search

GrapheneOS / os-issue-tracker

Issue tracker for GrapheneOS Android Open Source Project hardening work. Standalone projects like Auditor, AttestationServer and hardened_malloc have their own dedicated trackers.
https://grapheneos.org/
365 stars 21 forks source link

Phone reboots when visiting a website #2664

Closed connorlanigan closed 11 months ago

connorlanigan commented 1 year ago

This issue happens on a Pixel 6 running the GrapheneOS Stable channel, with build version UP1A.231005.007.2023103100.

The issue reproduces reliably on my device on every attempt (more than ten times now).

Steps

  1. Visit https://huggingface.co/spaces/dylanebert/igf in Vanadium or Chrome on a Pixel 6
  2. Tap "3D Gaussian Splatting"
  3. Tap "Bicycle"
  4. Wait for the loading progress bar to reach about 100% (this takes about 2 minutes on my Pixel 6).
  5. The phone then stops responding to gesture navigation. After a few more seconds, the screen turns off and the phone boots from the bootloader.

On a (different) Pixel device with stock Android, the page loads successfully instead without rebooting the device.

Logs

Logcat The last lines of `logcat` before the device reboots and `logcat` stops: ``` 11-07 17:46:49.225 12740 12740 D CellBroadcastReceiver: update supported roaming operator as 11-07 17:46:49.232 2335 2335 I Telephony: TelecomAccountTelephonyCallback: onServiceStateChanged: newState=0, mServiceState=0 11-07 17:46:49.233 2335 2335 I Telephony: isRttCurrentlySupported -- regular acct, hasVoiceAvailability: true 11-07 17:46:49.233 2335 2335 I Telephony: isRttSupported: false 11-07 17:46:49.233 2335 2335 I Telephony: alwaysAllowWhileRoaming: false 11-07 17:46:49.233 2335 2335 I Telephony: isRoaming: false 11-07 17:46:49.233 2335 2335 I Telephony: isOnWfc: false 11-07 17:46:49.519 2308 2308 I SHANNON_IMS: 2630 [CALL] isEmcAvailable for true (ImsCallManager%isEmcAvailable:1428) 11-07 17:46:49.665 534 534 I lowmemorykiller: Kill 'se.matpajobbet' (11515), uid 10281, oom_score_adj 999 to free 103972kB rss, 34728kB swap; reason: low watermark is breached and swap is low (32kB < 314572kB) 11-07 17:46:49.710 1402 6039 I ActivityManager: Process se.matpajobbet (pid 11515) has died: cch+99 CEM 11-07 17:46:49.711 865 865 I Zygote : Process 11515 exited due to signal 9 (Killed) 11-07 17:46:49.711 534 534 I lowmemorykiller: Kill 'com.android.managedprovisioning' (11841), uid 1310031, oom_score_adj 999 to free 126084kB rss, 916kB swap; reason: low watermark is breached and swap is low (34760kB < 314572kB) 11-07 17:46:49.712 1402 1633 D DisplayManagerService: Drop pending events for gone uid 10281 11-07 17:46:49.713 1402 1649 I libprocessgroup: Successfully killed process cgroup uid 10281 pid 11515 in 2ms 11-07 17:46:49.753 1402 14393 I ActivityManager: Process com.android.managedprovisioning (pid 11841) has died: cch+99 CEM 11-07 17:46:49.754 1402 1633 D DisplayManagerService: Drop pending events for gone uid 1310031 11-07 17:46:49.754 865 865 I Zygote : Process 11841 exited due to signal 9 (Killed) 11-07 17:46:49.756 1402 1649 I