os-issue-tracker icon indicating copy to clipboard operation
os-issue-tracker copied to clipboard
verified publisher icon GrapheneOS

Hardware Audio Service crashed due to null pointer deference

Open pixincreate opened this issue 1 year ago • 20 comments 

type: crash
osVersion: google/bluejay/bluejay:14/AP2A.240705.004/2024080200:user/release-keys
uid: 1041 (u:r:hal_audio_default:s0)
cmdline: /vendor/bin/hw/android.hardware.audio.service
processUptime: 0s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 0
cause: null pointer dereference
threadName: HwBinder:903_3

backtrace:
    /vendor/lib64/hw/audio.primary.gs101.so (event_free_common_event_client+64, pc 36b50)
    /vendor/lib64/hw/audio.platform.aoc.so (deinit_aoc_tuning_ctrl+68, pc 17764)
    /vendor/lib64/hw/audio.platform.aoc.so (aoc_card_ctrl_deinit+92, pc d69c)
    /vendor/lib64/hw/audio.primary.gs101.so (adev_close+640, pc 32f30)
    /vendor/lib64/hw/[email protected] (virtual thunk to android::hardware::audio::V7_1::implementation::Device::~Device()+92, pc 1a62c)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/hw/[email protected] (android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+480, pc 2b710)
    /vendor/lib64/hw/[email protected] (virtual thunk to android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+36, pc 2b8a4)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hidl::base::V1_0::BnHwBase::~BnHwBase()+188, pc 5f94c)
    /vendor/lib64/[email protected] (android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+192, pc 4c7e0)
    /vendor/lib64/[email protected] (virtual thunk to android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+36, pc 4c954)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hardware::IPCThreadState::joinThreadPool(bool)+1444, pc 56284)
    /vendor/lib64/libhidlbase.so (android::hardware::PoolThread::threadLoop()+24, pc 55cc8)
    /vendor/lib64/libutils.so (android::Thread::_threadLoop(void*)+244, pc 115d4)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 767ac)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64, pc 67d50)

and the same time, System Server crashed resulting in reboot that deleted all of current texts and session:

type: crash
SystemUptimeMs: 75607008
Process: system_server
Build: google/bluejay/bluejay:14/AP2A.240705.004/2024080200:user/release-keys
Crash-Handler: com.android.internal.os.RuntimeInit$KillApplicationHandler
Loading-Progress: 1.0
Dropped-Count: 0

java.lang.IllegalStateException: No TargetUser for 11
	at com.android.internal.util.Preconditions.checkState(Preconditions.java:216)
	at com.android.server.SystemServiceManager.onUser(SystemServiceManager.java:487)
	at com.android.server.SystemServiceManager.onUserStopping(SystemServiceManager.java:443)
	at com.android.server.am.UserController.finishUserStopping(UserController.java:1161)
	at com.android.server.am.UserController.lambda$stopSingleUserLU$6(UserController.java:1088)
	at com.android.server.am.UserController.$r8$lambda$OxdhwCv6Vy3KUyKMjyCBLuCttx0(UserController.java:0)
	at com.android.server.am.UserController$$ExternalSyntheticLambda12.run(R8$$SyntheticClass:0)
	at android.os.Handler.handleCallback(Handler.java:959)
	at android.os.Handler.dispatchMessage(Handler.java:100)
	at android.os.Looper.loopOnce(Looper.java:232)
	at android.os.Looper.loop(Looper.java:317)
	at android.os.HandlerThread.run(HandlerThread.java:85)
	at com.android.server.ServiceThread.run(ServiceThread.java:46)

pixincreate avatar Aug 05 '24 04:08 pixincreate

IDK man, shit has been crashing left right and centre since morning today

pixincreate avatar Aug 05 '24 04:08 pixincreate

Suggest rebooting the device. The soft reboot after a system_server crash isn't an actual reboot.

thestinger avatar Aug 05 '24 04:08 thestinger 

type: crash
osVersion: google/bluejay/bluejay:14/AP2A.240705.004/2024080200:user/release-keys
uid: 1041 (u:r:hal_audio_default:s0)
cmdline: /vendor/bin/hw/android.hardware.audio.service
processUptime: 0s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 0
cause: null pointer dereference
threadName: binder:809_2

