GetServices crashes in 2.0.0+ when connecting to heart rate monitor

[FIXMBR]

Board

ESP32

Device Description

Watchy smartwatch

Hardware Configuration

link to hardware documentation

Version

latest master

IDE Name

Arduino VS Code

Operating System

Arch Linux

Flash frequency

80Mhz

PSRAM enabled

no

Upload speed

921600

Description

I'm trying to connect to Polar H10 heart rate monitor.
From what I gathered, while it's connecting, function pClient->getService invokes getServices. Expected behavior is to return services map, instead it crashes with Stack canary watchpoint triggered (BTU_TASK) .

Sketch

/**
   A BLE client example that is rich in capabilities.
   There is a lot new capabilities implemented.
   author unknown
   updated by chegewara
*/
// #define CONFIG_BT_NIMBLE_TASK_STACK_SIZE 32768
#include "BLEDevice.h"
//#include "BLEScan.h"

// The remote service we wish to connect to.
static BLEUUID serviceUUID(BLEUUID((uint16_t)0x180D));
// The characteristic of the remote service we are interested in.
static BLEUUID charUUID(BLEUUID((uint16_t)0x2A37));

// static BLEAddress *pServerAddress;

static boolean doConnect = false;
static boolean connected = false;
static boolean doScan = false;
static BLERemoteCharacteristic *pRemoteCharacteristic;
static BLEAdvertisedDevice *myDevice;

static void notifyCallback(
    BLERemoteCharacteristic *pBLERemoteCharacteristic,
    uint8_t *pData,
    size_t length,
    bool isNotify)
{
    Serial.print("Notify callback for characteristic ");
    //  for (int i = 0; i < length; i++) {
    //    Serial.print(pData[i]);
    //    Serial.print(" ");
    //  }
    //  Serial.println();

    uint8_t HR_val;
    if (pData[0] == 16)
    {
        if (pData[1] > 10 && pData[1] < 254)
        { // HR must be between 10 and 254 bpm
            HR_val = pData[1];
            // HR_contact = true;
        }
        else
            HR_val = 0;
    }
    else
    {
        HR_val = 0;
        // HR_contact = false;
    }
    Serial.println(HR_val);
}

class MyClientCallback : public BLEClientCallbacks
{
    void onConnect(BLEClient *pclient)
    {
        connected = true;
        Serial.println("onConnect");
    }

    void onDisconnect(BLEClient *pclient)
    {
        connected = false;
        Serial.println("onDisconnect");
    }
};

bool connectToServer()
{
    Serial.print("Forming a connection to ");
    Serial.println(myDevice->getAddress().toString().c_str());

    BLEClient *pClient = BLEDevice::createClient();
    Serial.println(" - Created client");

    pClient->setClientCallbacks(new MyClientCallback());

    // Connect to the remove BLE Server.
    pClient->connect(myDevice); // if you pass BLEAdvertisedDevice instead of address, it will be recognized type of peer device address (public or private)
    Serial.println(" - Connected to server");

    // Serial.println(CONFIG_BT_BTU_TASK_STACK_SIZE);

    // Obtain a reference to the service we are after in the remote BLE server.
    BLERemoteService *pRemoteService = pClient->getService(serviceUUID);
    if (pRemoteService == nullptr)
    {
        Serial.print("Failed to find our service UUID: ");
        Serial.println(serviceUUID.toString().c_str());
        pClient->disconnect();
        return false;
    }
    Serial.println(" - Found our service");

    // Obtain a reference to the characteristic in the service of the remote BLE server.
    pRemoteCharacteristic = pRemoteService->getCharacteristic(charUUID);
    if (pRemoteCharacteristic == nullptr)
    {
        Serial.print("Failed to find our characteristic UUID: ");
        Serial.println(charUUID.toString().c_str());
        pClient->disconnect();
        return false;
    }
    Serial.println(" - Found our characteristic");

    // Read the value of the characteristic.
    if (pRemoteCharacteristic->canRead())
    {
        std::string value = pRemoteCharacteristic->readValue();
        Serial.print("The characteristic value was: ");
        Serial.println(value.c_str());
    }

    if (pRemoteCharacteristic->canNotify())
        pRemoteCharacteristic->registerForNotify(notifyCallback);

    connected = true;
    return true;
}
/**
   Scan for BLE servers and find the first one that advertises the service we are looking for.
*/
class MyAdvertisedDeviceCallbacks : public BLEAdvertisedDeviceCallbacks
{
    /**
        Called for each advertising BLE server.
    */
    void onResult(BLEAdvertisedDevice advertisedDevice)
    {
        Serial.print("BLE Advertised Device found: ");
        Serial.println(advertisedDevice.toString().c_str());

