Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[crash] Matter: __59-[MTRBaseClusterPowerSource initWithDevice:endpoint:queue:]_block_invoke #21430

Closed
aajain-com opened this issue Jul 29, 2022 · 0 comments · Fixed by #21504

Comments

@aajain-com
Copy link
Contributor

Problem

Crash reported during stability run with SHA aa9457e6b94b735076dff6297176183bf9780177

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0xb020000000000030 -> 0x0000000000000030 (possible pointer authentication failure)
Exception Codes: 0x0000000000000001, 0xb020000000000030
VM Region Info: 0x30 is not in any region.  Bytes before following region: 68719476688
      REGION TYPE                 START - END      [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      commpage (reserved)     1000000000-7000000000 [384.0G] ---/--- SM=NUL  ...(unallocated)
Termination Reason: SIGNAL 11 Segmentation fault: 11
Terminating Process: exc handler [19990]

Thread 2 Crashed:: Dispatch queue: com.csa.matter.framework.controller.workqueue
0 Matter 0x106af9704 __59-[MTRBaseClusterPowerSource initWithDevice:endpoint:queue:]_block_invoke + 64connectedhomeip/src/darwin/Framework/CHIP/zap-generated/MTRBaseClusters.mm:14246
1 Matter 0x106af96f4 __59-[MTRBaseClusterPowerSource initWithDevice:endpoint:queue:]_block_invoke + 48connectedhomeip/src/darwin/Framework/CHIP/zap-generated/MTRBaseClusters.mm:14246
5 Matter 0x106af9638 -[MTRBaseClusterPowerSource initWithDevice:endpoint:queue:] + 224 CHIP/zap-generated/MTRBaseClusters.mm:14244
2022-07-29 06:45:46.1584 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346169] [19990:138666] CHIP: [EM] Received message of type 0x5 with protocolId (0, 1) and MessageCounter:16726783 on exchange 43930i
2022-07-29 06:45:46.1585 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346169] [19990:138666] CHIP: [EM] Found matching exchange: 43930i, Delegate: 0x137e0b050
2022-07-29 06:45:46.1586 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346169] [19990:138666] CHIP: [EM] Rxd Ack; Removing MessageCounter:132071961 from Retrans Table on exchange 43930i
2022-07-29 06:45:46.1586 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346169] [19990:138666] CHIP: [EM] Removed CHIP MessageCounter:132071961 from RetransTable on exchange 43930i
2022-07-29 06:45:46.1588 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346169] [19990:138666] CHIP: [EM] Sending Standalone Ack for MessageCounter:16726783 on exchange 43930i
2022-07-29 06:45:46.1589 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346170] [19990:138666] CHIP: [IN] Prepared secure message 0x16b7412b8 to 0x000000007E3C723C (10)  of type 0x10 and protocolId (0, 0) on exchange 43930i with MessageCounter:132071962.
2022-07-29 06:45:46.1589 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346170] [19990:138666] CHIP: [IN] Sending encrypted msg 0x16b7412b8 with MessageCounter:132071962 to 0x000000007E3C723C (10) at monotonic time: 0000000002BF6C91 msec
2022-07-29 06:45:46.1595 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346170] [19990:138666] CHIP: [EM] Flushed pending ack for MessageCounter:16726783 on exchange 43930i
2022-07-29 06:45:46.1596 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346170] [19990:138666] CHIP: [CTL] Response Time: PFvPvhE+1277600751 0.063624 seconds
2022-07-29 06:45:46.1719 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346183] [19990:138666] CHIP: [CTL] Response Time: PFvPvtE+1181326133
2022-07-29 06:45:46.1720 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346183] [19990:138666] CHIP: [DMG] SendReadRequest ReadClient[0x137e0b050]: Sending Read Request