backtrace:
    /vendor/lib64/hw/audio.primary.gs101.so (event_free_common_event_client+64, pc 36b50)
    /vendor/lib64/hw/audio.platform.aoc.so (deinit_aoc_tuning_ctrl+68, pc 17764)
    /vendor/lib64/hw/audio.platform.aoc.so (aoc_card_ctrl_deinit+92, pc d69c)
    /vendor/lib64/hw/audio.primary.gs101.so (adev_close+640, pc 32f30)
    /vendor/lib64/hw/[email protected] (virtual thunk to android::hardware::audio::V7_1::implementation::Device::~Device()+92, pc 1a62c)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/hw/[email protected] (android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+480, pc 2b710)
    /vendor/lib64/hw/[email protected] (virtual thunk to android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+36, pc 2b8a4)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hidl::base::V1_0::BnHwBase::~BnHwBase()+188, pc 5f94c)
    /vendor/lib64/[email protected] (android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+192, pc 4c7e0)
    /vendor/lib64/[email protected] (virtual thunk to android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+36, pc 4c954)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hardware::IPCThreadState::joinThreadPool(bool)+1444, pc 56284)
    /vendor/bin/hw/android.hardware.audio.service (main+3980, pc 306c)
    /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+116, pc 5d304)

Shit crashed again.

I was infact installing GMS and moments before it gets installed, device crashes.

pixincreate avatar Aug 05 '24 04:08 pixincreate

It's unusual. It's the first report ever with this audio service crash. Do you have any special audio apps?

thestinger avatar Aug 05 '24 04:08 thestinger

No.
This is what I did:

  • Install GMS

And do my work -- I was in fact, trying to log in to karnataka bank mobile plus app which was not working as I expected. Also, I do have my watch connected to the phone via Bluetooth.

I basically do not use GMS, but install it whenever I face issues with the app that I install just to see if it is because of GMS not being present. The moment soft reboot happens, all GMS apps get installed.
And once I start removing the apps one by one once i no longer need, Play Store starts to crash stating finsky is missing or something.

pixincreate avatar Aug 05 '24 06:08 pixincreate

And yes, this started to happen since today morning. It has crash 5+ times so far.

pixincreate avatar Aug 05 '24 06:08 pixincreate

It's expected that Google Play will crash if you partially remove it.

thestinger avatar Aug 05 '24 13:08 thestinger

I did that.
I removed the GMS, and did not try installing that again. So far, no crash has happened.

pixincreate avatar Aug 05 '24 14:08 pixincreate 

type: crash
osVersion: google/bluejay/bluejay:14/AP2A.240705.004/2024080200:user/release-keys
uid: 1041 (u:r:hal_audio_default:s0)
cmdline: /vendor/bin/hw/android.hardware.audio.service
processUptime: 0s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 0
cause: null pointer dereference
threadName: HwBinder:817_9

backtrace:
    /vendor/lib64/hw/audio.primary.gs101.so (event_free_common_event_client+64, pc 36b50)
    /vendor/lib64/hw/audio.platform.aoc.so (deinit_aoc_tuning_ctrl+68, pc 17764)
    /vendor/lib64/hw/audio.platform.aoc.so (aoc_card_ctrl_deinit+92, pc d69c)
    /vendor/lib64/hw/audio.primary.gs101.so (adev_close+640, pc 32f30)
    /vendor/lib64/hw/[email protected] (virtual thunk to android::hardware::audio::V7_1::implementation::Device::~Device()+92, pc 1a62c)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/hw/[email protected] (android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+480, pc 2b710)
    /vendor/lib64/hw/[email protected] (virtual thunk to android::hardware::audio::V7_1::implementation::StreamOut::~StreamOut()+36, pc 2b8a4)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hidl::base::V1_0::BnHwBase::~BnHwBase()+188, pc 5f94c)
    /vendor/lib64/[email protected] (android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+192, pc 4c7e0)
    /vendor/lib64/[email protected] (virtual thunk to android::hardware::audio::V7_1::BnHwStreamOut::~BnHwStreamOut()+36, pc 4c954)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hardware::IPCThreadState::joinThreadPool(bool)+1444, pc 56284)
    /vendor/lib64/libhidlbase.so (android::hardware::PoolThread::threadLoop()+24, pc 55cc8)
    /vendor/lib64/libutils.so (android::Thread::_threadLoop(void*)+244, pc 115d4)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 767ac)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64, pc 67d50)

I hit install GMS, it started to install. Just now it crashed. After soft reboot, all 3 apps are now installed.

It's expected that Google Play will crash if you partially remove it.

No, this was not the case before. And yes, all 3 apps cannot be removed at a time but rather one after the other. So, the moment one app is removed you get error which is the first time I'm seeing. Just uninstalled it, no error occurred.

pixincreate avatar Aug 05 '24 14:08 pixincreate

And once I start removing the apps one by one once i no longer need, Play Store starts to crash stating finsky is missing or something.

This is normal and expected. Remove Play Store before Play services to avoid it. The audio crash you're seeing isn't normal and we haven't seen it from anyone else so we'll need to figure out what's unique about your setup so we can determine the cause.

thestinger avatar Aug 05 '24 15:08 thestinger

My setup after I locked the bootloader again giving up root access has been simple.
I do have Shizuku installed for experiments and some of the apps that I use require it.
However, I do not see anything that affects the way GMS works. But I doubt the package_installer just because it has been the most unstable app for me for so long (when I install multiple apps, device would crash resulting in soft reboot and the same still happens).