libprocessgroup: Successfully killed process cgroup uid 1310031 pid 11841 in 0ms 11-07 17:46:49.766 534 534 I lowmemorykiller: Kill 'de.swr.avp.ard' (10863), uid 10162, oom_score_adj 999 to free 135428kB rss, 3060kB swap; reason: low watermark is breached and swap is low (4640kB < 314572kB) 11-07 17:46:49.817 534 534 I lowmemorykiller: Kill 'com.android.nfc' (11935), uid 1301027, oom_score_adj 999 to free 127160kB rss, 176kB swap; reason: low watermark is breached and swap is low (28kB < 314572kB) 11-07 17:46:49.820 1402 1914 D ConnectivityService: releasing NetworkRequest [ REQUEST id=290, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED&NOT_VCN_MANAGED Uid: 10162 RequestorUid: 10162 RequestorPkg: de.swr.avp.ard UnderlyingNetworks: Null] ] (release request) 11-07 17:46:49.820 1402 2854 I ActivityManager: Process de.swr.avp.ard (pid 10863) has died: cch+99 CEM 11-07 17:46:49.821 1402 1633 D DisplayManagerService: Drop pending events for gone uid 10162 11-07 17:46:49.821 1402 1649 I libprocessgroup: Successfully killed process cgroup uid 10162 pid 10863 in 0ms 11-07 17:46:49.822 865 865 I Zygote : Process 10863 exited due to signal 9 (Killed) 11-07 17:46:49.864 1402 2854 I ActivityManager: Process com.android.nfc (pid 11935) has died: cch+99 CEM 11-07 17:46:49.865 1402 1633 D DisplayManagerService: Drop pending events for gone uid 1301027 11-07 17:46:49.865 865 865 I Zygote : Process 11935 exited due to signal 9 (Killed) 11-07 17:46:49.865 1402 1649 I libprocessgroup: Successfully killed process cgroup uid 1301027 pid 11935 in 1ms 11-07 17:46:49.866 534 534 I lowmemorykiller: Kill 'com.android.dynsystem:dynsystem' (11836), uid 1000, oom_score_adj 999 to free 126284kB rss, 636kB swap; reason: low watermark is breached and swap is low (0kB < 314572kB) 11-07 17:46:49.917 534 534 I lowmemorykiller: Kill 'com.nvidia.geforcenow:telemetry' (10087), uid 10325, oom_score_adj 999 to free 118848kB rss, 14824kB swap; reason: low watermark is breached and swap is low (4kB < 314572kB) 11-07 17:46:49.968 534 534 I lowmemorykiller: Kill 'com.nvidia.geforcenow' (9890), uid 10325, oom_score_adj 999 to free 115316kB rss, 20632kB swap; reason: low watermark is breached and swap is low (2940kB < 314572kB) ```
/sys/fs/pstore/console-ramoops-0 Not sure how useful this is, but here is a snippet from the file that looks like it could be related: ``` RAMDUMP_MSG.txt: reset message: KP: Watchdog detected hard LOCKUP on cpu 0 UUID: a811fe39-ceeb-9d42-ba33-db01817b4b10 last kernel version: 5.10.157-android13-4-g593471607d51 aosp kernel version: 5.10.198-android13-4-g57616f1b5f6f build: google/oriole/oriole:14/UP1A.231005.007/2023103100:user/release-keys RST_STAT: 0x1 - CLUSTER0_NONCPU_WDTRESET GSA_RESET_STATUS: 0x10 - GSA_INTERMEDIATE_RESET Reboot reason: 0xcbca - APC Watchdog Reboot mode: 0x0 - Normal Boot [ 0.621206] [DSS] Core stat at previous(KERNEL) [ 0.621332] [DSS] Core0: Alive (Software Lockup) [ 0.621494] [DSS] Core1: Alive (Software Lockup) [ 0.621657] [DSS] Core2: Dead/PANIC (No Lockup) [ 0.621825] [DSS] Core3: Dead/PANIC (No Lockup) [ 