2022-07-29 06:45:46.1722 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346183] [19990:138666] CHIP: [IN] Prepared secure message 0x1393ab9e8 to 0x000000007E3C723C (10)  of type 0x2 and protocolId (0, 1) on exchange 43931i with MessageCounter:132071963.
2022-07-29 06:45:46.1722 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346183] [19990:138666] CHIP: [IN] Sending encrypted msg 0x1393ab9e8 with MessageCounter:132071963 to 0x000000007E3C723C (10) at monotonic time: 0000000002BF6C9E msec
2022-07-29 06:45:46.1726 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346183] [19990:138666] CHIP: [DMG] MoveToState ReadClient[0x137e0b050]: Moving to [AwaitingIn]
2022-07-29 06:45:46.2249 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346236] [19990:138666] CHIP: [EM] Received message of type 0x5 with protocolId (0, 1) and MessageCounter:16726784 on exchange 43931i
2022-07-29 06:45:46.2250 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346236] [19990:138666] CHIP: [EM] Found matching exchange: 43931i, Delegate: 0x137e0b050
2022-07-29 06:45:46.2250 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346236] [19990:138666] CHIP: [EM] Rxd Ack; Removing MessageCounter:132071963 from Retrans Table on exchange 43931i
2022-07-29 06:45:46.2250 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346236] [19990:138666] CHIP: [EM] Removed CHIP MessageCounter:132071963 from RetransTable on exchange 43931i
2022-07-29 06:45:46.2253 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346236] [19990:138666] CHIP: [EM] Sending Standalone Ack for MessageCounter:16726784 on exchange 43931i
2022-07-29 06:45:46.2253 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346236] [19990:138666] CHIP: [IN] Prepared secure message 0x16b7412b8 to 0x000000007E3C723C (10)  of type 0x10 and protocolId (0, 0) on exchange 43931i with MessageCounter:132071964.
2022-07-29 06:45:46.2253 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346236] [19990:138666] CHIP: [IN] Sending encrypted msg 0x16b7412b8 with MessageCounter:132071964 to 0x000000007E3C723C (10) at monotonic time: 0000000002BF6CD4 msec
2022-07-29 06:45:46.2255 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346236] [19990:138666] CHIP: [EM] Flushed pending ack for MessageCounter:16726784 on exchange 43931i
2022-07-29 06:45:46.2255 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346236] [19990:138666] CHIP: [CTL] Response Time: PFvPvtE+1181326133 0.053605 seconds
2022-07-29 06:45:46.2314 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346242] [19990:138666] CHIP: [CTL] Response Time: PFvPvhE+249321602
2022-07-29 06:45:46.2314 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346242] [19990:138666] CHIP: [DMG] SendReadRequest ReadClient[0x137d07c90]: Sending Read Request
2022-07-29 06:45:46.2317 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346242] [19990:138666] CHIP: [IN] Prepared secure message 0x139689718 to 0x000000007E3C723C (10)  of type 0x2 and protocolId (0, 1) on exchange 43932i with MessageCounter:132071965.
2022-07-29 06:45:46.2317 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🔵 [1659102346242] [19990:138666] CHIP: [IN] Sending encrypted msg 0x139689718 with MessageCounter:132071965 to 0x000000007E3C723C (10) at monotonic time: 0000000002BF6CDA msec
2022-07-29 06:45:46.2321 -0700 default 0x21daa 0x0 homed[19990] (Matter): 🟢 [1659102346243] [19990:138666] CHIP: [DMG] MoveToState ReadClient[0x137d07c90]: Moving to [AwaitingIn]
2022-07-29 06:45:46.2759 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346287] [19990:138658] CHIP: [CTL] Shutting down the commissioner
