search

GrapheneOS / os-issue-tracker

Issue tracker for GrapheneOS Android Open Source Project hardening work. Standalone projects like Auditor, AttestationServer and hardened_malloc have their own dedicated trackers.
https://grapheneos.org/
358 stars 21 forks source link

Hardware Audio Service crashed due to null pointer deference #3832

Open pixincreate opened 2 months ago

pixincreate commented 2 months ago 
type: crash
osVersion: google/bluejay/bluejay:14/AP2A.240705.004/2024080200:user/release-keys
uid: 1041 (u:r:hal_audio_default:s0)
cmdline: /vendor/bin/hw/android.hardware.audio.service
processUptime: 0s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 0
cause: null pointer dereference
threadName: HwBinder:903_3

backtrace:
    /vendor/lib64/hw/audio.primary.gs101.so (event_free_common_event_client+64, pc 36b50)
    /vendor/lib64/hw/audio.platform.aoc.so (deinit_aoc_tuning_ctrl+68, pc 17764)
    /vendor/lib64/hw/audio.platform.aoc.so (aoc_card_ctrl_deinit+92, pc d69c)
    /vendor/lib64/hw/audio.primary.gs101.so (adev_close+640, pc 32f30)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (virtual thunk to android::hardware::audio::V7_1::implementation::Device::~Device()+92, pc 1a62c)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+480, pc 2b710)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (virtual thunk to android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+36, pc 2b8a4)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hidl::base::V1_0::BnHwBase::~BnHwBase()+188, pc 5f94c)
    /vendor/lib64/android.hardware.audio@7.1.so (android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+192, pc 4c7e0)
    /vendor/lib64/android.hardware.audio@7.1.so (virtual thunk to android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+36, pc 4c954)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hardware::IPCThreadState::joinThreadPool(bool)+1444, pc 56284)
    /vendor/lib64/libhidlbase.so (android::hardware::PoolThread::threadLoop()+24, pc 55cc8)
    /vendor/lib64/libutils.so (android::Thread::_threadLoop(void*)+244, pc 115d4)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 767ac)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64, pc 67d50)

and the same time, System Server crashed resulting in reboot that deleted all of current texts and session:

type: crash
SystemUptimeMs: 75607008
Process: system_server
Build: google/bluejay/bluejay:14/AP2A.240705.004/2024080200:user/release-keys
Crash-Handler: com.android.internal.os.RuntimeInit$KillApplicationHandler
Loading-Progress: 1.0
Dropped-Count: 0

java.lang.IllegalStateException: No TargetUser for 11
    at com.android.internal.util.Preconditions.checkState(Preconditions.java:216)
    at com.android.server.SystemServiceManager.onUser(SystemServiceManager.java:487)
    at com.android.server.SystemServiceManager.onUserStopping(SystemServiceManager.java:443)
    at com.android.server.am.UserController.finishUserStopping(UserController.java:1161)
    at com.android.server.am.UserController.lambda$stopSingleUserLU$6(UserController.java:1088)
    at com.android.server.am.UserController.$r8$lambda$OxdhwCv6Vy3KUyKMjyCBLuCttx0(UserController.java:0)
    at com.android.server.am.UserController$$ExternalSyntheticLambda12.run(R8$$SyntheticClass:0)
    at android.os.Handler.handleCallback(Handler.java:959)
    at android.os.Handler.dispatchMessage(Handler.java:100)
    at android.os.Looper.loopOnce(Looper.java:232)
    at android.os.Looper.loop(Looper.java:317)
    at android.os.HandlerThread.run(HandlerThread.java:85)
    at com.android.server.ServiceThread.run(ServiceThread.java:46)
pixincreate commented 2 months ago

IDK man, shit has been crashing left right and centre since morning today

thestinger commented 2 months ago

Suggest rebooting the device. The soft reboot after a system_server crash isn't an actual reboot.

