Public bug reported:

A bit of background (not sure if important): in our setup RFKill is
driving a GPIO to enable / disable the BT transceiver. This is a slow
operation and it could take ~500ms for the RFKill subsystem to complete
the operation.

In the Bluetooth configuration panel if I click on the Bluetooth on/off
toggle switch 5+ times in a row repeatedly, gnome (or BT configuration
panel) crashes.

This is what I have in the journal:
```
gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
kernel: BT_RADIO going: on
kernel: BCM_BT: going ON
gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
gnome-settings-[886]: Failed to set RFKill: Stream has outstanding operation
gnome-settings-daemon.desktop[886]: **
gnome-settings-daemon.desktop[886]: 
rfkill-plugin:ERROR:rfkill-glib.c:168:write_change_all_timeout_cb: assertion 
failed: (rfkill->priv->event)
```

Coredump:
```
Core was generated by `/usr/lib/gnome-settings-daemon/gnome-settings-daemon'.
Program terminated with signal SIGABRT, Aborted.
#0  __libc_do_syscall () at 
../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
44      ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file or 
directory.
(gdb) bt
#0  __libc_do_syscall () at 
../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
#1  0xf687bee6 in __GI_raise (sig=sig@entry=6) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:56
#2  0xf687cbee in __GI_abort () at abort.c:89
#3  0xf69bc7ea in g_assertion_message () from 
/lib/arm-linux-gnueabihf/libglib-2.0.so.0
#4  0xf69bc888 in g_assertion_message_expr () from 
/lib/arm-linux-gnueabihf/libglib-2.0.so.0
#5  0xf285d562 in write_change_all_timeout_cb (rfkill=0x643430, 
rfkill@entry=0x4b3f70) at rfkill-glib.c:168
#6  0xf285dc68 in cc_rfkill_glib_send_change_all_event (rfkill=0x4b3f70, 
rfkill_type=2, enable=0, cancellable=0xf285e0b8, callback=0xf285c709 
<rfkill_set_cb>,
    user_data=0x492b90) at rfkill-glib.c:242
#7  0xf285cf78 in engine_set_bluetooth_airplane_mode (enable=<optimized out>, 
manager=0x492b90) at gsd-rfkill-manager.c:345
#8  handle_set_property (connection=<optimized out>, sender=<optimized out>, 
object_path=<optimized out>, interface_name=<optimized out>,
    property_name=0xf490f528 "BluetoothAirplaneMode", value=0xf4919460, 
error=0xffc75dac, user_data=0x492b90) at gsd-rfkill-manager.c:395
#9  0xf6b162ea in ?? () from /lib/arm-linux-gnueabihf/libgio-2.0.so.0
```

At least for `assertion 'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed` what
I think it's happening here is that
`cc_rfkill_glib_send_change_all_event()` is rapidly called and several
request for the asynchronous writing are queued on several
`GSimpleAsyncResult` objects. When the first writing is done in
`write_change_all_done_cb()` the latest `rfkill->priv->simple` object is
freed. All the subsequent `write_change_all_done_cb()` callbacks find a
NULL `rfkill->priv->simple`.

** Affects: gnome-settings-daemon (Ubuntu)
     Importance: Undecided
         Status: New

** Description changed:

  A bit of background (not sure if important): in our setup RFKill is
  driving a GPIO to enable / disable the BT transceiver. This is a slow
  operation and it could take ~500ms for the RFKill subsystem to complete
  the operation.
  
  In the Bluetooth configuration panel if I click on the Bluetooth on/off
  toggle switch 5+ times in a row repeatedly, gnome (or BT configuration
  panel) crashes.
  
  This is what I have in the journal:
  ```
  gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  kernel: BT_RADIO going: on
  kernel: BCM_BT: going ON
  gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: Failed to set RFKill: Stream has outstanding operation
  gnome-settings-daemon.desktop[886]: **
  gnome-settings-daemon.desktop[886]: 
rfkill-plugin:ERROR:rfkill-glib.c:168:write_change_all_timeout_cb: assertion 
failed: (rfkill->priv->event)
  ```
  
  Coredump:
  ```
  Core was generated by `/usr/lib/gnome-settings-daemon/gnome-settings-daemon'.
  Program terminated with signal SIGABRT, Aborted.
  #0  __libc_do_syscall () at 
../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
  44      ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file 
or directory.
  (gdb) bt
  #0  __libc_do_syscall () at 
../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
  #1  0xf687bee6 in __GI_raise (sig=sig@entry=6) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:56
  #2  0xf687cbee in __GI_abort () at abort.c:89
  #3  0xf69bc7ea in g_assertion_message () from 
/lib/arm-linux-gnueabihf/libglib-2.0.so.0
  #4  0xf69bc888 in g_assertion_message_expr () from 
/lib/arm-linux-gnueabihf/libglib-2.0.so.0
  #5  0xf285d562 in write_change_all_timeout_cb (rfkill=0x643430, 
rfkill@entry=0x4b3f70) at rfkill-glib.c:168
- #6  0xf285dc68 in cc_rfkill_glib_send_change_all_event (rfkill=0x4b3f70, 
rfkill_type=2, enable=0, cancellable=0xf285e0b8, callback=0xf285c709 
<rfkill_set_cb>, 
-     user_data=0x492b90) at rfkill-glib.c:242
+ #6  0xf285dc68 in cc_rfkill_glib_send_change_all_event (rfkill=0x4b3f70, 
rfkill_type=2, enable=0, cancellable=0xf285e0b8, callback=0xf285c709 
<rfkill_set_cb>,
+     user_data=0x492b90) at rfkill-glib.c:242
  #7  0xf285cf78 in engine_set_bluetooth_airplane_mode (enable=<optimized out>, 
manager=0x492b90) at gsd-rfkill-manager.c:345
- #8  handle_set_property (connection=<optimized out>, sender=<optimized out>, 
object_path=<optimized out>, interface_name=<optimized out>, 
-     property_name=0xf490f528 "BluetoothAirplaneMode", value=0xf4919460, 
error=0xffc75dac, user_data=0x492b90) at gsd-rfkill-manager.c:395
+ #8  handle_set_property (connection=<optimized out>, sender=<optimized out>, 
object_path=<optimized out>, interface_name=<optimized out>,
+     property_name=0xf490f528 "BluetoothAirplaneMode", value=0xf4919460, 
error=0xffc75dac, user_data=0x492b90) at gsd-rfkill-manager.c:395
  #9  0xf6b162ea in ?? () from /lib/arm-linux-gnueabihf/libgio-2.0.so.0
  ```
  
