Public bug reported:
[Summary]
On Ubuntu 26.04 (bluez 5.85), transferring a file over Bluetooth (OBEX/OPP)
between two
Ubuntu systems pops up an apport crash-report dialog. The file transfer itself
completes
successfully -- the dialog is caused by a crash of the per-user `mpris-proxy`
service, not
by a transfer failure. Reproduces 100% between two 26.04 systems.
[Steps to reproduce]
1. Install Ubuntu 26.04 on two systems (SUTs).
2. Settings -> Bluetooth -> pair/connect the two systems.
3. Send a file from one system to the other over Bluetooth.
4. An error / crash-report dialog pops up (the file still arrives).
[Expected]
The file transfers without any crash/apport dialog; mpris-proxy does not crash.
[Actual]
mpris-proxy crashes with SIGSEGV during the transfer, producing an apport crash
dialog
(update-notifier-crash -> whoopsie -> apport-gtk).
[Root cause]
In bluez `tools/mpris-proxy.c`, `find_player_by_obex()` dereferences
`player->obex->obex`
without a NULL check. `player->obex` stays NULL when the bluez MediaPlayer
object has no
`ObexPort` property (an Experimental property, disabled by default), yet
`register_player()`
still adds such a player to its list. Every OBEX PUT emits a
`Transfer1 PropertiesChanged(Status)` -> `obex_property_changed()` ->
`find_player_by_obex()` -> NULL dereference -> SIGSEGV. The faulting address
(0x8, user-mode
read) matches the struct layout, confirming this code path.
Example journal (sosreport):
obexd[...]: PUT(0x2), Continue(0x10)
kernel: mpris-proxy[...]: segfault at 8 ip ... error 4 in mpris-proxy[...]
systemd[...]: mpris-proxy.service: Main process exited, code=dumped,
status=11/SEGV
[Why 26.04 only]
The BIP cover-art path (find_player_by_obex) was added between bluez 5.77 and
5.80;
Ubuntu 24.04 ships bluez 5.72 which does not contain it. No hardware/firmware
factor.
[Upstream fix]
PR: bluez #2098 "mpris-proxy: Fix possible crash" adds NULL checks to all four
`player->obex` dereference sites (references Red Hat BZ 2466640 with the
identical
backtrace). NOTE: the PR is currently CLOSED without merge, and bluez 5.86 /
5.87 / master
still contain the unguarded code -- no released bluez includes the fix yet. An
Ubuntu SRU
would need to carry PR #2098 as a delta patch (with line-offset adjustment).
[Workaround / verification]
On both systems: `systemctl --user mask mpris-proxy.service`, then repeat the
transfer --
the crash dialog no longer appears, confirming the root cause.
[Environment]
Ubuntu 26.04.1 LTS, kernel 7.3.0-9002-oem, bluez 5.85-4ubuntu0.x.
(Filed from internal tracking WTN-503.)
** Affects: oem-priority
Importance: Undecided
Status: New
** Affects: bluez (Ubuntu)
Importance: Undecided
Status: New
** Tags: jira-wtn-503 oem-priority
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172906
Title:
mpris-proxy segfault (NULL deref in find_player_by_obex) triggers
apport crash dialog during Bluetooth OBEX file transfer on 26.04
To manage notifications about this bug go to:
https://bugs.launchpad.net/oem-priority/+bug/2172906/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