pixincreate commented 2 months ago 
type: crash
osVersion: google/bluejay/bluejay:14/AP2A.240705.004/2024080200:user/release-keys
uid: 1041 (u:r:hal_audio_default:s0)
cmdline: /vendor/bin/hw/android.hardware.audio.service
processUptime: 0s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 0
cause: null pointer dereference
threadName: binder:809_2

backtrace:
    /vendor/lib64/hw/audio.primary.gs101.so (event_free_common_event_client+64, pc 36b50)
    /vendor/lib64/hw/audio.platform.aoc.so (deinit_aoc_tuning_ctrl+68, pc 17764)
    /vendor/lib64/hw/audio.platform.aoc.so (aoc_card_ctrl_deinit+92, pc d69c)
    /vendor/lib64/hw/audio.primary.gs101.so (adev_close+640, pc 32f30)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (virtual thunk to android::hardware::audio::V7_1::implementation::Device::~Device()+92, pc 1a62c)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+480, pc 2b710)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (virtual thunk to android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+36, pc 2b8a4)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hidl::base::V1_0::BnHwBase::~BnHwBase()+188, pc 5f94c)
    /vendor/lib64/android.hardware.audio@7.1.so (android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+192, pc 4c7e0)
    /vendor/lib64/android.hardware.audio@7.1.so (virtual thunk to android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+36, pc 4c954)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hardware::IPCThreadState::joinThreadPool(bool)+1444, pc 56284)
    /vendor/bin/hw/android.hardware.audio.service (main+3980, pc 306c)
    /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+116, pc 5d304)

Shit crashed again.

I was infact installing GMS and moments before it gets installed, device crashes.

thestinger commented 2 months ago

It's unusual. It's the first report ever with this audio service crash. Do you have any special audio apps?

pixincreate commented 2 months ago

No.
This is what I did:

And do my work -- I was in fact, trying to log in to karnataka bank mobile plus app which was not working as I expected. Also, I do have my watch connected to the phone via Bluetooth.

I basically do not use GMS, but install it whenever I face issues with the app that I install just to see if it is because of GMS not being present. The moment soft reboot happens, all GMS apps get installed.
And once I start removing the apps one by one once i no longer need, Play Store starts to crash stating finsky is missing or something.

pixincreate commented 2 months ago

And yes, this started to happen since today morning. It has crash 5+ times so far.

thestinger commented 2 months ago

It's expected that Google Play will crash if you partially remove it.

pixincreate commented 2 months ago

I did that.
I removed the GMS, and did not try installing that again. So far, no crash has happened.

pixincreate commented 2 months ago 
type: crash
osVersion: google/bluejay/bluejay:14/AP2A.240705.004/2024080200:user/release-keys
uid: 1041 (u:r:hal_audio_default:s0)
cmdline: /vendor/bin/hw/android.hardware.audio.service
processUptime: 0s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 0
cause: null pointer dereference
threadName: HwBinder:817_9

backtrace:
    /vendor/lib64/hw/audio.primary.gs101.so (event_free_common_event_client+64, pc 36b50)
    /vendor/lib64/hw/audio.platform.aoc.so (deinit_aoc_tuning_ctrl+68, pc 17764)
    /vendor/lib64/hw/audio.platform.aoc.so (aoc_card_ctrl_deinit+92, pc d69c)
    /vendor/lib64/hw/audio.primary.gs101.so (adev_close+640, pc 32f30)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (virtual thunk to android::hardware::audio::V7_1::implementation::Device::~Device()+92, pc 1a62c)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+480, pc 2b710)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (virtual thunk to android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+36, pc 2b8a4)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hidl::base::V1_0::BnHwBase::~BnHwBase()+188, pc 5f94c)
    /vendor/lib64/android.hardware.audio@7.1.so (android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+192, pc 4c7e0)
    /vendor/lib64/android.hardware.audio@7.1.so (virtual thunk to android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+36, pc 4c954)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hardware::IPCThreadState::joinThreadPool(bool)+1444, pc 56284)
    /vendor/lib64/libhidlbase.so (android::hardware::PoolThread::threadLoop()+24, pc 55cc8)
    /vendor/lib64/libutils.so (android::Thread::_threadLoop(void*)+244, pc 115d4)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 767ac)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64, pc 67d50)

I hit install GMS, it started to install. Just now it crashed. After soft reboot, all 3 apps are now installed.

It's expected that Google Play will crash if you partially remove it.

No, this was not the case before. And yes, all 3 apps cannot be removed at a time but rather one after the other. So, the moment one app is removed you get error which is the first time I'm seeing. Just uninstalled it, no error occurred.

thestinger commented 2 months ago

And once I start removing the apps one by one once i no longer need, Play Store starts to crash stating finsky is missing or something.

