Bluetoothd crashing on 4.7

Hi:

I recently packaged bluez 4.7 for possible inclusion in Ubuntu intrepid [1]. Upon doing some basic testing with it, I've run into a situation where when I try to pair with a keyboard, bluetoothd crashes. If I run it under valgrind, bluetoothd survives the crash, and the keyboard works [2]. If I run it with gdb, it comes down, and I get a trace at least[3]. If I run it without a debugger, keyboard doesn't properly work.

[1] https://bugs.edge.launchpad.net/~superm1/+archive
[2] http://paste.ubuntu.com/51091/
[3] http://paste.ubuntu.com/51090/

Regards

Mario Limonciello
*Dell | Linux Engineering*
[email protected]

So that this doesnt' get lost, I solved this myself on IRC. The attached patch resolves it.

/src/dbus-hci.c
=======================================

diff -Nur -x '*.orig' -x '*~' bluez-4.7/src/dbus-hci.c bluez-4.7.new/src/dbus-hci.c

--- bluez-4.7/src/dbus-hci.c 2008-09-26 00:39:55.000000000 -0500

+++ bluez-4.7.new/src/dbus-hci.c 2008-09-26 18:22:33.000000000 -0500

@@ -518,7 +518,7 @@

bonding = adapter_get_bonding_info(adapter);
- if (bacmp(&bonding->bdaddr, peer))
+ if (bonding && bacmp(&bonding->bdaddr, peer))
bonding = NULL;
if (status == 0) {

Mario Limonciello
*Dell | Linux Engineering*
[email protected]

Hi Mario,

This is probably caused by my cleanup/rewrite patches for the pairing logic in 4.7. Based on the gdb trace the attached patch should fix the issue. It's also pushed to the kernel.org git and should appear in the next release.

Johan

commit cccde44377fc5bb5d9db51ca6b4fcb790c7d24ba

Author: Johan Hedberg <[email protected]>
Date:   Sat Sep 27 14:08:42 2008 -0700

Fix potential NULL pointer dereference

index 795df0a..eea166e 100644
@@ -518,7 +518,7 @@ void hcid_dbus_bonding_process_complete(bdaddr_t *local, bdaddr_t *peer,
 
 	bonding = adapter_get_bonding_info(adapter);
 
-	if (bacmp(&bonding->bdaddr, peer))
+	if (bonding && bacmp(&bonding->bdaddr, peer))
 		bonding = NULL;
 
 	if (status == 0) {