Android 13 sync app disconecting from catfish

[librarydemise457892]

Unable to maintain connectivity in the sync app with catfish on Android 13. Watch briefly connects to app but then immediately disconnects. If you do manage to get it connected (see edge cases below) it will connect for a couple of hours before then exhibiting the above issues. Watch behaves normally with all other tested devices and it seems to only be an issue with the sync app.

Tested on:
Android 13 (both f droid most recent and test build mentioned below)
Ubuntu touch (using telescope)

Couldn't test on any other android phones (only tested on 13 but nobody in matrix seems to be having this issue) to reproduce the issue and couldn't get the starfish client for Sailfish Os to install.

Steps to reproduce:

1. Turn on phone and watch (cold boot and reboot exhibit same issue *)
2. Install Sync App from f droid
3. Allow all permissions including restricted android 13 notification settings and to allow run in background without being shutdown
   
4. Select catfish when it appears and confirm the pairing code
5. Sync app shows it is connected and watch will buzz with notifications before showing the disconnected screen
6. Press the reconnect button. Repeat of step 5.

*Issue does always not occur on clean install of the app. Issue occurs once it has been connected for a couple of hours at which point it disconnects, can then be reconnected for 5 seconds before disconnecting again. I tested a clean install again today and the issue persisted.

Attempted troubleshooting:

• Clear cache and storage
• Reset and allow all asked for permissions
• Reinstall the app (sometimes it would connect and sync fine like reported in the matrix chat, but then after a few hours would quietly disconnect and then repeat steps 5-6)

Observations;

• While location permission is asked for and is set to precise, on Android 13 is not asking for permission to run in the background (see full list of permissions)
  
  
• When the pairing dialogue appears (on my android phone) it shows the name "ubuntu phablet" which is the name of the Ubuntu phone I tested on without any issues. This is even after forgetting.
• I left the watch on (and unattended) while I left the house and went for a run. I paired my Sony earbuds using gadgetbridge, disconnected when I came home then tried to connect catfish using the sync app again. To my surprise the watch connected for a couple of hours seemingly without issue until it disconnected and repeated steps 5-6.
• When it was claiming to be connected via the android sync app, the battery of the watch was not accurate, which leads me to believe it wasn't actually connected.

Android 13 ( Graphene OS across several builds from 04/02/23 onwards)
Catfish running build id 202301128132217
Asteroid OS sync app from F droid version 0.27 AND unsigned build from @Doomsdayrs based on pull requests #189 / #190 (all pictures where taken showing the test build rather than the fdroid build)

This is my first github issue so please let me know if there is an issue format for this repository. Additionally if you walk me through it I can test and provide the logs.

[librarydemise457892]

Update:

Re flashed the watch tonight to nightly build 20230210035535 and reinstalled the app after having not played around with it since writing the above last week (not had time to test). Issue still persists across builds.

[librarydemise457892]

Update 2:
After using Ubuntu touch and a clean flash of catfish for 24hrs without disconnects I tried the new gadget bridge build today (0.73.0) that merged asteroid support to see if the issue was present using this app. Although I was able to connect unlike the asteroid sync app the end result was it disconnecting after 1hr 10min. I was able to reconnect after this (It was asking me to re pair the device). I will check the logs to see if there is something obvious.

[sevmonster]

I also had this issue, and the problem isn't just that it is disconnecting, the Bluetooth stack is crashing. #194

[librarydemise457892]

I also had this issue, and the problem isn't just that it is disconnecting, the Bluetooth stack is crashing. #194

I see. I'm glad I finally found someone else who is able to replicate this and it's not just me. We have a similar setup with Graphene on Pixel 6 and 6 pro respectively. I've been trying to keep track of this issue and although I've seen only a handful of people with different watches (and some A13 roms but never 12) in matrix chat describing something similar none of them got back to me (and those that did couldn't replicate it). For the record to gauge any patterns what watch did you experience this on? Not sure if it's worth updating this thread if it's beyond the scope of just catfish?

I did experience the same on Gadget bridge as per the recommendations of that thread and above.

[sevmonster]

Yeah I've been using Gadgetbridge and while it has been more stable, I have been seeing possible crashes an hour or more into the Bluetooth connection, though logcat is never running when I notice it happening. (Gadgetbridge also doesn't stay connected in the background regardless, so even if it didn't crash it doesn't really matter.)

