendix #1 at the end.

The procedure to reproduce the issue is:
1. Pair the S305 headset from Ubuntu using the bluetooth icon in the
task bar, "Set up new device..."
2. In the "Bluetooth Preferences" screen, hit "Remove" button to
remove the paired S305.
3. Power off and then power on S305.
4. The S305 will try to connect and get a negative link key reply.
You'll see the PIN input dialog flash away quickly because after the
negative reply, the LMP link is detached.
5. After step 4, the S305 willl request again and this time you'll be
given the dialog to input the PIN. Put '0000' and you'll see the
desktop frozen. Keyboard, mouse, network ... everything is down.

With step 5, I don't expect the audio is correctly setup as there should be a couple of more configuration to do. However, the unexpected thing is that the system hang up. I've reported the issue in linux-bluetooth mail list and would like to see if the issue can be caused by some process crash in user space. I managed to find the log of Appendix #2. My system still has so the panic backtrace is not available , however I attached a picture taken by my mobile.

For those who are interested, I have the hcidump log and my initial analysis here:

http://marc.info/?l=linux-bluetooth&m=126415557115779&w=2

--------------------------------------------
Appendix #1
lsb_release -rd
Description: Ubuntu 9.10
Release: 9.10

uname -a
Linux njred148 2.6.31-17-generic #54-Ubuntu SMP Thu Dec 10 16:20:31 UTC 2009 i686 GNU/Linux

> ii pulseaudio-module-bluetooth 1:0.9.19-0ubuntu4
> Bluetooth module for PulseAudio sound server
> ii bluez 4.51-0ubuntu2
> Bluetooth tools and daemons
> ii bluez-alsa 4.51-0ubuntu2
> Bluetooth audio support
> ii bluez-compat 4.51-0ubuntu2
> BlueZ 3.x compatibility binaries
> ii bluez-cups 4.51-0ubuntu2
> Bluetooth printer driver for CUPS
> rc bluez-gnome 1.8-0ubuntu5
> Bluetooth utilities for GNOME
> ii bluez-gstreamer 4.51-0ubuntu2
> Bluetooth GStreamer support
> ii bluez-hcidump 1.42-1build1
> Analyses Bluetooth HCI packets
> ii bluez-utils 4.51-0ubuntu2
> Transitional package
>

--------------------------------------------
Appendix 2

Jan 28 07:35:05 njred148 rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="881" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.
Jan 28 11:32:18 njred148 pulseaudio[22235]: pid.c: Stale PID file, overwriting.
Jan 28 11:33:58 njred148 pulseaudio[22235]: module-bluetooth-device.c:
Default profile not connected, selecting off profile
Jan 28 11:40:33 njred148 pulseaudio[22219]: module-bluetooth-device.c:
Default profile not connected, selecting off profile
Jan 28 12:30:40 njred148 Cleanup, done. Exitting...
Jan 28 12:31:51 njred148 pulseaudio[23458]: pid.c: Stale PID file, overwriting.

[Bao Liang (timbao)]

Just revisited my description, and there're some words missing

My system still has so the panic backtrace is not available , however I attached a picture taken by my mobile.

==>

My system still has rsyslogd problem(see the message rsyslogd was HUPed, type 'lightweight'. in kernel log) so the panic backtrace is not available , however I attached a picture taken by my mobile.

[Bao Liang (timbao)]

Is there any progress? I tested latest 2.6.33-rc9 from ubuntu, the
problem is still there. rsyslog still doesn't work so I took another
picture. Back trace is quite similar and if looking at the bluetooth
part, the call stack (at least those shown in the console) is the
same.

[Bao Liang (timbao)]

a correct to #3, it's 2.6.33-rc8

[Bao Liang (timbao)]

just fyi, and added a correction to #3, it's 2.6.33-rc8

---------- Forwarded message ----------
From: Liang Bao <email address hidden>
Date: 2010/3/1
Subject: Re: Kernel panic when handing Motorola S305 headset
To: <email address hidden>

I'd like to continue the previous thread on that Motorola S305 causes
kernel panic because I did find some clue here. Sorry for misleading
guess one month ago if any.

Recap the problem here so that you don't to read the first long post.
The pattern to reproduce the issue is:
1. Pair the S305 headset from the phone or the PC( I am using a Ubuntu)
2. Remove pairing on the phone or PC
3. Power off and then power on S305.
4. The S305 will try to connect and since link key removed on this
side it will try to pair. Input 0000.
5. Kernel panic happens. This can be observed on kernel version
2.6.29(on the Droid phone, yes, it's a modified version),
2.6.31-19-generic on a Ubuntu and a pretty latest 2.6.33-020633rc8
from Ubuntu official RC release.

The exact kernel crash point is
            if (l2cap_check_security(sk)) {
                 if (bt_sk(sk)->defer_setup) {
                     struct sock *parent = bt_sk(sk)->parent;
                     rsp.result = cpu_to_le16(L2CAP_CR_PEND);
                     rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
>>>                   parent->sk_data_ready(parent, 0)
                 } else {

After tracing the issue for a couple of weeks, I find the difference
between a normal flow and the panic one. If the user space process
accepts the L2CAP connection request before L2CAP_INFO_RSP received,
the following calls will be carried out:

l2cap_sock_accept-> bt_accept_dequeue->bt_accept_unlink(in the branch
bt_sk(parent)->defer_setup)-> set bt_sk(sk)->parent = NULL. Later when
L2CAP_INFO_RSP arrives, the l2cap_conn_start() will try to call the
marked line above and de-referring NULL happen.

To fix this, shall we consider checking if a pending socket can be
accepted in bt_accept_dequeue() prior to a pending L2CAP_INFO_REQ
responded? For example,  adding a check to BT_CONNECT2 in
af_bluetooth.c.

215         if (sk->sk_state == BT_CONNECTED || !newsock ||
216                         ( bt_sk(parent)->defer_setup &&
(sk->sk_state != BT_CONNECT2))) {

Again, I am not sure if this will bring a side-effect. Please advise
the most appropriate way. Thanks.

p.s: I attached partial trace files for those who're interested to the traces.

[Tig3rzhark (tig3rzhark)]

Just recently, I was trying to get it to work on Ubuntu Netbook Remix. I experienced the same Kernel Panic as described in this bug report. I hope that the problem can be solved in time.

[JohnHammond (johnq)]

I wanted to share that this also affects the Android OS at least up through 2.1. I can confirm that S305 headset crashes my Motorola Droid about every other time.

I couldn't select Android or AOSP in "Also Affects Distribution" above, otherwise I would have tagged it.

[salvador franco (dr-franco-rdguez)]

I Have the same headset, motorola s305, in an acer desktop. I bought a "perfect choice" usb bluetoth and ubuntu 10.04 recognize inmediately. Then I power on the headset and the 2 elements pairse correctly. The soun quality is excelent and i have not problem.

[Konrad Zapałowicz (kzapalowicz)]

This is reported against an old version of Ubuntu and many things has changed since then. Because of that we won't fix this issue however if this behavior repeats on a modern version please fill a bug report against it and we will take it from there.