- What I think it's happening here is that
+ At least for `assertion 'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed` what
+ I think it's happening here is that
  `cc_rfkill_glib_send_change_all_event()` is rapidly called and several
  request for the asynchronous writing are queued on several
  `GSimpleAsyncResult` objects. When the first writing is done in
  `write_change_all_done_cb()` the latest `rfkill->priv->simple` object is
  freed. All the subsequent `write_change_all_done_cb()` callbacks find a
  NULL `rfkill->priv->simple`.

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to gnome-settings-daemon in Ubuntu.
https://bugs.launchpad.net/bugs/1662836

Title:
  repeatedly turning BT off and off crashes gnome

Status in gnome-settings-daemon package in Ubuntu:
  New

Bug description:
  A bit of background (not sure if important): in our setup RFKill is
  driving a GPIO to enable / disable the BT transceiver. This is a slow
  operation and it could take ~500ms for the RFKill subsystem to
  complete the operation.

  In the Bluetooth configuration panel if I click on the Bluetooth
  on/off toggle switch 5+ times in a row repeatedly, gnome (or BT
  configuration panel) crashes.

  This is what I have in the journal:
  ```
  gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  kernel: BT_RADIO going: on
  kernel: BCM_BT: going ON
  gnome-settings-[886]: g_simple_async_result_take_error: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: g_simple_async_result_complete_in_idle: assertion 
'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed
  gnome-settings-[886]: Failed to set RFKill: Stream has outstanding operation
  gnome-settings-daemon.desktop[886]: **
  gnome-settings-daemon.desktop[886]: 
rfkill-plugin:ERROR:rfkill-glib.c:168:write_change_all_timeout_cb: assertion 
failed: (rfkill->priv->event)
  ```

  Coredump:
  ```
  Core was generated by `/usr/lib/gnome-settings-daemon/gnome-settings-daemon'.
  Program terminated with signal SIGABRT, Aborted.
  #0  __libc_do_syscall () at 
../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
  44      ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file 
or directory.
  (gdb) bt
  #0  __libc_do_syscall () at 
../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
  #1  0xf687bee6 in __GI_raise (sig=sig@entry=6) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:56
  #2  0xf687cbee in __GI_abort () at abort.c:89
  #3  0xf69bc7ea in g_assertion_message () from 
/lib/arm-linux-gnueabihf/libglib-2.0.so.0
  #4  0xf69bc888 in g_assertion_message_expr () from 
/lib/arm-linux-gnueabihf/libglib-2.0.so.0
  #5  0xf285d562 in write_change_all_timeout_cb (rfkill=0x643430, 
rfkill@entry=0x4b3f70) at rfkill-glib.c:168
  #6  0xf285dc68 in cc_rfkill_glib_send_change_all_event (rfkill=0x4b3f70, 
rfkill_type=2, enable=0, cancellable=0xf285e0b8, callback=0xf285c709 
<rfkill_set_cb>,
      user_data=0x492b90) at rfkill-glib.c:242
  #7  0xf285cf78 in engine_set_bluetooth_airplane_mode (enable=<optimized out>, 
manager=0x492b90) at gsd-rfkill-manager.c:345
  #8  handle_set_property (connection=<optimized out>, sender=<optimized out>, 
object_path=<optimized out>, interface_name=<optimized out>,
      property_name=0xf490f528 "BluetoothAirplaneMode", value=0xf4919460, 
error=0xffc75dac, user_data=0x492b90) at gsd-rfkill-manager.c:395
  #9  0xf6b162ea in ?? () from /lib/arm-linux-gnueabihf/libgio-2.0.so.0
  ```

  At least for `assertion 'G_IS_SIMPLE_ASYNC_RESULT (simple)' failed`
  what I think it's happening here is that
  `cc_rfkill_glib_send_change_all_event()` is rapidly called and several
  request for the asynchronous writing are queued on several
  `GSimpleAsyncResult` objects. When the first writing is done in
  `write_change_all_done_cb()` the latest `rfkill->priv->simple` object
  is freed. All the subsequent `write_change_all_done_cb()` callbacks
  find a NULL `rfkill->priv->simple`.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-settings-daemon/+bug/1662836/+subscriptions

-- 
Mailing list: https://launchpad.net/~desktop-packages
Post to     : desktop-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~desktop-packages
More help   : https://help.launchpad.net/ListHelp

Reply via email to