So Android 13 ROMs and multiple brands of watches, not just catfish? I was leaning toward this might be a bug in the Bluetooth stack and I think that points more there.

Have you or anyone else brought this to GrapheneOS or Google?

[librarydemise457892]

Yeah I've been using Gadgetbridge and while it has been more stable, I have been seeing possible crashes an hour or more into the Bluetooth connection, though logcat is never running when I notice it happening. (Gadgetbridge also doesn't stay connected in the background regardless, so even if it didn't crash it doesn't really matter.)

So Android 13 ROMs and multiple brands of watches, not just catfish? I was leaning toward this might be a bug in the Bluetooth stack and I think that points more there.

Have you or anyone else brought this to GrapheneOS or Google?

Same here on gadgetbridge.

I can't confirm it at the moment but I've been in touch with a user who goes by totalsonic1 who I believe is having similar issues on other A13 roms (Bliss 16.5 and Arrow OS 13) but will need them to confirm what watch they are having issues with and then confirm it's the same issue and not a similar one. I linked them this thread so hopefully they can post their experience here.

As for who I've brought this to, nobody aside from here. Didn't bring it to graphene as based on Matrix chat and some digging seemed like a broader Android 13 issue. Haven't told Google/Android team as don't have logs and honestly not really sure where I would start posting to bring it to them. I'm not sure if anyone else is tracking this issue.

[sevmonster]

logcat_02-27-2023_21-32-48.txt

[02-27 21:23:55.236 12572:12599 D/BtGatt.GattService]
writeCharacteristic() - trying to acquire permit.
[02-27 21:23:55.236 12572:12637 F/libc]
FORTIFY: memcpy: prevented 555-byte write into 513-byte buffer
[02-27 21:23:55.237 12572:12637 F/libc]
Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 12637 (bt_main_thread), pid 12572 (droid.bluetooth)

Does your crash look similar?

[librarydemise457892]

logcat_02-27-2023_21-32-48.txt

[02-27 21:23:55.236 12572:12599 D/BtGatt.GattService]
writeCharacteristic() - trying to acquire permit.
[02-27 21:23:55.236 12572:12637 F/libc]
FORTIFY: memcpy: prevented 555-byte write into 513-byte buffer
[02-27 21:23:55.237 12572:12637 F/libc]
Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 12637 (bt_main_thread), pid 12572 (droid.bluetooth)

Does your crash look similar?

Tell me how you got this and I'll try to recreate it. Problem happens frequently so don't imagine it would be too difficult.

[sevmonster]

Don't worry about it. A scant amount of research has revealed the issue.

NordicSemiconductor/Android-BLE-Library#420 (comment)

Apparently before Android 13, the BLE stack was allowing out-of-spec buffer sizes for characteristics. This is not an Android bug, it is an AsteroidOS bug. If the characteristic size is larger than 512 under Android 13 it will overflow the buffer and crash. Previous versions of Android would silently allow this behavior.

[librarydemise457892]

Don't worry about it. A scant amount of research has revealed the issue.

NordicSemiconductor/Android-BLE-Library#420 (comment)

Apparently before Android 13, the BLE stack was allowing out-of-spec buffer sizes for characteristics. This is not an Android bug, it is an AsteroidOS bug. If the characteristic size is larger than 512 under Android 13 it will overflow the buffer and crash. Previous versions of Android would silently allow this behavior.

Ahh I was looking in all the wrong places then... DodoRadio did say something to me in Matrix chat about it being an issue with BT LE in Android 13 but I would never have found this. Hopefully this helps someone.

[sevmonster]

At this point the app is basically unusable on Android 13 until this is resolved. I haven't gotten logs for Gadgetbridge but I will assume if it is crashing too it'll be for a similar reason.

Maybe some watches/implementations don't have this issue, I am ignorant to app internals—but this bug still has the ability to manifest under I assume any Android 13 device.

[librarydemise457892]

logcat_02-27-2023_21-32-48.txt

[02-27 21:23:55.236 12572:12599 D/BtGatt.GattService]
writeCharacteristic() - trying to acquire permit.
[02-27 21:23:55.236 12572:12637 F/libc]
FORTIFY: memcpy: prevented 555-byte write into 513-byte buffer
[02-27 21:23:55.237 12572:12637 F/libc]
Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 12637 (bt_main_thread), pid 12572 (droid.bluetooth)

Does your crash look similar?