This is normal and expected. Remove Play Store before Play services to avoid it. The audio crash you're seeing isn't normal and we haven't seen it from anyone else so we'll need to figure out what's unique about your setup so we can determine the cause.

pixincreate commented 2 months ago

My setup after I locked the bootloader again giving up root access has been simple.
I do have Shizuku installed for experiments and some of the apps that I use require it.
However, I do not see anything that affects the way GMS works. But I doubt the package_installer just because it has been the most unstable app for me for so long (when I install multiple apps, device would crash resulting in soft reboot and the same still happens).

But I wonder what might be the relation betwen audio hardware service and GMS.

thestinger commented 2 months ago

It's possible something was done via ADB which is causing this but it's hard to know what that could possibly be.

pixincreate commented 2 months ago

I'm pretty sure, that is not the case here. I use Shizuku only for terminal access and installing apps mainly from Aurora Store. Nothing else.

Edit:

Shizuku is currently being used for Tap, tap, Obtanium, Aurora Store, Swift Backup and Termux (exported rish)

Lppsoeht commented 2 months ago

Happened to me too several times. No audio was playing, no adb ever. Never rooted.

Lppsoeht commented 2 months ago

Happened to me too several times. No audio was playing, no adb ever. Never rooted.

Sometimes it happens several times a day Without even using the device, I find it soft-rebooted with this exact crash log.

pixincreate commented 1 month ago 
type: crash
osVersion: google/bluejay/bluejay:14/AP2A.240905.003.F1/2024090400:user/release-keys
uid: 1041 (u:r:hal_audio_default:s0)
cmdline: /vendor/bin/hw/android.hardware.audio.service
processUptime: 0s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 0
cause: null pointer dereference
threadName: HwBinder:809_8

backtrace:
    /vendor/lib64/hw/audio.primary.gs101.so (event_free_common_event_client+64, pc 36b50)
    /vendor/lib64/hw/audio.platform.aoc.so (deinit_aoc_tuning_ctrl+68, pc 17764)
    /vendor/lib64/hw/audio.platform.aoc.so (aoc_card_ctrl_deinit+92, pc d69c)
    /vendor/lib64/hw/audio.primary.gs101.so (adev_close+640, pc 32f30)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (virtual thunk to android::hardware::audio::V7_1::implementation::Device::~Device()+92, pc 1a62c)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (android::hardware::audio::V7_1::implementation::StreamIn::~StreamIn()+344, pc 25778)
    /vendor/lib64/hw/android.hardware.audio@7.1-impl.so (virtual thunk to android::hardware::audio::V7_1::implementation::StreamIn::~StreamIn()+36, pc 25904)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hidl::base::V1_0::BnHwBase::~BnHwBase()+188, pc 5f94c)
    /vendor/lib64/android.hardware.audio@7.0.so (android::hardware::audio::V7_0::BnHwStreamIn::~BnHwStreamIn()+192, pc 79870)
    /vendor/lib64/android.hardware.audio@7.0.so (virtual thunk to android::hardware::audio::V7_0::BnHwStreamIn::~BnHwStreamIn()+36, pc 799e4)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hardware::IPCThreadState::joinThreadPool(bool)+1444, pc 56284)
    /vendor/lib64/libhidlbase.so (android::hardware::PoolThread::threadLoop()+24, pc 55cc8)
    /vendor/lib64/libutils.so (android::Thread::_threadLoop(void*)+244, pc 115d4)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 767ac)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64, pc 67d50)

Crashed again when I installed GMS.

oppressor1761 commented 1 month ago

Afaik, system update can erase what Shizuku did. Before next GOS release, turn off developer options and see if the problem persists after updated. You can also reset your device.

pixincreate commented 1 month ago

Afaik, system update can erase what Shizuku did. Before next GOS release, turn off developer options and see if the problem persists after updated. You can also reset your device.

Please make it make sense. Shizuku has nothing to do here or whatsoever. Just so you know, GMS is installed GrapheneOS's very own AppStore and no where else.

System update has nothing to do with installing GMS from AppStore.

thestinger commented 1 month ago

This is still the only report we've ever received of this.

Lppsoeht commented 1 month ago

This is still the only report we've ever received of this.

Actually, the same crash happened to me several times. Pixel 6 pro, never rooted or adb whatsoever. I have some developer settings not set to default but the dev setting toggle is off. Weirdly, in the last weeks it stopped happening often. Most of the time it happened when I was not at home.

(Next time it happens I'll remember to add my report to this thread)