Hi Arthur,
On Wed, Jun 3, 2020 at 2:45 AM Arthur Lambert <lambertarthur22@xxxxxxxxx> wrote:
>
> Hello,
>
> I am working on an embedded device with Bluez 5.54.
> My bluez init script for the bluetoothd demon :
>
> # cat /etc/init.d/S19_bluez
> #!/bin/sh
>
> start() {
> echo -n "Starting $0: "
> #bluetoothd -dE&
> echo "Done."
> }
>
> (...)
>
> To initialize my hci0, we are using btmgmt :
>
> /usr/bin/btmgmt -i hci0 power off
> /usr/bin/btmgmt -i hci0 le on
> /usr/bin/btmgmt -i hci0 bredr on
> /usr/bin/btmgmt -i hci0 connectable on
> /usr/bin/btmgmt -i hci0 bondable on
> /usr/bin/btmgmt -i hci0 discov on
> /usr/bin/btmgmt -i hci0 name XXXXX-HEADBAND-V2
> /usr/bin/btmgmt -i hci0 advertising on
> /usr/bin/btmgmt -i hci0 power on
>
> Log from bluetoothd:
>
> # valgrind --leak-check=no --show-reachable=no
> --show-possibly-lost=no --track-origins=yes bluetoothd -dEn
> ==237== Memcheck, a memory error detector
> ==237== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
> ==237== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
> ==237== Command: bluetoothd -dEn
> ==237==
> ==237== Invalid read of size 4
> ==237== at 0x4005458: _dl_get_ready_to_run (in /lib/ld-uClibc-1.0.31.so)
> ==237== Address 0x7dffc934 is on thread 1's stack
> ==237== 20 bytes below stack pointer
> ==237==
> ==237== Invalid read of size 4
> ==237== at 0x4B05AB8: __uClibc_main (in /lib/libuClibc-1.0.31.so)
> ==237== Address 0x7dffcbec is on thread 1's stack
> ==237== 20 bytes below stack pointer
> ==237==
> bluetoothd[237]: Bluetooth daemon 5.54
> bluetoothd[237]: src/main.c:parse_config() parsing /etc/bluetooth/main.conf
> bluetoothd[237]: src/main.c:parse_config() Key file does not have key
> “DiscoverableTimeout” in group “General”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have key
> “AlwaysPairable” in group “General”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have key
> “PairableTimeout” in group “General”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have key
> “Privacy” in group “General”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have key
> “JustWorksRepairing” in group “General”
> bluetoothd[237]: src/main.c:parse_config() name=XXXXX-HEADBAND-V2
> bluetoothd[237]: src/main.c:parse_config() Key file does not have key
> “Class” in group “General”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have key
> “DeviceID” in group “General”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have key
> “ReverseServiceDiscovery” in group “General”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have group “GATT”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have group “GATT”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have group “GATT”
> bluetoothd[237]: src/main.c:parse_config() Key file does not have group “GATT”
> bluetoothd[237]: src/adapter.c:adapter_init() sending read version command
> bluetoothd[237]: Starting SDP server
> bluetoothd[237]: src/sdpd-service.c:register_device_id() Adding device
> id record for 0002:1d6b:0246:0536
> bluetoothd[237]: src/plugin.c:plugin_init() Loading builtin plugins
> bluetoothd[237]: src/plugin.c:add_plugin() Loading hostname plugin
> bluetoothd[237]: src/plugin.c:add_plugin() Loading wiimote plugin
> bluetoothd[237]: src/plugin.c:add_plugin() Loading autopair plugin
> bluetoothd[237]: src/plugin.c:add_plugin() Loading policy plugin
> bluetoothd[237]: src/plugin.c:add_plugin() Loading network plugin
> bluetoothd[237]: src/plugin.c:add_plugin() Loading input plugin
> bluetoothd[237]: src/plugin.c:add_plugin() Loading hog plugin
> bluetoothd[237]: src/plugin.c:add_plugin() Loading gap plugin
> bluetoothd[237]: src/plugin.c:add_plugin() Loading scanparam plugin
> bluetoothd[237]: src/plugin.c:add_plugin() Loading deviceinfo plugin
> bluetoothd[237]: src/plugin.c:plugin_init() Loading plugins
> /usr/lib/bluetooth/plugins
> bluetoothd[237]: profiles/input/suspend-none.c:suspend_init()
> bluetoothd[237]: profiles/network/manager.c:read_config() Config
> options: Security=true
> bluetoothd[237]: Failed to open RFKILL control device