I have found how to run logcat (https://www.xda-developers.com/how-to-take-logs-android/) and will try to grab some logs later this week. Hopefully some of those people I contacted with different setups can comment and share their experience to help paint a better picture of this issue.

[sevmonster]

This characteristic caused the overflow on my device:

[03-26 14:31:25.502 17005:17005 D/class org.asteroidos.sync.services.SynchronizationService]
00009001-0000-0000-0000-00a57e401d05 [60, 105, 110, 115, 101, 114, 116, 62, 60, 105, 100, 62, 49, 53, 52, 52, 56, 48, 51, 57, 48, 53, 60, 47, 105, 100, 62, 60, 112, 110, 62, 100, 101, 46, 108, 117, 104, 109, 101, 114, 46, 111, 119, 110, 99, 108, 111, 117, 100, 110, 101, 119, 115, 114, 101, 97, 100, 101, 114, 60, 47, 112, 110, 62, 60, 118, 98, 62, 110, 111, 114, 109, 97, 108, 60, 47, 118, 98, 62, 60, 97, 110, 62, 78, 101, 119, 115, 60, 47, 97, 110, 62, 60, 115, 117, 62, 89, 111, 117, 32, 104, 97, 118, 101, 32, 49, 54, 49, 56, 32, 110, 101, 119, 32, 117, 110, 114, 101, 97, 100, 32, 105, 116, 101, 109, 115, 60, 47, 115, 117, 62, 60, 98, 111, 62, -30, -128, -94, 32, 72, 111, 119, 32, 65, 114, 109, 32, 97, 105, 109, 115, 32, 116, 111, 32, 115, 113, 117, 101, 101, 122, 101, 32, 100, 101, 118, 105, 99, 101, 32, 109, 97, 107, 101, 114, 115, 32, 102, 111, 114, 32, 99, 97, 115, 104, 32, 114, 97, 116, 104, 101, 114, 32, 116, 104, 97, 110, 32, 112, 111, 99, 107, 101, 116, 32, 112, 101, 110, 110, 105, 101, 115, 32, 102, 111, 114, 32, 99, 111, 114, 101, 115, 10, -30, -128, -94, 32, 82, 73, 80, 32, 71, 111, 114, 100, 111, 110, 32, 77, 111, 111, 114, 101, 58, 32, 73, 110, 116, 101, 108, 32, 99, 111, 45, 102, 111, 117, 110, 100, 101, 114, 32, 100, 105, 101, 115, 44, 32, 97, 103, 101, 100, 32, 57, 52, 10, -30, -128, -94, 32, 85, 116, 97, 104, 32, 111, 117, 116, 108, 97, 119, 115, 32, 107, 105, 100, 115, 39, 32, 115, 111, 99, 105, 97, 108, 32, 109, 101, 100, 105, 97, 32, 97, 100, 100, 105, 99, 116, 105, 111, 110, 44, 32, 115, 101, 116, 115, 32, 100, 105, 103, 105, 116, 97, 108, 32, 99, 117, 114, 102, 101, 119, 10, -30, -128, -94, 32, 67, 73, 83, 65, 32, 117, 110, 108, 101, 97, 115, 104, 101, 115, 32, 85, 110, 116, 105, 116, 108, 101, 100, 32, 71, 111, 111, 115, 101, 32, 84, 111, 111, 108, 32, 116, 111, 32, 104, 111, 110, 107, 32, 97, 116, 32, 100, 97, 110, 103, 101, 114, 32, 105, 110, 32, 77, 105, 99, 114, 111, 115, 111, 102, 116, 39, 115, 32, 99, 108, 111, 117, 100, 10, -30, -128, -94, 32, 71, 105, 116, 72, 117, 98, 32, 112, 117, 98, 108, 105, 115, 104, 101, 115, 32, 82, 83, 65, 32, 83, 83, 72, 32, 104, 111, 115, 116, 32, 107, 101, 121, 115, 32, 98, 121, 32, 109, 105, 115, 116, 97, 107, 101, 44, 32, 105, 115, 115, 117, 101, 115, 32, 117, 112, 100, 97, 116, 101, 10, -30, -128, -94, 32, 70, 114, 101, 110, 99, 104, 32, 112, 97, 114, 108, 105, 97, 109, 101, 110, 116, 32, 115, 97, 121, 115, 32, 111, 117, 105, 32, 116, 111, 32, 65, 73, 32, 115, 117, 114, 118, 101, 105, 108, 108, 97, 110, 99, 101, 32, 102, 111, 114, 32, 50, 48, 50, 52, 32, 80, 97, 114, 105, 115, 32, 79, 108, 121, 109, 112, 105, 99, 115, 60, 47, 98, 111, 62, 60, 47, 105, 110, 115, 101, 114, 116, 62]

574B!