        // We have found a device, let us now see if it contains the service we are looking for.
        if (advertisedDevice.haveServiceUUID() && advertisedDevice.isAdvertisingService(serviceUUID))
        {

            BLEDevice::getScan()->stop();
            myDevice = new BLEAdvertisedDevice(advertisedDevice);
            doConnect = true;
            doScan = true;

        } // Found our server
    }     // onResult
};        // MyAdvertisedDeviceCallbacks

void setup()
{
    Serial.begin(115200);
    Serial.println("Starting Arduino BLE Client application...");
    BLEDevice::init("");

    // Retrieve a Scanner and set the callback we want to use to be informed when we
    // have detected a new device.  Specify that we want active scanning and start the
    // scan to run for 5 seconds.
    BLEScan *pBLEScan = BLEDevice::getScan();
    pBLEScan->setAdvertisedDeviceCallbacks(new MyAdvertisedDeviceCallbacks());
    pBLEScan->setInterval(1349);
    pBLEScan->setWindow(449);
    pBLEScan->setActiveScan(true);
    pBLEScan->start(5, false);
} // End of setup.

// This is the Arduino main loop function.
void loop()
{

    // If the flag "doConnect" is true then we have scanned for and found the desired
    // BLE Server with which we wish to connect.  Now we connect to it.  Once we are
    // connected we set the connected flag to be true.
    if (doConnect == true)
    {
        if (connectToServer())
        {
            Serial.println("We are now connected to the BLE Server.");
        }
        else
        {
            Serial.println("We have failed to connect to the server; there is nothin more we will do.");
        }
        doConnect = false;
    }

    // If we are connected to a peer BLE Server, update the characteristic each time we are reached
    // with the current time since boot.
    if (connected)
    {
        String newValue = "Time since boot: " + String(millis() / 1000);
        Serial.println("Setting new characteristic value to \"" + newValue + "\"");

        // Set the characteristic's value to be the array of bytes that is actually a string.
        pRemoteCharacteristic->writeValue(newValue.c_str(), newValue.length());
    }
    else if (doScan)
    {
        BLEDevice::getScan()->start(0); // this is just eample to start scan after disconnect, most likely there is better way to do it in arduino
    }

    delay(1000); // Delay a second between loops.
} // End of loop

Debug Message

Starting Arduino BLE Client application...
[   897][D][BLEAdvertisedDevice.cpp:472] setRSSI(): - setRSSI(): rssi: -76
[   897][D][BLEAdvertisedDevice.cpp:292] parseAdvertisement(): Type: 0x01 (), length: 1, data: 06
[   901][D][BLEAdvertisedDevice.cpp:292] parseAdvertisement(): Type: 0x02 (), length: 4, data: 0d18eefe
[   910][D][BLEAdvertisedDevice.cpp:500] setServiceUUID(): - addServiceUUID(): serviceUUID: 0000180d-0000-1000-8000-00805f9b34fb
[   922][D][BLEAdvertisedDevice.cpp:500] setServiceUUID(): - addServiceUUID(): serviceUUID: 0000feee-0000-1000-8000-00805f9b34fb
[   933][D][BLEAdvertisedDevice.cpp:292] parseAdvertisement(): Type: 0x0a (), length: 1, data: 04
[   942][D][BLEAdvertisedDevice.cpp:530] setTXPower(): - txPower: 4
[   948][D][BLEAdvertisedDevice.cpp:292] parseAdvertisement(): Type: 0xff (), length: 6, data: 6b003f000053
[   957][D][BLEAdvertisedDevice.cpp:449] setManufacturerData(): - manufacturer data: 6b003f000053
[   966][D][BLEAdvertisedDevice.cpp:292] parseAdvertisement(): Type: 0x09 (), length: 18, data: 506f6c617220483130203642453137373241
[   977][D][BLEAdvertisedDevice.cpp:461] setName(): - setName(): name: Polar H10 6BE1772A
BLE Advertised Device found: Name: Polar H10 6BE1772A, Address: f9:97:a1:c6:b4:da, manufacturer data: 6b003f000053, serviceUUID: 0000180d-0000-1000-8000-00805f9b34fb, serviceUUID: 0000feee-0000-1000-8000-00805f9b34fb, txPower: 4
Forming a connection to f9:97:a1:c6:b4:da
 - Created client
[  2007][I][BLEDevice.cpp:622] addPeerDevice(): add conn_id: 0, GATT role: client
[  2008][D][BLEDevice.cpp:148] gattClientEventHandler(): gattClientEventHandler [esp_gatt_if: 4] ... Unknown
[  2017][D][BLEClient.cpp:178] gattClientEventHandler(): gattClientEventHandler [esp_gatt_if: 4] ... Unknown
[  2488][D][BLEDevice.cpp:148] gattClientEventHandler(): gattClientEventHandler [esp_gatt_if: 4] ... Unknown
[  2488][D][BLEClient.cpp:178] gattClientEventHandler(): gattClientEventHandler [esp_gatt_if: 4] ... Unknown
[  2496][D][BLEDevice.cpp:148] gattClientEventHandler(): gattClientEventHandler [esp_gatt_if: 4] ... Unknown
[  2505][D][BLEClient.cpp:178] gattClientEventHandler(): gattClientEventHandler [esp_gatt_if: 4] ... Unknown
onConnect
 - Connected to server
Guru Meditation Error: Core  0 panic'ed (Unhandled debug exception). 
Debug exception reason: Stack canary watchpoint triggered (BTU_TASK) 
Core  0 register dump:
PC      : 0x40094dbe  PS      : 0x00060836  A0      : 0x80096bda  A1      : 0x3ffd6c80  
A2      : 0x3ffb6c34  A3      : 0x00060820  A4      : 0x00000000  A5      : 0x00000000  
A6      : 0x00000000  A7      : 0x00000000  A8      : 0x801192e4  A9      : 0x3ffd6d90  
A10     : 0x00000001  A11     : 0x00000008  A12     : 0x00000000  A13     : 0x00000001  
A14     : 0x00000000  A15     : 0x00000001  SAR     : 0x0000001d  EXCCAUSE: 0x00000001  
EXCVADDR: 0x00000000  LBEG    : 0x4008f7d0  LEND    : 0x4008f7db  LCOUNT  : 0xffffffff  


