Bug 100237

Summary: pulseaudio 10.0: crash in bluetooth module when an HSP/A2DP source connects
Product: PulseAudio Reporter: Manuel Lauss <manuel.lauss>
Component: modulesAssignee: pulseaudio-bugs
Status: RESOLVED FIXED QA Contact: pulseaudio-bugs
Severity: normal    
Priority: medium CC: lennart
Version: unspecified   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
See Also: https://launchpad.net/bugs/1690028
https://launchpad.net/bugs/1672171
Whiteboard:
i915 platform: i915 features:
Bug Depends on:    
Bug Blocks: 99067    
Attachments: full debug log
0001-bluez5-util-fix-profile-waiting-logic.patch
0001-bluez5-util-fix-profile-waiting-logic.patch

Description Manuel Lauss 2017-03-16 18:41:25 UTC
Created attachment 130268 [details]
full debug log

When I connect an HSP/A2DP source, pulseaudio 10 and current -git crash in the
bluez5 module:

D: [pulseaudio] bluez5-util.c: Properties changed in device /org/bluez/hci0/dev_FC_A8_9A_AC_72_44
D: [pulseaudio] backend-native.c: dbus: path=/Profile/HSPAGProfile, interface=org.bluez.Profile1, member=NewConnection
D: [pulseaudio] backend-native.c: dbus: NewConnection path=/org/bluez/hci0/dev_FC_A8_9A_AC_72_44, fd=19, profile headset_head_unit
I: [pulseaudio] backend-native.c: doing listen
D: [pulseaudio] bluez5-util.c: Transport /org/bluez/hci0/dev_FC_A8_9A_AC_72_44/fd19 state: disconnected -> idle
D: [pulseaudio] backend-native.c: Transport /org/bluez/hci0/dev_FC_A8_9A_AC_72_44/fd19 available for profile headset_head_unit
D: [pulseaudio] backend-native.c: RFCOMM << AT+VGS=15
D: [pulseaudio] backend-native.c: RFCOMM >> OK
I: [pulseaudio] backend-native.c: Lost RFCOMM connection.
D: [pulseaudio] bluez5-util.c: Transport /org/bluez/hci0/dev_FC_A8_9A_AC_72_44/fd19 state: idle -> disconnected
D: [pulseaudio] bluez5-util.c: dbus: path=/MediaEndpoint/A2DPSource, interface=org.bluez.MediaEndpoint1, member=SelectConfiguration
D: [pulseaudio] bluez5-util.c: Unknown interface org.freedesktop.DBus.Introspectable found, skipping
D: [pulseaudio] bluez5-util.c: Unknown interface org.bluez.MediaTransport1 found, skipping
D: [pulseaudio] bluez5-util.c: Unknown interface org.freedesktop.DBus.Properties found, skipping
D: [pulseaudio] bluez5-util.c: dbus: path=/MediaEndpoint/A2DPSource, interface=org.bluez.MediaEndpoint1, member=SetConfiguration
D: [pulseaudio] bluez5-util.c: Transport /org/bluez/hci0/dev_FC_A8_9A_AC_72_44/fd2 state: disconnected -> idle
E: [pulseaudio] bluez5-util.c: Assertion '!device->wait_for_profiles_timer' failed at /var/tmp/portage/media-sound/pulseaudio-10.0/work/pulseaudio-10.0/src/modules/bluetooth/bluez5-util.c:254, function device_start_waiting_for_profiles(). Aborting.


pulseaudio then crashes; the backtrace of the corefile shows this:

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007f4187cfce2a in __GI_abort () at abort.c:89
#2  0x00007f417b1eb9a5 in pa_bluetooth_transport_set_state () from /usr/lib64/pulse-10.0/modules/libbluez5-util.so
#3  0x00007f417b1ee500 in endpoint_set_configuration.isra () from /usr/lib64/pulse-10.0/modules/libbluez5-util.so
#4  0x00007f417b1ee95b in endpoint_handler () from /usr/lib64/pulse-10.0/modules/libbluez5-util.so
#5  0x00007f41884a2d53 in ?? () from /usr/lib64/libdbus-1.so.3
#6  0x00007f418849431c in dbus_connection_dispatch () from /usr/lib64/libdbus-1.so.3
#7  0x00007f41889c7524 in dispatch_cb () from /usr/lib64/pulseaudio/libpulsecommon-10.0.so
#8  0x00007f4188c1a32e in pa_mainloop_dispatch () from /usr/lib64/libpulse.so.0
#9  0x00007f4188c1a53c in pa_mainloop_iterate () from /usr/lib64/libpulse.so.0
#10 0x00007f4188c1a5e0 in pa_mainloop_run () from /usr/lib64/libpulse.so.0
#11 0x00000000004070c9 in main ()

bluez-5.44 is used.
Comment 1 Tanu Kaskinen 2017-03-16 21:14:42 UTC
Created attachment 130274 [details] [review]
0001-bluez5-util-fix-profile-waiting-logic.patch

Thanks for the report! I attached a patch, can you test it?
Comment 2 Manuel Lauss 2017-03-16 21:22:56 UTC
the patch doesn't apply to anyhting.  I think there's another patch missing,
because variable n_disconnected_profiles isn't in current -git.
Comment 3 Tanu Kaskinen 2017-03-16 21:33:50 UTC
Created attachment 130275 [details] [review]
0001-bluez5-util-fix-profile-waiting-logic.patch

Oh, I'm sorry. I had an old patch that also modifies the same logic, and I intended to amend that, but my new changes ended up in a separate patch, so the changes in the old patch were left out.

Here's an updated version.
Comment 4 Manuel Lauss 2017-03-16 21:43:20 UTC
That worked beautifully!  PA even switches to a2dp_sink automatically now, always had to it by hand previously.

Thank you very much!
Comment 5 Tanu Kaskinen 2017-03-29 09:21:43 UTC
The fix is now in master.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.