I have a feeling this might be related to Nextcloud News sending huge notifications. After clearing it, I am not getting crashes just yet. This would make sense given the notification update characteristic UUID.

@librarydemise457892 You can use https://github.com/darshanparajuli/LogcatReader

edit: I was right, that packet is for my newsfeed notification.

[librarydemise457892]

This characteristic caused the overflow on my device:

[03-26 14:31:25.502 17005:17005 D/class org.asteroidos.sync.services.SynchronizationService]
00009001-0000-0000-0000-00a57e401d05 [60, 105, 110, 115, 101, 114, 116, 62, 60, 105, 100, 62, 49, 53, 52, 52, 56, 48, 51, 57, 48, 53, 60, 47, 105, 100, 62, 60, 112, 110, 62, 100, 101, 46, 108, 117, 104, 109, 101, 114, 46, 111, 119, 110, 99, 108, 111, 117, 100, 110, 101, 119, 115, 114, 101, 97, 100, 101, 114, 60, 47, 112, 110, 62, 60, 118, 98, 62, 110, 111, 114, 109, 97, 108, 60, 47, 118, 98, 62, 60, 97, 110, 62, 78, 101, 119, 115, 60, 47, 97, 110, 62, 60, 115, 117, 62, 89, 111, 117, 32, 104, 97, 118, 101, 32, 49, 54, 49, 56, 32, 110, 101, 119, 32, 117, 110, 114, 101, 97, 100, 32, 105, 116, 101, 109, 115, 60, 47, 115, 117, 62, 60, 98, 111, 62, -30, -128, -94, 32, 72, 111, 119, 32, 65, 114, 109, 32, 97, 105, 109, 115, 32, 116, 111, 32, 115, 113, 117, 101, 101, 122, 101, 32, 100, 101, 118, 105, 99, 101, 32, 109, 97, 107, 101, 114, 115, 32, 102, 111, 114, 32, 99, 97, 115, 104, 32, 114, 97, 116, 104, 101, 114, 32, 116, 104, 97, 110, 32, 112, 111, 99, 107, 101, 116, 32, 112, 101, 110, 110, 105, 101, 115, 32, 102, 111, 114, 32, 99, 111, 114, 101, 115, 10, -30, -128, -94, 32, 82, 73, 80, 32, 71, 111, 114, 100, 111, 110, 32, 77, 111, 111, 114, 101, 58, 32, 73, 110, 116, 101, 108, 32, 99, 111, 45, 102, 111, 117, 110, 100, 101, 114, 32, 100, 105, 101, 115, 44, 32, 97, 103, 101, 100, 32, 57, 52, 10, -30, -128, -94, 32, 85, 116, 97, 104, 32, 111, 117, 116, 108, 97, 119, 115, 32, 107, 105, 100, 115, 39, 32, 115, 111, 99, 105, 97, 108, 32, 109, 101, 100, 105, 97, 32, 97, 100, 100, 105, 99, 116, 105, 111, 110, 44, 32, 115, 101, 116, 115, 32, 100, 105, 103, 105, 116, 97, 108, 32, 99, 117, 114, 102, 101, 119, 10, -30, -128, -94, 32, 67, 73, 83, 65, 32, 117, 110, 108, 101, 97, 115, 104, 101, 115, 32, 85, 110, 116, 105, 116, 108, 101, 100, 32, 71, 111, 111, 115, 101, 32, 84, 111, 111, 108, 32, 116, 111, 32, 104, 111, 110, 107, 32, 97, 116, 32, 100, 97, 110, 103, 101, 114, 32, 105, 110, 32, 77, 105, 99, 114, 111, 115, 111, 102, 116, 39, 115, 32, 99, 108, 111, 117, 100, 10, -30, -128, -94, 32, 71, 105, 116, 72, 117, 98, 32, 112, 117, 98, 108, 105, 115, 104, 101, 115, 32, 82, 83, 65, 32, 83, 83, 72, 32, 104, 111, 115, 116, 32, 107, 101, 121, 115, 32, 98, 121, 32, 109, 105, 115, 116, 97, 107, 101, 44, 32, 105, 115, 115, 117, 101, 115, 32, 117, 112, 100, 97, 116, 101, 10, -30, -128, -94, 32, 70, 114, 101, 110, 99, 104, 32, 112, 97, 114, 108, 105, 97, 109, 101, 110, 116, 32, 115, 97, 121, 115, 32, 111, 117, 105, 32, 116, 111, 32, 65, 73, 32, 115, 117, 114, 118, 101, 105, 108, 108, 97, 110, 99, 101, 32, 102, 111, 114, 32, 50, 48, 50, 52, 32, 80, 97, 114, 105, 115, 32, 79, 108, 121, 109, 112, 105, 99, 115, 60, 47, 98, 111, 62, 60, 47, 105, 110, 115, 101, 114, 116, 62]