Backtrace:0x40094dbb:0x3ffd6c800x40096bd7:0x3ffd6cc0 0x40096e42:0x3ffd6ce0 0x40096e77:0x3ffd6d00 0x4008356c:0x3ffd6d20 0x400835a9:0x3ffd6d50 0x400971d3:0x3ffd6d70 0x400971f4:0x3ffd6d90 0x401192e1:0x3ffd6db0 0x40118ad9:0x3ffd6dd0 0x4011989d:0x3ffd6df0 0x400eedf1:0x3ffd6e10 0x400efe86:0x3ffd6e30 0x4010d531:0x3ffd6e50 0x4010e209:0x3ffd6e70 0x40109ec8:0x3ffd6e90 0x40131ff9:0x3ffd6ec0 0x40132154:0x3ffd6ee0 0x40132326:0x3ffd6f00 0x40101332:0x3ffd6f40 0x401006a6:0x3ffd71d0 0x4011c82f:0x3ffd71f0 0x4011ccd1:0x3ffd7230 0x4011cd89:0x3ffd74c0 0x4011cda7:0x3ffd74e0 0x4011cd6d:0x3ffd7500 0x4011cda7:0x3ffd7520 0x4011cd6d:0x3ffd7540 0x4011cda7:0x3ffd7560 0x4011cd6d:0x3ffd7580 0x4011cda7:0x3ffd75a0 0x4011cd6d:0x3ffd75c0 0x4011cda7:0x3ffd75e0 0x4011cd6d:0x3ffd7600 0x4011cf53:0x3ffd7620 0x4010664d:0x3ffd7640 0x40101355:0x3ffd78e0 0x40101836:0x3ffd7b70 0x401021d5:0x3ffd7be0 0x401037a3:0x3ffd7c10 0x401037e2:0x3ffd7c30 0x401109a9:0x3ffd7c50 0x400ff1a2:0x3ffd7dd0 0x401195e3:0x3ffd7df0 




PC: 0x40094dbe: vPortEnterCritical at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/freertos/port/xtensa/include/freertos/portmacro.h line 109
EXCVADDR: 0x00000000

