[Bug 794331] pulseaudio segfaults for bluetooth devices

17 Dec 2012

      https://bugzilla.novell.com/show_bug.cgi?id=794331

https://bugzilla.novell.com/show_bug.cgi?id=794331#c6

--- Comment #6 from Petr Tesařík <ptesarik@suse.com> 2012-12-17 12:18:08 UTC ---
Output of hwinfo --bluetooth:

04: USB 00.0: 11500 Bluetooth Device                            
  [Created at usb.122]
  Unique ID: PYMB.nQKjiuCfL84
  Parent ID: zPk0.7gZT0a5zLs5
  SysFS ID: /devices/pci0000:00/0000:00:1a.1/usb4/4-1/4-1:1.0
  SysFS BusID: 4-1:1.0
  Hardware Class: bluetooth
  Model: "Cambridge Silicon Radio Bluetooth Dongle (HCI mode)"
  Hotplug: USB
  Vendor: usb 0x0a12 "Cambridge Silicon Radio, Ltd"
  Device: usb 0x0001 "Bluetooth Dongle (HCI mode)"
  Revision: "19.58"
  Driver: "btusb"
  Driver Modules: "btusb"
  Speed: 12 Mbps
  Module Alias: "usb:v0A12p0001d1958dcE0dsc01dp01icE0isc01ip01"
  Driver Info #0:
    Driver Status: btusb is active
    Driver Activation Cmd: "modprobe btusb"
  Config Status: cfg=new, avail=yes, need=no, active=unknown
  Attached to: #3 (Hub)

Output of hciconfig -a:
hci0:   Type: BR/EDR  Bus: USB
        BD Address: 00:15:83:3D:0A:57  ACL MTU: 384:8  SCO MTU: 64:8
        UP RUNNING PSCAN 
        RX bytes:60691936 acl:82 sco:1186838 events:263 errors:0
        TX bytes:60265716 acl:112 sco:1181803 commands:66 errors:185
        Features: 0xff 0xff 0x8f 0xfe 0x9b 0xf9 0x00 0x80
        Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3 
        Link policy: RSWITCH HOLD SNIFF PARK 
        Link mode: SLAVE ACCEPT 
        Name: 'Azariah'
        Class: 0x580100
        Service Classes: Capturing, Object Transfer, Telephony
        Device Class: Computer, Uncategorized
        HCI Version: 2.0 (0x3)  Revision: 0x7a6
        LMP Version: 2.0 (0x3)  Subversion: 0x7a6
        Manufacturer: Cambridge Silicon Radio (10)

Output of hciconfig hci0 voice:
hci0:   Type: BR/EDR  Bus: USB
        BD Address: 00:15:83:3D:0A:57  ACL MTU: 384:8  SCO MTU: 64:8
        Voice setting: 0x0060 (Default Condition)
        Input Coding: Linear
        Input Data Format: 2's complement
        Input Sample Size: 16 bit
        # of bits padding at MSB: 0
        Air Coding Format: CVSD

Output of hcitool con:
Connections:
        > ACL EE:42:0E:44:11:24 handle 42 state 1 lm MASTER AUTH ENCRYPT 

Output of hcitool info EE:42:0E:44:11:24:
        BD Address:  EE:42:0E:44:11:24
        Device Name: Eurobird EBH-420
        LMP Version: 2.1 (0x4) LMP Subversion: 0x422
        Manufacturer: Integrated System Solution Corp. (57)
        Features page 0: 0xbf 0xff 0xff 0xfe 0x88 0x3d 0x19 0x82
                <3-slot packets> <5-slot packets> <encryption> <slot offset> 
                <timing accuracy> <role switch> <sniff mode> <park state> 
                <RSSI> <channel quality> <SCO link> <HV2 packets> 
                <HV3 packets> <u-law log> <A-law log> <CVSD> <paging scheme> 
                <power control> <transparent SCO> <broadcast encrypt> 
                <EDR ACL 2 Mbps> <EDR ACL 3 Mbps> <enhanced iscan> 
                <interlaced iscan> <interlaced pscan> <inquiry with RSSI> 
                <extended SCO> <AFH cap. slave> <3-slot EDR ACL> 
                <5-slot EDR ACL> <pause encryption> <AFH cap. master> 
                <AFH class. master> <EDR eSCO 2 Mbps> <extended inquiry> 
                <simple pairing> <encapsulated PDU> <inquiry TX power> 
                <extended features> 
        Features page 1: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00

And most importantly, output of
dbus-send --system --dest=org.bluez --print-reply
/org/bluez/27561/hci0/dev_EE_42_0E_44_11_24/fd3
org.bluez.MediaTransport.GetProperties

method return sender=:1.193 -> dest=:1.274 reply_serial=2
   array [
      dict entry(
         string "Device"
         variant             object path
"/org/bluez/27561/hci0/dev_EE_42_0E_44_11_24"
      )
      dict entry(
         string "UUID"
         variant             string "0000111f-0000-1000-8000-00805f9b34fb"
      )
      dict entry(
         string "Codec"
         variant             byte 0
      )
      dict entry(
         string "Configuration"
         variant             array [
            ]
      )
      dict entry(
         string "NREC"
         variant             boolean true
      )
      dict entry(
         string "InbandRingtone"
         variant             boolean false
      )
      dict entry(
         string "Routing"
         variant             string "HCI"
      )
   ]

I know that the noise-reduction/echo cancellation (NREC) property is optional,
but if the pulseaudio bluetooth module decided to implement it, then it must be
implemented properly, because dbus_message_iter_get_basic() will overwrite 4
bytes starting at the given address, so if you only reserve 1 byte (type
pa_bool_t), the call will overwrite the following variable.

I fail to see how this depends on my hardware configuration, sorry.

BTW upstream is already fixed (just with a slightly different patch), see
http://cgit.freedesktop.org/pulseaudio/pulseaudio/commit/src/modules/bluetoo...

Would you mind backporting that fix to openSUSE?

-- 
Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug 794331] pulseaudio segfaults for bluetooth devices

bugzilla_noreply＠novell.com