574B!

@librarydemise457892 You can use https://github.com/darshanparajuli/LogcatReader

I will look into this. May encounter issues as not rooted but will see what I can come up with.

Edit: I see the option for ADB approval in the app. I will try this.

[sevmonster]

You don't need root, and if you use Termux (pkg install android-tools) or similar, you can connect from your device. Once you get your logs (filter by tag org.asteroidos.sync), find the UUID of any message over 512B, and that will be your culprit.

I've managed to sidestep the issue by blacklisting apps that might send large notifications. It's not optimal since those notifications are generally ones I want (chat and email) but it's better than Bluetooth crashing every time my feeds update or I get an email.

[librarydemise457892]

logcat_02-27-2023_21-32-48.txt

[02-27 21:23:55.236 12572:12599 D/BtGatt.GattService]
writeCharacteristic() - trying to acquire permit.
[02-27 21:23:55.236 12572:12637 F/libc]
FORTIFY: memcpy: prevented 555-byte write into 513-byte buffer
[02-27 21:23:55.237 12572:12637 F/libc]
Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 12637 (bt_main_thread), pid 12572 (droid.bluetooth)

Does your crash look similar?

I tried using the logcat app you linked but I could not recreate this. I gave it all the authorizations it asked for but when I tried to pair my watch with my phone, it did replicate the behavior of not being able to connect, but when I looked in the logs there were no messages with a corresponding time stamp for the issue. I rebooted and double checked that logcat had full access to logs and tried again a few more times but I could not get it to produce a log to explain this behavior. I'll need to try again later.

I see a new PR has been merged so hopefully there is a new build that fixes this soon.

EDIT:

I retested using adb logcat -v time > logcat.txt and managed to find the corresponding error which corroborates what Sev experienced (Followed by several large blocks of D/class org.asteroidos.sync.services.SynchronizationService].

03-28 16:36:19.428 F/libc (10208): FORTIFY: memcpy: prevented 600-byte write into 513-byte buffer
03-28 16:36:19.429 F/libc (10208): Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 10409 (bt_main_thread), pid 10208 (droid.bluetooth)

[eLtMosen]

Perillamint was so kind to share a compiled version in the matrix chat.
Mind that it will likely needed to be installed using adb install app-debug.apk from a pc connected to the phone. I tried the usual click-in-filemanager but that did not work or was refused.
app-debug.apk.zip

[sevmonster]

You need to uninstall the old app because it's using a different signature. adb shouldn't be required. Some vendors might block the app because the cert subject is C=US, O=Android, CN=Android Debug.

I think the PR fixed the issue. Haven't had any crashes with long notifications. I will continue testing this version.

[librarydemise457892]

Perillamint was so kind to share a compiled version in the matrix chat. Mind that it will likely needed to be installed using adb install app-debug.apk from a pc connected to the phone. I tried the usual click-in-filemanager but that did not work or was refused. app-debug.apk.zip

Installed successfully and running now. Will report back on stability but already an improvement as it can connect.

[sevmonster]

I haven't had any spontaneous disconnections or crashes since installing the debug build.

[librarydemise457892]

I haven't had any spontaneous disconnections or crashes since installing the debug build.

Yeah sorry for the slow reply. Took some extra time to test it and no drop outs or crashes. Only issue is some notifications don't come through for certain apps but believe that is out of the scope of this issue, and I can open a new one and close this issue once this new builds hits stable release.

Thanks to everyone who worked on this we got there.

[stylefish]

hi :)
seems like i'm affected by this issue too. i've not tested the debug build above, because i was wondering if are there any plans on releasing this to the official f-droid app?
greetings