> bluetoothd[237]: src/main.c:main() Entering main loop
> bluetoothd[237]: Bluetooth management interface 1.9 initialized
> bluetoothd[237]: src/adapter.c:read_version_complete() sending read
> supported commands command
> bluetoothd[237]: src/adapter.c:read_version_complete() sending read
> index list command
> bluetoothd[237]: src/adapter.c:read_commands_complete() Number of commands: 61
> bluetoothd[237]: src/adapter.c:read_commands_complete() Number of events: 34
> bluetoothd[237]: src/adapter.c:read_commands_complete() enabling
> kernel-side connection control
> bluetoothd[237]: src/adapter.c:read_index_list_complete() Number of
> controllers: 0
> bluetoothd[237]: src/adapter.c:index_added() index 0
> bluetoothd[237]: src/adapter.c:btd_adapter_new() System name: XXXXXX-HEADBAND-V2
> bluetoothd[237]: src/adapter.c:btd_adapter_new() Major class: 0
> bluetoothd[237]: src/adapter.c:btd_adapter_new() Minor class: 0
> bluetoothd[237]: src/adapter.c:btd_adapter_new() Modalias: usb:v1D6Bp0246d0536
> bluetoothd[237]: src/adapter.c:btd_adapter_new() Discoverable timeout:
> 180 seconds
> bluetoothd[237]: src/adapter.c:btd_adapter_new() Pairable timeout: 0 seconds
> bluetoothd[237]: src/adapter.c:index_added() sending read info command
> for index 0
> bluetoothd[237]: src/adapter.c:read_info_complete() index 0 status 0x00
> bluetoothd[237]: src/adapter.c:clear_uuids() sending clear uuids
> command for index 0
> bluetoothd[237]: src/adapter.c:clear_devices() sending clear devices
> command for index 0
> bluetoothd[237]: src/adapter.c:set_mode() sending set mode command for index 0
> bluetoothd[237]: src/adapter.c:set_mode() sending set mode command for index 0
> bluetoothd[237]: src/adapter.c:set_mode() sending set mode command for index 0
> bluetoothd[237]: src/adapter.c:set_privacy() sending set privacy
> command for index 0
> bluetoothd[237]: src/adapter.c:set_privacy() setting privacy mode 0x00
> for index 0
> bluetoothd[237]: src/gatt-database.c:btd_gatt_database_new() GATT
> Manager registered for adapter: /org/bluez/hci0
> bluetoothd[237]: src/adapter.c:adapter_service_add() /org/bluez/hci0
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Adding
> record with handle 0x10001
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Record
> pattern UUID 00000007-0000-1000-8000-00805f9
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Record
> pattern UUID 00000100-0000-1000-8000-00805f9
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Record
> pattern UUID 00001002-0000-1000-8000-00805f9
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Record
> pattern UUID 00001800-0000-1000-8000-00805f9
> bluetoothd[237]: src/adapter.c:adapter_service_insert() /org/bluez/hci0
> bluetoothd[237]: src/adapter.c:add_uuid() sending add uuid command for index 0
> bluetoothd[237]: src/adapter.c:adapter_service_add() /org/bluez/hci0
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Adding
> record with handle 0x10002
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Record
> pattern UUID 00000007-0000-1000-8000-00805f9
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Record
> pattern UUID 00000100-0000-1000-8000-00805f9
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Record
> pattern UUID 00001002-0000-1000-8000-00805f9
> bluetoothd[237]: src/sdpd-service.c:add_record_to_server() Record
> pattern UUID 00001801-0000-1000-8000-00805f9
> bluetoothd[237]: src/adapter.c:adapter_service_insert() /org/bluez/hci0
> bluetoothd[237]: src/adapter.c:add_uuid() sending add uuid command for index 0
> bluetoothd[237]: src/advertising.c:btd_adv_manager_new() LE
> Advertising Manager created for adapter: /org/bluez/hci0
> bluetoothd[237]: plugins/hostname.c:hostname_probe()
> bluetoothd[237]: profiles/network/manager.c:panu_server_probe() path
> /org/bluez/hci0
> bluetoothd[237]: profiles/network/server.c:server_register()
> Registered interface org.bluez.NetworkServer1 on path /org/bluez/hci0
> bluetoothd[237]: profiles/network/manager.c:gn_server_probe() path