2022-07-29 06:45:46.2759 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346287] [19990:138658] CHIP: [CTL] Shutting down the controller
2022-07-29 06:45:46.2759 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346287] [19990:138658] CHIP: [IN] Expiring all sessions for fabric 0xa!!
2022-07-29 06:45:46.2759 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346287] [19990:138658] CHIP: [IN] SecureSession[0x1393ff2c0]: MarkForEviction Type:2 LSID:47951
2022-07-29 06:45:46.2760 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🔵 [1659102346287] [19990:138658] CHIP: [SC] SecureSession[0x1393ff2c0]: Moving from state 'kActive' --> 'kPendingEviction'
2022-07-29 06:45:46.2789 -0700   error 0x21da2 0x183f3 homed[19990] (Matter): 🔴 [1659102346290] [19990:138658] CHIP: [DMG] Time out! failed to receive report data from Exchange: 43932i
2022-07-29 06:45:46.2791 -0700 default 0x21a27 0x183f3 homed[19990] (Matter): 🟢 [1659102346290] [19990:137767] CHIP: [CTL] Response Time: PFvPvhE+249321602 0.047696 seconds
2022-07-29 06:45:46.2800 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346291] [19990:138658] CHIP: [IN] SecureSession[0x1393ff2c0]: Released - Type:2 LSID:47951
2022-07-29 06:45:46.2800 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🔵 [1659102346291] [19990:138658] CHIP: [FP] Forgetting fabric 0xa
2022-07-29 06:45:46.2800 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🔵 [1659102346291] [19990:138658] CHIP: [TS] Pending Last Known Good Time: 2022-07-29T13:40:27
2022-07-29 06:45:46.2801 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): PersistentStorageDelegate Sync Get Value for Key: g/lkgt
2022-07-29 06:45:46.2803 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🔵 [1659102346291] [19990:138658] CHIP: [TS] Previous Last Known Good Time: 2022-07-29T13:40:27
2022-07-29 06:45:46.2803 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🔵 [1659102346291] [19990:138658] CHIP: [TS] Reverted Last Known Good Time to previous value
2022-07-29 06:45:46.2803 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346291] [19990:138658] CHIP: [CTL] Shutting down the System State, this will teardown the CHIP Stack
2022-07-29 06:45:46.2803 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346291] [19990:138658] CHIP: [IN] SecureSession[0x139357100]: Released - Type:2 LSID:47949
2022-07-29 06:45:46.2803 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346291] [19990:138658] CHIP: [DMG] IM WH moving to [Uninitialized]
2022-07-29 06:45:46.2803 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346291] [19990:138658] CHIP: [DMG] IM WH moving to [Uninitialized]
2022-07-29 06:45:46.2803 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346291] [19990:138658] CHIP: [DMG] IM WH moving to [Uninitialized]
2022-07-29 06:45:46.2803 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346291] [19990:138658] CHIP: [DMG] IM WH moving to [Uninitialized]
2022-07-29 06:45:46.2803 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🟢 [1659102346291] [19990:138658] CHIP: [DMG] All ReadHandler-s are clean, clear GlobalDirtySet
2022-07-29 06:45:46.2805 -0700 default 0x21da2 0x183f3 homed[19990] (Matter): 🔵 [1659102346291] [19990:138658] CHIP: [BLE] CancelConnection
2022-07-29 06:45:46.2805 -0700   error 0x21da2 0x183f3 homed[19990] (Matter): 🔴 [1659102346291] [19990:138658] CHIP: [DL] Inet Layer shutdown
2022-07-29 06:45:46.2805 -0700   error 0x21da2 0x183f3 homed[19990] (Matter): 🔴 [1659102346291] [19990:138658] CHIP: [DL] BLE shutdown
2022-07-29 06:45:46.2805 -0700   error 0x21da2 0x183f3 homed[19990] (Matter): 🔴 [1659102346291] [19990:138658] CHIP: [DL] System Layer shutdown