But I wonder what might be the relation betwen audio hardware service and GMS.

pixincreate avatar Aug 05 '24 16:08 pixincreate

It's possible something was done via ADB which is causing this but it's hard to know what that could possibly be.

thestinger avatar Aug 05 '24 16:08 thestinger

I'm pretty sure, that is not the case here. I use Shizuku only for terminal access and installing apps mainly from Aurora Store. Nothing else.

Edit:

Shizuku is currently being used for Tap, tap, Obtanium, Aurora Store, Swift Backup and Termux (exported rish)

pixincreate avatar Aug 05 '24 17:08 pixincreate

Happened to me too several times. No audio was playing, no adb ever. Never rooted.

Lppsoeht avatar Aug 13 '24 15:08 Lppsoeht

Happened to me too several times. No audio was playing, no adb ever. Never rooted.

Sometimes it happens several times a day Without even using the device, I find it soft-rebooted with this exact crash log.

Lppsoeht avatar Sep 01 '24 19:09 Lppsoeht 

type: crash
osVersion: google/bluejay/bluejay:14/AP2A.240905.003.F1/2024090400:user/release-keys
uid: 1041 (u:r:hal_audio_default:s0)
cmdline: /vendor/bin/hw/android.hardware.audio.service
processUptime: 0s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 0
cause: null pointer dereference
threadName: HwBinder:809_8

backtrace:
    /vendor/lib64/hw/audio.primary.gs101.so (event_free_common_event_client+64, pc 36b50)
    /vendor/lib64/hw/audio.platform.aoc.so (deinit_aoc_tuning_ctrl+68, pc 17764)
    /vendor/lib64/hw/audio.platform.aoc.so (aoc_card_ctrl_deinit+92, pc d69c)
    /vendor/lib64/hw/audio.primary.gs101.so (adev_close+640, pc 32f30)
    /vendor/lib64/hw/[email protected] (virtual thunk to android::hardware::audio::V7_1::implementation::Device::~Device()+92, pc 1a62c)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/hw/[email protected] (android::hardware::audio::V7_1::implementation::StreamIn::~StreamIn()+344, pc 25778)
    /vendor/lib64/hw/[email protected] (virtual thunk to android::hardware::audio::V7_1::implementation::StreamIn::~StreamIn()+36, pc 25904)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hidl::base::V1_0::BnHwBase::~BnHwBase()+188, pc 5f94c)
    /vendor/lib64/[email protected] (android::hardware::audio::V7_0::BnHwStreamIn::~BnHwStreamIn()+192, pc 79870)
    /vendor/lib64/[email protected] (virtual thunk to android::hardware::audio::V7_0::BnHwStreamIn::~BnHwStreamIn()+36, pc 799e4)
    /vendor/lib64/libutils.so (android::RefBase::decStrong(void const*) const+156, pc 10c9c)
    /vendor/lib64/libhidlbase.so (android::hardware::IPCThreadState::joinThreadPool(bool)+1444, pc 56284)
    /vendor/lib64/libhidlbase.so (android::hardware::PoolThread::threadLoop()+24, pc 55cc8)
    /vendor/lib64/libutils.so (android::Thread::_threadLoop(void*)+244, pc 115d4)
    /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 767ac)
    /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64, pc 67d50)

Crashed again when I installed GMS.

pixincreate avatar Sep 16 '24 03:09 pixincreate

Afaik, system update can erase what Shizuku did. Before next GOS release, turn off developer options and see if the problem persists after updated. You can also reset your device.

oppressor1761 avatar Sep 17 '24 14:09 oppressor1761

Afaik, system update can erase what Shizuku did. Before next GOS release, turn off developer options and see if the problem persists after updated. You can also reset your device.

Please make it make sense. Shizuku has nothing to do here or whatsoever. Just so you know, GMS is installed GrapheneOS's very own AppStore and no where else.

System update has nothing to do with installing GMS from AppStore.

pixincreate avatar Sep 17 '24 15:09 pixincreate

This is still the only report we've ever received of this.

thestinger avatar Sep 17 '24 16:09 thestinger

This is still the only report we've ever received of this.

Actually, the same crash happened to me several times. Pixel 6 pro, never rooted or adb whatsoever. I have some developer settings not set to default but the dev setting toggle is off. Weirdly, in the last weeks it stopped happening often. Most of the time it happened when I was not at home.

(Next time it happens I'll remember to add my report to this thread)

Lppsoeht avatar Sep 17 '24 17:09 Lppsoeht