> /org/bluez/hci0
> bluetoothd[237]: profiles/network/manager.c:nap_server_probe() path
> /org/bluez/hci0
> bluetoothd[237]: src/adapter.c:btd_adapter_unblock_address() hci0
> 00:00:00:00:00:00
> bluetoothd[237]: src/adapter.c:load_link_keys() hci0 keys 0 debug_keys 0
> bluetoothd[237]: src/adapter.c:load_ltks() hci0 keys 0
> bluetoothd[237]: src/adapter.c:load_irks() hci0 irks 0
> bluetoothd[237]: src/adapter.c:load_conn_params() hci0 conn params 0
> bluetoothd[237]: src/adapter.c:adapter_service_insert() /org/bluez/hci0
> bluetoothd[237]: src/adapter.c:add_uuid() sending add uuid command for index 0
> bluetoothd[237]: src/adapter.c:set_did() hci0 source 2 vendor 1d6b
> product 246 version 536
> bluetoothd[237]: src/adapter.c:adapter_register() Adapter
> /org/bluez/hci0 registered
> bluetoothd[237]: src/adapter.c:set_dev_class() sending set device
> class command for index 0
> bluetoothd[237]: src/adapter.c:set_name() sending set local name
> command for index 0
> bluetoothd[237]: src/adapter.c:new_settings_callback() Settings: 0x00000280
> bluetoothd[237]: src/adapter.c:settings_changed() Changed settings: 0x00000200
> bluetoothd[237]: src/adapter.c:settings_changed() Pending settings: 0x00000000
> bluetoothd[237]: src/adapter.c:new_settings_callback() Settings: 0x00000282
> bluetoothd[237]: src/adapter.c:settings_changed() Changed settings: 0x00000002
> bluetoothd[237]: src/adapter.c:settings_changed() Pending settings: 0x00000000
> bluetoothd[237]: src/adapter.c:new_settings_callback() Settings: 0x00000292
> bluetoothd[237]: src/adapter.c:settings_changed() Changed settings: 0x00000010
> bluetoothd[237]: src/adapter.c:settings_changed() Pending settings: 0x00000000
> bluetoothd[237]: src/adapter.c:new_settings_callback() Settings: 0x0000029a
> bluetoothd[237]: src/adapter.c:settings_changed() Changed settings: 0x00000008
> bluetoothd[237]: src/adapter.c:settings_changed() Pending settings: 0x00000000
> bluetoothd[237]: src/adapter.c:local_name_changed_callback() Name: TESTBENCH-V2
> bluetoothd[237]: src/adapter.c:local_name_changed_callback() Short name:
> bluetoothd[237]: src/adapter.c:local_name_changed_callback() Current
> alias: TESTBENCH-V2
> bluetoothd[237]: src/adapter.c:new_settings_callback() Settings: 0x0000069a
> bluetoothd[237]: src/adapter.c:settings_changed() Changed settings: 0x00000400
> bluetoothd[237]: src/adapter.c:settings_changed() Pending settings: 0x00000000
> bluetoothd[237]: Failed to clear UUIDs: Busy (0x0a)
> bluetoothd[237]: src/adapter.c:new_settings_callback() Settings: 0x0000069b
> bluetoothd[237]: src/adapter.c:settings_changed() Changed settings: 0x00000001
> bluetoothd[237]: src/adapter.c:settings_changed() Pending settings: 0x00000000
> bluetoothd[237]: src/adapter.c:adapter_start() adapter /org/bluez/hci0
> has been enabled
> bluetoothd[237]: src/adapter.c:trigger_passive_scanning()
> bluetoothd[237]: src/adapter.c:new_settings_callback() Settings: 0x000006db
> bluetoothd[237]: src/adapter.c:settings_changed() Changed settings: 0x00000040
> bluetoothd[237]: src/adapter.c:settings_changed() Pending settings: 0x00000000
> bluetoothd[237]: src/adapter.c:new_settings_callback() Settings: 0x00000edb
> bluetoothd[237]: src/adapter.c:settings_changed() Changed settings: 0x00000800
> bluetoothd[237]: src/adapter.c:settings_changed() Pending settings: 0x00000000
> bluetoothd[237]: Failed to set privacy: Rejected (0x0b)
> bluetoothd[237]: src/adapter.c:load_link_keys_complete() link keys
> loaded for hci0
> bluetoothd[237]: src/adapter.c:load_ltks_complete() LTKs loaded for hci0
> bluetoothd[237]: src/adapter.c:load_irks_complete() IRKs loaded for hci0
> bluetoothd[237]: src/adapter.c:load_conn_params_complete() Connection
> Parameters loaded for hci0
> bluetoothd[237]: src/adapter.c:local_name_changed_callback() Name:
> XXXXXX-HEADBAND-V2
> bluetoothd[237]: src/adapter.c:local_name_changed_callback() Short name:
> bluetoothd[237]: src/adapter.c:local_name_changed_callback() Current
> alias: XXXXXXX-HEADBAND-V2
>
> # run btgatt client here...
