search

GrapheneOS / os-issue-tracker

Issue tracker for GrapheneOS Android Open Source Project hardening work. Standalone projects like Auditor, AttestationServer and hardened_malloc have their own dedicated trackers.
https://grapheneos.org/
360 stars 21 forks source link

vendor.google.wifi_ext-service-vendor crash #3653

Closed HexPandaa closed 4 months ago

HexPandaa commented 4 months ago

I received two of such notifications after a crash and reboot (5 system_server crash notifications)

type: crash
osVersion: google/shiba/shiba:14/AP2A.240605.024/2024061400:user/release-keys
uid: 1010 (u:r:hal_wifi_ext:s0)
cmdline: /apex/com.google.pixel.wifi.ext/bin/hw/vendor.google.wifi_ext-service-vendor
processUptime: 0s

signal: 11 (SIGSEGV), code 9 (SEGV_MTESERR), faultAddr 200c15300ca64fc
threadName: binder:6229_1
MTE: enabled

backtrace:
    /apex/com.google.pixel.wifi.ext/lib64/libwifi-hal.so (SetLogHandler::cancel()+348, pc 4abac)
    /apex/com.google.pixel.wifi.ext/lib64/libwifi-hal.so (wifi_get_cancel_cmd(int, wifi_interface_info*) (.cfi)+140, pc 2e3ec)
    /apex/com.google.pixel.wifi.ext/bin/hw/vendor.google.wifi_ext-service-vendor (aidl::android::hardware::wifi::WifiChip::stopLoggingToDebugRingBufferInternal()+104, pc 4b5b8)
    /apex/com.google.pixel.wifi.ext/bin/hw/vendor.google.wifi_ext-service-vendor (aidl::android::hardware::wifi::WifiChip::stopLoggingToDebugRingBuffer()+68, pc 4b4f4)
    /apex/com.google.pixel.wifi.ext/lib64/android.hardware.wifi-V2-ndk.so (aidl::android::hardware::wifi::_aidl_android_hardware_wifi_IWifiChip_onTransact(AIBinder*, unsigned int, AParcel const*, AParcel*)+3904, pc 42d30)
    /system/lib64/libbinder_ndk.so (ABBinder::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+140, pc 1051c)
    /system/lib64/libbinder.so (android::IPCThreadState::executeCommand(int)+1328, pc 53a90)
    /system/lib64/libbinder.so (android::IPCThreadState::joinThreadPool(bool)+684, pc 52a0c)
    /system/lib64/libbinder.so (android::PoolThread::threadLoop()+28, pc 5273c)
    /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+248, pc 126f8)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 795dc)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68, pc 69fa4)
type: crash
osVersion: google/shiba/shiba:14/AP2A.240605.024/2024061400:user/release-keys
uid: 1010 (u:r:hal_wifi_ext:s0)
cmdline: /apex/com.google.pixel.wifi.ext/bin/hw/vendor.google.wifi_ext-service-vendor
processUptime: 0s

signal: 11 (SIGSEGV), code 9 (SEGV_MTESERR), faultAddr 800c7cdc265cb2c
threadName: binder:932_1
MTE: enabled

backtrace:
    /apex/com.google.pixel.wifi.ext/lib64/libwifi-hal.so (SetLogHandler::cancel()+348, pc 4abac)
    /apex/com.google.pixel.wifi.ext/lib64/libwifi-hal.so (wifi_get_cancel_cmd(int, wifi_interface_info*) (.cfi)+140, pc 2e3ec)
    /apex/com.google.pixel.wifi.ext/bin/hw/vendor.google.wifi_ext-service-vendor (aidl::android::hardware::wifi::WifiChip::stopLoggingToDebugRingBufferInternal()+104, pc 4b5b8)
    /apex/com.google.pixel.wifi.ext/bin/hw/vendor.google.wifi_ext-service-vendor (aidl::android::hardware::wifi::WifiChip::stopLoggingToDebugRingBuffer()+68, pc 4b4f4)
    /apex/com.google.pixel.wifi.ext/lib64/android.hardware.wifi-V2-ndk.so (aidl::android::hardware::wifi::_aidl_android_hardware_wifi_IWifiChip_onTransact(AIBinder*, unsigned int, AParcel const*, AParcel*)+3904, pc 42d30)
    /system/lib64/libbinder_ndk.so (ABBinder::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int)+140, pc 1051c)
    /system/lib64/libbinder.so (android::IPCThreadState::executeCommand(int)+1328, pc 53a90)
    /system/lib64/libbinder.so (android::IPCThreadState::joinThreadPool(bool)+684, pc 52a0c)
    /system/lib64/libbinder.so (android::PoolThread::threadLoop()+28, pc 5273c)
    /system/lib64/libutils.so (android::Thread::_threadLoop(void*)+248, pc 126f8)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 795dc)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68, pc 69fa4)
thestinger commented 4 months ago

This is resolved for the next release by adding back the workaround from before.