Apple reference: radar:97794001

bzbarsky-apple added a commit to bzbarsky-apple/connectedhomeip that referenced this issue Aug 1, 2022
…ework.

Darwin framework objects were holding on to OperationalDeviceProxy and CHIPCluster instances, but OperationalDeviceProxy can be destroyed randomly by anyone who cares to do it, and CHIPCluster is really designed as a stack-only object.

This PR makes the following changes:

* MTRBaseDevice now either stores a DeviceProxy (for PASE only) or a node id
  (for CASE).

* MTRBaseCluster instances now just store a DeviceProxy.

* MTRCallbackBridge will handle getting an exchange manager and session before
  invoking the action block, unless the action block is runnable without any
  remote interaction (the "read from cache" case).

* Most of the MTRDevice and MTRClusters APIs that used to sync-run things on the
  Matter queue now do it async when doing CASE.  They were changed to copy their
  incoming arguments to avoid the caller mutating them after the call.

I believe this should fix project-chip#21430
bzbarsky-apple added a commit to bzbarsky-apple/connectedhomeip that referenced this issue Aug 1, 2022
…ework.

Darwin framework objects were holding on to OperationalDeviceProxy and CHIPCluster instances, but OperationalDeviceProxy can be destroyed randomly by anyone who cares to do it, and CHIPCluster is really designed as a stack-only object.

This PR makes the following changes:

* MTRBaseDevice now either stores a DeviceProxy (for PASE only) or a node id
  (for CASE).

* MTRBaseCluster instances now just store a DeviceProxy.

* MTRCallbackBridge will handle getting an exchange manager and session before
  invoking the action block, unless the action block is runnable without any
  remote interaction (the "read from cache" case).

* Most of the MTRDevice and MTRClusters APIs that used to sync-run things on the
  Matter queue now do it async when doing CASE.  They were changed to copy their
  incoming arguments to avoid the caller mutating them after the call.

I believe this should fix project-chip#21430
bzbarsky-apple added a commit to bzbarsky-apple/connectedhomeip that referenced this issue Aug 2, 2022
…ework.

Darwin framework objects were holding on to OperationalDeviceProxy and
CHIPCluster instances, but OperationalDeviceProxy can be destroyed randomly by
anyone who cares to do it, and CHIPCluster is really designed as a stack-only
object.

This PR makes the following changes:

* MTRBaseDevice now either stores a DeviceProxy (for PASE only) or a node id
  (for CASE).

* MTRBaseCluster instances now just store a DeviceProxy.

* MTRCallbackBridge will handle getting an exchange manager and session before
  invoking the action block, unless the action block is runnable without any
  remote interaction (the "read from cache" case).

* Most of the MTRDevice and MTRClusters APIs that used to sync-run things on the
  Matter queue now do it async when doing CASE.  They were changed to copy their
  incoming arguments to avoid the caller mutating them after the call.

I believe this should fix project-chip#21430
bzbarsky-apple added a commit to bzbarsky-apple/connectedhomeip that referenced this issue Aug 2, 2022
…ework.

Darwin framework objects were holding on to OperationalDeviceProxy and
CHIPCluster instances, but OperationalDeviceProxy can be destroyed randomly by
anyone who cares to do it, and CHIPCluster is really designed as a stack-only
object.

This PR makes the following changes:

* MTRBaseDevice now either stores a DeviceProxy (for PASE only) or a node id
  (for CASE).

* MTRBaseCluster instances now just store a DeviceProxy.

* MTRCallbackBridge will handle getting an exchange manager and session before
  invoking the action block, unless the action block is runnable without any
  remote interaction (the "read from cache" case).

* Most of the MTRDevice and MTRClusters APIs that used to sync-run things on the
  Matter queue now do it async when doing CASE.  They were changed to copy their
  incoming arguments to avoid the caller mutating them after the call.

I believe this should fix project-chip#21430
bzbarsky-apple added a commit to bzbarsky-apple/connectedhomeip that referenced this issue Aug 2, 2022
…ework.

Darwin framework objects were holding on to OperationalDeviceProxy and
CHIPCluster instances, but OperationalDeviceProxy can be destroyed randomly by
anyone who cares to do it, and CHIPCluster is really designed as a stack-only
object.

This PR makes the following changes:

* MTRBaseDevice now either stores a DeviceProxy (for PASE only) or a node id
  (for CASE).

* MTRBaseCluster instances now just store a DeviceProxy.

* MTRCallbackBridge will handle getting an exchange manager and session before
  invoking the action block, unless the action block is runnable without any
  remote interaction (the "read from cache" case).

