[pulseaudio-tickets] [Bug 107081] New: pulseaudio 12.0 crashes with SIGABRT when trying to switch Bluetooth headset profile

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=107081

            Bug ID: 107081
           Summary: pulseaudio 12.0 crashes with SIGABRT when trying to
                    switch Bluetooth headset profile
           Product: PulseAudio
           Version: unspecified
          Hardware: x86-64 (AMD64)
                OS: Linux (All)
            Status: NEW
          Severity: major
          Priority: medium
         Component: modules
          Assignee: pulseaudio-bugs at lists.freedesktop.org
          Reporter: dominik at greysector.net
        QA Contact: pulseaudio-bugs at lists.freedesktop.org
                CC: lennart at poettering.net

This was originally reported on Fedora 28:
https://bugzilla.redhat.com/show_bug.cgi?id=1594596 .

Description of problem:
pulseaudio crashes with SIGABRT when trying to switch Bluetooth headset
profile.

Version-Release number of selected component (if applicable):
$ rpm -qa blue\* pulse\* |sort
blueberry-1.2.2-1.fc28.noarch
bluez-5.50-1.fc28.x86_64
bluez-cups-5.50-1.fc28.x86_64
bluez-hcidump-2.5-11.fc28.x86_64
bluez-hid2hci-5.50-1.fc28.x86_64
bluez-libs-5.50-1.fc28.x86_64
bluez-obexd-5.50-1.fc28.x86_64
bluez-tools-0.2.0-0.7.git20170912.7cb788c.fc28.x86_64
pulseaudio-12.0-1.fc28.x86_64
pulseaudio-libs-12.0-1.fc28.i686
pulseaudio-libs-12.0-1.fc28.x86_64
pulseaudio-libs-glib2-12.0-1.fc28.x86_64
pulseaudio-module-bluetooth-12.0-1.fc28.x86_64
pulseaudio-module-x11-12.0-1.fc28.x86_64
pulseaudio-utils-12.0-1.fc28.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Connect a BT headset (Jabra Evolve 65)
2. pactl set-card-profile bluez_card.aa_bb_cc_xx_yy_zz a2dp_sink

Actual results:
Connection failure: Connection terminated
(pulseaudio crashes)

Expected results:
New sink with A2DP profile becomes available.

Additional info:
gdb backtrace:
$ gdb pulseaudio /var/spool/abrt/ccpp-2018-06-24-23:42:32.635655-16789/coredump
GNU gdb (GDB) Fedora 8.1-15.fc28
...
Core was generated by `/usr/bin/pulseaudio --daemonize=no'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007f5a6fddff2b in raise () from /lib64/libc.so.6
[Current thread is 1 (Thread 0x7f5a738b4980 (LWP 16789))]
(gdb) where
#0  0x00007f5a6fddff2b in raise () from /lib64/libc.so.6
#1  0x00007f5a6fdca561 in abort () from /lib64/libc.so.6
#2  0x00007f5a64022765 in start_thread (u=u at entry=0x5634fe461120) at
modules/bluetooth/module-bluez5-device.c:1731
#3  0x00007f5a64025583 in set_profile_cb (c=<optimized out>,
new_profile=0x5634fe579d20)
    at modules/bluetooth/module-bluez5-device.c:2075
#4  0x00007f5a7344216e in pa_card_set_profile (c=c at entry=0x5634fe4be810,
profile=profile at entry=0x5634fe579d20, 
    save=save at entry=true) at pulsecore/card.c:318
#5  0x00007f5a6884f62d in command_set_card_profile (pd=<optimized out>,
command=<optimized out>, tag=2, 
    t=<optimized out>, userdata=<optimized out>) at
pulsecore/protocol-native.c:4728
#6  0x00007f5a72675203 in pa_pdispatch_run (pd=0x5634fe57ec90,
packet=packet at entry=0x5634fe5295f0, 
    ancil_data=ancil_data at entry=0x5634fe45ef18,
userdata=userdata at entry=0x5634fe4ba430) at pulsecore/pdispatch.c:346
#7  0x00007f5a68857ee9 in pstream_packet_callback (p=0x5634fe45ec80,
packet=0x5634fe5295f0, ancil_data=0x5634fe45ef18, 
    userdata=0x5634fe4ba430) at pulsecore/protocol-native.c:4951
#8  0x00007f5a72677bfd in do_read (p=p at entry=0x5634fe45ec80,
re=re at entry=0x5634fe45ee48) at pulsecore/pstream.c:1012
#9  0x00007f5a7267aa4b in do_pstream_read_write (p=0x5634fe45ec80) at
pulsecore/pstream.c:248
#10 0x00007f5a7267adfd in srb_callback (srb=0x5634fe49ad90,
userdata=0x5634fe45ec80) at pulsecore/pstream.c:287
#11 0x00007f5a7267b68a in srbchannel_rwloop (sr=0x5634fe49ad90) at
pulsecore/srbchannel.c:190
#12 0x00007f5a731ed798 in dispatch_pollfds (m=0x5634fe366970) at
pulse/mainloop.c:140
#13 pa_mainloop_dispatch (m=m at entry=0x5634fe366970) at pulse/mainloop.c:898
#14 0x00007f5a731eda70 in pa_mainloop_iterate (m=0x5634fe366970,
block=<optimized out>, retval=0x7ffcb566f698)
    at pulse/mainloop.c:929
#15 0x00007f5a731edb10 in pa_mainloop_run (m=0x5634fe366970,
retval=0x7ffcb566f698) at pulse/mainloop.c:945
#16 0x00005634fe0e006f in main (argc=<optimized out>, argv=<optimized out>) at
daemon/main.c:1144
(gdb)

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/pulseaudio-bugs/attachments/20180630/0ec5d54b/attachment.html>