0.621994] [DSS] Core4: Dead/PANIC (No Lockup) [ 0.622162] [DSS] Core5: Dead (No Lockup) [ 0.622313] [DSS] Core6: Alive (Lockup Warning) [ 0.622474] [DSS] Core7: Alive/PANIC (No Lockup) [ 0.622643] [I] [DSS] ***** S2D Info Block ******************************************************** [ 0.622947] [I] [DSS] S2D Magic didn't detect - s2d validity check failed! [ 0.623128] [I] [DSS] Additional information: [ 0.623322] [I] [DSS] S2D status: No PD user consent [ 0.624919] [I] [DSS] PD user consent: Not granted [ 0.625074] [I] [DSS] PD auth status: Locked (bitmap: 0x00000010) [ 0.625290] [I] [DSS] ***************************************************************************** [ 0.625497] [I] [DSS] Core reg status and PC: [ 0.625624] [I] [DSS] /- Power state - +:On -:Off [ 0.625768] [I] [DSS] |/- Recorded by - P:panic A:arraydump S:s2d _:none [ 0.625949] [I] [DSS] ||/- IRQ - O:enabled X:disabled _:n/a [ 0.626118] [I] [DSS] |||/- FIQ - O:enabled X:disabled _:n/a [ 0.626288] [I] [DSS] core# |||| [ 0.626393] [I] [DSS] 0 -___ PC=0x0000000000000000 EL0 [ 0.626694] [I] [DSS] 1 -___ PC=0x0000000000000000 EL0 [ 0.626996] [I] [DSS] 2 -P__ PC=0xffffba28ea4701d8 EL1 [ 0.627225] [I] [DSS] 3 -P__ PC=0xffffba28e9683610 EL1 [ 0.627455] [I] [DSS] 4 -P__ PC=0xffffba28ea4701d8 EL1 [ 0.627686] [I] [DSS] 5 -___ PC=0x0000000000000000 EL0 [ 0.627985] [I] [DSS] 6 -___ PC=0x0000000000000000 EL0 [ 0.628282] [I] [DSS] 7 -P__ PC=0xffffba28e495546c EL1 [ 0.628516] [LNXDBG] PCSR iteration: [ 0.628618] [LNXDBG] core# [NS/S|EL|PC, ...] [ 0.628733] [LNXDBG] 0 n/a [ 0.628857] [LNXDBG] 1 n/a [ 0.628981] [LNXDBG] 2 n/a [ 0.629104] [LNXDBG] 3 n/a [ 0.629228] [LNXDBG] 4 n/a [ 0.629352] [LNXDBG] 5 n/a [ 0.629476] [LNXDBG] 6 n/a [ 0.629600] [LNXDBG] 7 n/a [ 0.629758] [LNXDBG] WDT FIQ info: [ 0.629859] [LNXDBG] core# type raw-magic elr [ 0.629980] [LNXDBG] 0 N/A 0x00000000 0x0000000000000000 [ 0.630318] [LNXDBG] 1 N/A 0x00000000 0x0000000000000000 [ 0.630655] [LNXDBG] 2 N/A 0x00000000 0x0000000000000000 [ 0.630994] [LNXDBG] 3 N/A 0x00000000 0x0000000000000000 [ 0.631333] [LNXDBG] 4 N/A 0x00000000 0x0000000000000000 [ 0.631670] [LNXDBG] 5 N/A 0x00000000 0x0000000000000000 [ 0.632008] [LNXDBG] 6 N/A 0x00000000 0x0000000000000000 [ 0.632344] [LNXDBG] 7 N/A 0x00000000 0x0000000000000000 ```
robovoice1 commented 1 year ago

Also with Pixel6pro raven: Vanadium 119.0.6045.66 UP1A.231105.003.2023110700

robovoice1 commented 1 year ago

No reboot with: Brave - Nightly 1.62.21, Chromium 119.0.6045.105

robovoice1 commented 1 year ago

issue persist (rebooting pixel) with latest alpha release Vanadium 119.0.6045.134 UP1A.231105.003.2023110700

datoshkr commented 1 year ago

Same issue on Pixel 6a Vanadium 119.0.6045.134.0 GrapheneOS UP1A.231105.003.2023110700

LunchBoxC commented 1 year ago

This doesn't happen on my Pixel 7a.

Just wanted to add that to the conversation.

thestinger commented 11 months ago

Is this still an issue with latest OS version?

robovoice1 commented 11 months ago

re-tested with p6pro raven UQ1A.231205.015.2023120800 Vanadium 120.0.6099.43

No reboot of the device! 😃