** Description changed: - [Summary] - On Ubuntu 26.04 (bluez 5.85), transferring a file over Bluetooth (OBEX/OPP) between two - Ubuntu systems pops up an apport crash-report dialog. The file transfer itself completes - successfully -- the dialog is caused by a crash of the per-user `mpris-proxy` service, not - by a transfer failure. Reproduces 100% between two 26.04 systems. + [ Impact ] - [Steps to reproduce] + On Ubuntu 26.04 (bluez 5.85), the per-user `mpris-proxy` service crashes with + SIGSEGV whenever an `org.bluez.obex.Transfer1` object emits a Status change -- + which happens on every OBEX transfer, including an incoming Bluetooth file push. + The crash produces an apport crash-report dialog (update-notifier-crash -> + whoopsie -> apport-gtk). The file transfer itself still completes, but the user + is presented with a crash dialog every time, and the MPRIS/AVRCP media-control + bridge dies and must be restarted. + + Root cause: in `tools/mpris-proxy.c`, `find_player_by_obex()` and related + helpers dereference `player->obex` (and its inner `->obex` proxy) without a NULL + check. A player legitimately has no OBEX session in three ordinary cases and + stays on the players list in each: + - register_player(): the remote exposes no ObexPort (no AVRCP cover art); + - device_property_changed(): the device disconnected; + - obex_proxy_removed(): obexd went away. + + Because `g_dbus_client_new()` roots the OBEX client at "/", mpris-proxy proxies + all of obexd's objects, including the server-side transfers obexd registers at + /org/bluez/obex/server/sessionN/transferM for an incoming push. Those paths + never belong to a player, so walking the list faults on the first player whose + session is NULL. Any peer pushing a file over OBEX therefore crashes mpris-proxy + as soon as one registered player lacks a cover-art session (the common config). + + This only affects 26.04: the BIP cover-art path (find_player_by_obex) was added + between bluez 5.77 and 5.80; 24.04 ships bluez 5.72 without it. + + [ Test Plan ] + + Two Ubuntu 26.04 systems with working Bluetooth are required (or use the + hardware-free D-Bus reproducer in bluez issue #2569). + 1. Install Ubuntu 26.04 on two systems (SUTs). - 2. Settings -> Bluetooth -> pair/connect the two systems. - 3. Send a file from one system to the other over Bluetooth. - 4. An error / crash-report dialog pops up (the file still arrives). + 2. Settings -> Bluetooth -> pair and connect the two systems. + 3. Confirm `mpris-proxy` is running: `systemctl --user status mpris-proxy.service`. + 4. Send a file from one system to the other over Bluetooth (OBEX/OPP). - [Expected] - The file transfers without any crash/apport dialog; mpris-proxy does not crash. + Without the fix: an apport crash dialog pops up; the journal shows + `mpris-proxy[...]: segfault at 8 ...` and + `mpris-proxy.service: ... code=dumped, status=11/SEGV`. The file still arrives. - [Actual] - mpris-proxy crashes with SIGSEGV during the transfer, producing an apport crash dialog - (update-notifier-crash -> whoopsie -> apport-gtk). + With the fix: the file transfers with no crash dialog, and + `systemctl --user status mpris-proxy.service` shows no core dump. - [Root cause] - In bluez `tools/mpris-proxy.c`, `find_player_by_obex()` dereferences `player->obex->obex` - without a NULL check. `player->obex` stays NULL when the bluez MediaPlayer object has no - `ObexPort` property (an Experimental property, disabled by default), yet `register_player()` - still adds such a player to its list. Every OBEX PUT emits a - `Transfer1 PropertiesChanged(Status)` -> `obex_property_changed()` -> - `find_player_by_obex()` -> NULL dereference -> SIGSEGV. The faulting address (0x8, user-mode - read) matches the struct layout, confirming this code path. + Quick confirmation of the root cause (without the fix): + `systemctl --user mask mpris-proxy.service` on both units, then repeat the + transfer -- the dialog no longer appears because the crashing service is absent. - Example journal (sosreport): - obexd[...]: PUT(0x2), Continue(0x10) - kernel: mpris-proxy[...]: segfault at 8 ip ... error 4 in mpris-proxy[...] - systemd[...]: mpris-proxy.service: Main process exited, code=dumped, status=11/SEGV + [ Where problems could occur ] - [Why 26.04 only] - The BIP cover-art path (find_player_by_obex) was added between bluez 5.77 and 5.80; - Ubuntu 24.04 ships bluez 5.72 which does not contain it. No hardware/firmware factor. + The change is confined to `tools/mpris-proxy.c` (the mpris-proxy utility only); + it does not touch the bluetoothd daemon, the OBEX daemon, or any library. It + only adds defensive NULL/early-return guards before existing dereferences and + replaces one `g_dbus_proxy_unref()` with `g_clear_pointer()` on the same pointer, + so it cannot introduce new dereferences. The worst plausible regression is that + a player whose OBEX session is transiently NULL is skipped in + find_player_by_obex() for that one PropertiesChanged event -- i.e. a cover-art + update could be missed in a race window -- which is strictly better than the + current unconditional crash. If anything regressed, it would be visible as + missing AVRCP cover-art images; core media playback/control is unaffected. - [Upstream fix] - PR: bluez #2098 "mpris-proxy: Fix possible crash" adds NULL checks to all four - `player->obex` dereference sites (references Red Hat BZ 2466640 with the identical - backtrace). NOTE: the PR is currently CLOSED without merge, and bluez 5.86 / 5.87 / master - still contain the unguarded code -- no released bluez includes the fix yet. An Ubuntu SRU - would need to carry PR #2098 as a delta patch (with line-offset adjustment). + [ Other Info ] - [Workaround / verification] - On both systems: `systemctl --user mask mpris-proxy.service`, then repeat the transfer -- - the crash dialog no longer appears, confirming the root cause. - - [Environment] - Ubuntu 26.04.1 LTS, kernel 7.3.0-9002-oem, bluez 5.85-4ubuntu0.x. - - (Filed from internal tracking WTN-503.) + * Upstream fix: PR https://github.com/bluez/bluez/pull/2098 + (Bastien Nocera, "mpris-proxy: Fix possible crash"; Closes Red Hat + BZ 2466640). The PR passed CI but was auto-closed without landing; bluez + 5.86/5.87/master still carry the unguarded code, so this is carried as an + Ubuntu delta. + * Additional analysis and an extra guard for the inner `session->obex` + (a failed CreateSession can leave it NULL) are described in bluez issue + https://github.com/bluez/bluez/issues/2569. The Ubuntu patch includes that + extra guard on top of PR #2098. + * Internal tracking: WTN-503.
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172906 Title: mpris-proxy segfault (NULL deref in find_player_by_obex) triggers apport crash dialog during Bluetooth OBEX file transfer on 26.04 To manage notifications about this bug go to: https://bugs.launchpad.net/oem-priority/+bug/2172906/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