Decoding stack results
0x40094dbb: vPortEnterCritical at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/freertos/port/xtensa/include/freertos/portmacro.h line 109
0x40096bd7: multi_heap_internal_lock at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/heap/multi_heap.c line 152
0x40096e42: multi_heap_malloc at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/heap/multi_heap_poisoning.c line 229
0x40096e77: multi_heap_malloc at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/heap/multi_heap_poisoning.c line 225
0x4008356c: heap_caps_malloc at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/heap/heap_caps.c line 145
0x400835a9: heap_caps_malloc_default at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/heap/heap_caps.c line 177
0x400971d3: _calloc_r at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/newlib/heap.c line 72
0x400971f4: calloc at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/newlib/heap.c line 36
0x401192e1: list_append at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/common/osi/list.c line 156
0x40118ad9: fixed_queue_enqueue at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/common/osi/fixed_queue.c line 142
0x4011989d: osi_thread_post at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/common/osi/thread.c line 246
0x400eedf1: transmit_downward at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/hci/hci_layer.c line 298
0x400efe86: bte_main_hci_send at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/main/bte_main.c line 242
0x4010d531: l2c_link_send_to_lower at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/l2cap/l2c_link.c line 1249
0x4010e209: l2c_link_check_send_pkts at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/l2cap/l2c_link.c line 1196
0x40109ec8: L2CA_SendFixedChnlData at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/l2cap/l2c_api.c line 1847
0x40131ff9: attp_send_msg_to_l2cap at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/att_protocol.c line 347
0x40132154: attp_cl_send_cmd at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/att_protocol.c line 497
0x40132326: attp_send_cl_msg at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/att_protocol.c line 618
0x40101332: gatt_act_discovery at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/gatt_cl.c line 110
0x401006a6: GATTC_Discover at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/gatt_api.c line 896
0x4011c82f: bta_gattc_discover_procedure at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 497
0x4011ccd1: bta_gattc_explore_srvc at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 601
0x4011cd89: bta_gattc_char_dscpt_disc_cmpl at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 714
0x4011cda7: bta_gattc_start_disc_char_dscp at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 542
0x4011cd6d: bta_gattc_char_dscpt_disc_cmpl at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 706
0x4011cda7: bta_gattc_start_disc_char_dscp at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 542
0x4011cd6d: bta_gattc_char_dscpt_disc_cmpl at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 706
0x4011cda7: bta_gattc_start_disc_char_dscp at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 542
0x4011cd6d: bta_gattc_char_dscpt_disc_cmpl at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 706
0x4011cda7: bta_gattc_start_disc_char_dscp at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 542
0x4011cd6d: bta_gattc_char_dscpt_disc_cmpl at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 706
0x4011cda7: bta_gattc_start_disc_char_dscp at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 542
0x4011cd6d: bta_gattc_char_dscpt_disc_cmpl at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 706
0x4011cf53: bta_gattc_disc_cmpl_cback at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/bta/gatt/bta_gattc_cache.c line 1067
0x4010664d: gatt_end_operation at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/gatt_utils.c line 2301
0x40101355: gatt_act_discovery at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/gatt_cl.c line 116
0x40101836: gatt_process_read_info_rsp at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/gatt_cl.c line 484
0x401021d5: gatt_client_handle_server_rsp at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/gatt_cl.c line 1125
0x401037a3: gatt_data_process at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/gatt_main.c line 1004
0x401037e2: gatt_le_data_ind at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/gatt/gatt_main.c line 587
0x401109a9: l2c_rcv_acl_data at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/l2cap/l2c_main.c line 275
0x400ff1a2: btu_hci_msg_process at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/host/bluedroid/stack/btu/btu_task.c line 144
0x401195e3: osi_thread_run at /home/runner/work/esp32-arduino-lib-builder/esp32-arduino-lib-builder/esp-idf/components/bt/common/osi/thread.c line 67

Other Steps to Reproduce

The code works fine on 1.0.x versions of library. I've seen other people having the same issue with 2.0.x lib and this hear rate monitor.

I have checked existing issues, online documentation and the Troubleshooting Guide

• I confirm I have checked existing issues, online documentation and Troubleshooting guide.

[jacobq]

Might it be possible to add an option to specify the stack size for the Bluetooth task (CONFIG_BTU_TASK_STACK_SIZE) from Arduino similar to what was done for ARDUINO_LOOP_STACK_SIZE in #5173?

I am running into this with a simple "remote shutter" (HID) device, and it doesn't look like a typical memory leak on my side. Sometimes it happens immediately when the device connects, other times it connects, runs, and even disconnects/reconnects many times before happening.

[VojtechBartoska]

Hello, can you please retest this on v2.0.3-rc1?

[FIXMBR]

Unfortunately, I won't be able to test it for a week or so. I will report back once I get to test it.

[FIXMBR]

Just tested it on the new version and I get the same error.
I made a merge request that fixes this issue by increasing the CONFIG_BT_BTU_TASK_STACK_SIZE to 8k.
espressif/esp32-arduino-lib-builder#54
Making it user configurable might a better solution though.

[VojtechBartoska]

Thanks for the PR @FIXMBR! We will review it as soon as possible.