>
> bluetoothd[237]: src/adapter.c:connected_callback() hci0 device
> 80:32:53:37:58:A6 connected eir_len 0
> bluetoothd[237]: src/device.c:device_create() dst 80:32:53:37:58:A6
> bluetoothd[237]: src/device.c:device_new() address 80:32:53:37:58:A6
> bluetoothd[237]: src/device.c:device_new() Creating device
> /org/bluez/hci0/dev_80_32_53_37_58_A6
> bluetoothd[237]: src/gatt-database.c:connect_cb() New incoming LE ATT connection
> bluetoothd[237]: attrib/gattrib.c:g_attrib_ref() 0x4c56848: g_attrib_ref=1
> bluetoothd[237]: src/device.c:load_gatt_db() Restoring
> 80:32:53:37:58:A6 gatt database from file
> bluetoothd[237]: No cache for 80:32:53:37:58:A6
> bluetoothd[237]: src/gatt-client.c:btd_gatt_client_connected() Device connected.
> bluetoothd[237]: src/device.c:gatt_debug() MTU exchange complete, with MTU: 256
> bluetoothd[237]: src/device.c:gatt_debug() Read By Type - start:
> 0x0001 end: 0xffff
> bluetoothd[237]: src/device.c:gatt_debug() MTU Exchange failed. ATT ECODE: 0x06
> bluetoothd[237]: src/device.c:gatt_debug() Read By Grp Type - start:
> 0x0001 end: 0xffff
> bluetoothd[237]: src/device.c:gatt_debug() Read By Type - start:
> 0x0010 end: 0xffff
> bluetoothd[237]: src/device.c:gatt_debug() Primary service discovery
> failed. ATT ECODE: 0x06
> bluetoothd[237]: src/device.c:gatt_debug() Failed to initialize gatt-client
> bluetoothd[237]: src/device.c:gatt_client_ready_cb() status: failed, error: 6
> bluetoothd[237]: src/device.c:device_svc_resolved()
> /org/bluez/hci0/dev_80_32_53_37_58_A6 err -5
> bluetoothd[237]: src/device.c:gatt_debug() Read By Grp Type - start:
> 0x0010 end: 0xffff
> bluetoothd[237]: src/device.c:gatt_debug() Read By Grp Type - start:
> 0x0001 end: 0xffff
> bluetoothd[237]: src/device.c:gatt_debug() Read By Type - start:
> 0x0001 end: 0x000f
> bluetoothd[237]: src/device.c:gatt_debug() Read By Type - start:
> 0x0001 end: 0x000f
> bluetoothd[237]: src/device.c:gatt_debug() Read By Type - start:
> 0x000f end: 0x000f
> bluetoothd[237]: src/device.c:gatt_debug() Read By Type - start:
> 0x0001 end: 0xffff
> bluetoothd[237]: src/gatt-database.c:db_hash_read_cb() Database Hash read
> ==237== Invalid read of size 1
> ==237== at 0x4831BA4: memcpy (vg_replace_strmem.c:1035)
> ==237== by 0x79E1B: ??? (in /usr/bin/bluetoothd)
> ==237== Address 0x0 is not stack'd, malloc'd or (recently) free'd
Looks like a NULL pointer, it would be great if you could provide the
backtrace with source symbols though.
> ==237==
> ==237== Process terminating with default action of signal 11 (SIGSEGV)
> ==237== Access not within mapped region at address 0x0
> ==237== at 0x4831BA4: memcpy (vg_replace_strmem.c:1035)
> ==237== by 0x79E1B: ??? (in /usr/bin/bluetoothd)
> ==237== If you believe this happened as a result of a stack
> ==237== overflow in your program's main thread (unlikely but
> ==237== possible), you can try to increase the size of the
> ==237== main thread stack using the --main-stacksize= flag.
> ==237== The main thread stack size used in this run was 8388608.
> /usr/bin/bluetoothd: can't resolve symbol '__libc_freeres'
> ==237==
> ==237== HEAP SUMMARY:
> ==237== in use at exit: 40,320 bytes in 860 blocks
> ==237== total heap usage: 4,297 allocs, 3,437 frees, 981,133 bytes allocated
> ==237==
> ==237== For a detailed leak analysis, rerun with: --leak-check=full
> ==237==
> ==237== For counts of detected and suppressed errors, rerun with: -v
> ==237== ERROR SUMMARY: 57 errors from 3 contexts (suppressed: 0 from 0)
> Segmentation fault
>
> From my host, I run this command to trigger the segmentation fault :
> [arthur ] sudo ./btgatt-client -i hci0 -d cc:c0:79:ce:f9:56 -m 256
> Connecting to device... Done
> [GATT client]# Service Added - UUID:
> 00001800-0000-1000-8000-00805f9b34fb start: 0x0001 end: 0x0005
> [GATT client]# Service Added - UUID:
> 00001801-0000-1000-8000-00805f9b34fb start: 0x0006 end: 0x000f
> [GATT client]# GATT discovery procedures failed - error code: 0x00
> [GATT client]# Device disconnected: Connection reset by peer
> Shutting down...
>
> When I run the test with btgatt-client from 5.50 release, there is no issue.
> Is it normal?
--
Luiz Augusto von Dentz