* Most of the MTRDevice and MTRClusters APIs that used to sync-run things on the
  Matter queue now do it async when doing CASE.  They were changed to copy their
  incoming arguments to avoid the caller mutating them after the call.

I believe this should fix project-chip#21430
woody-apple pushed a commit that referenced this issue Aug 2, 2022
…ework. (#21504)

Darwin framework objects were holding on to OperationalDeviceProxy and
CHIPCluster instances, but OperationalDeviceProxy can be destroyed randomly by
anyone who cares to do it, and CHIPCluster is really designed as a stack-only
object.

This PR makes the following changes:

* MTRBaseDevice now either stores a DeviceProxy (for PASE only) or a node id
  (for CASE).

* MTRBaseCluster instances now just store a DeviceProxy.

* MTRCallbackBridge will handle getting an exchange manager and session before
  invoking the action block, unless the action block is runnable without any
  remote interaction (the "read from cache" case).

* Most of the MTRDevice and MTRClusters APIs that used to sync-run things on the
  Matter queue now do it async when doing CASE.  They were changed to copy their
  incoming arguments to avoid the caller mutating them after the call.

I believe this should fix #21430
github-actions bot pushed a commit that referenced this issue Aug 2, 2022
…ework. (#21504)

Darwin framework objects were holding on to OperationalDeviceProxy and
CHIPCluster instances, but OperationalDeviceProxy can be destroyed randomly by
anyone who cares to do it, and CHIPCluster is really designed as a stack-only
object.

This PR makes the following changes:

* MTRBaseDevice now either stores a DeviceProxy (for PASE only) or a node id
  (for CASE).

* MTRBaseCluster instances now just store a DeviceProxy.

* MTRCallbackBridge will handle getting an exchange manager and session before
  invoking the action block, unless the action block is runnable without any
  remote interaction (the "read from cache" case).

* Most of the MTRDevice and MTRClusters APIs that used to sync-run things on the
  Matter queue now do it async when doing CASE.  They were changed to copy their
  incoming arguments to avoid the caller mutating them after the call.

I believe this should fix #21430
woody-apple added a commit that referenced this issue Aug 2, 2022
…ework. (#21504) (#21528)

Darwin framework objects were holding on to OperationalDeviceProxy and
CHIPCluster instances, but OperationalDeviceProxy can be destroyed randomly by
anyone who cares to do it, and CHIPCluster is really designed as a stack-only
object.

This PR makes the following changes:

* MTRBaseDevice now either stores a DeviceProxy (for PASE only) or a node id
  (for CASE).

* MTRBaseCluster instances now just store a DeviceProxy.

* MTRCallbackBridge will handle getting an exchange manager and session before
  invoking the action block, unless the action block is runnable without any
  remote interaction (the "read from cache" case).

* Most of the MTRDevice and MTRClusters APIs that used to sync-run things on the
  Matter queue now do it async when doing CASE.  They were changed to copy their
  incoming arguments to avoid the caller mutating them after the call.

I believe this should fix #21430

Co-authored-by: Boris Zbarsky <bzbarsky@apple.com>
isiu-apple pushed a commit to isiu-apple/connectedhomeip that referenced this issue Sep 16, 2022
…ework. (project-chip#21504)

Darwin framework objects were holding on to OperationalDeviceProxy and
CHIPCluster instances, but OperationalDeviceProxy can be destroyed randomly by
anyone who cares to do it, and CHIPCluster is really designed as a stack-only
object.

This PR makes the following changes:

* MTRBaseDevice now either stores a DeviceProxy (for PASE only) or a node id
  (for CASE).

* MTRBaseCluster instances now just store a DeviceProxy.

* MTRCallbackBridge will handle getting an exchange manager and session before
  invoking the action block, unless the action block is runnable without any
  remote interaction (the "read from cache" case).

* Most of the MTRDevice and MTRClusters APIs that used to sync-run things on the
  Matter queue now do it async when doing CASE.  They were changed to copy their
  incoming arguments to avoid the caller mutating them after the call.

I believe this should fix project-chip#21430
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant