net: lib: download_client: hard fault when cancelling download

[chmielewskiandreas]

As described in that PR I am getting a hard fault when trying to cancel a download.

https://github.com/nrfconnect/sdk-nrf/pull/6955

To reproduce this issue apply the following changes

diff --git a/samples/nrf9160/download/src/main.c b/samples/nrf9160/download/src/main.c
index 53bbdf39c..135d23ba8 100644
--- a/samples/nrf9160/download/src/main.c
+++ b/samples/nrf9160/download/src/main.c
@@ -165,6 +165,21 @@ static int callback(const struct download_client_evt *event)
        return 0;
 }
 
+void my_work_handler(struct k_work *work)
+{
+    printk("*********** cancelling\n");
+    download_client_disconnect(&downloader);
+}
+
+K_WORK_DEFINE(my_work, my_work_handler);
+
+void my_timer_handler(struct k_timer *dummy)
+{
+       k_work_submit(&my_work);
+}
+
+K_TIMER_DEFINE(my_timer, my_timer_handler, NULL);
+
 void main(void)
 {
        int err;
@@ -214,4 +229,6 @@ void main(void)
        }
 
        printk("Downloading %s\n", URL);
+
+       k_timer_start(&my_timer, K_SECONDS(5), K_NO_WAIT);
 }

[Håkon Alseth]

Hi,

 

As described in that PR I am getting a hard fault when trying to cancel a download.

When I try to add the specific code with workq for cancelling, I get a timeout on the TCP connection. Did I mis-configure the sample at my end?

Could you share your device log with the hard fault?

 

Kind regards,

Håkon

[chmielewskiandreas]

Hi, so for me the example works fine. Probably you have a general issue with executing that example on your board / sim card?

Originally I saw that issue when doing FOTA and tried to reproduce this with that sample. When trying to cancel FOTA I get this error

[00:00:14.871,887] <inf> ct: ********************* cancelling
[00:00:14.874,969] <inf> dfu_target_mcuboot: MCUBoot image upgrade aborted.
[00:00:14.875,000] <err> lwm2m_firmware: FOTA_DOWNLOAD_EVT_ERROR
[00:00:14.875,030] <inf> dfu_target_mcuboot: MCUBoot image upgrade aborted.
[00:00:18.663,085] <err> os: Exception occurred in Secure State
[00:00:18.663,116] <err> os: ***** HARD FAULT *****
[00:00:18.663,116] <err> os:   Fault escalation (see below)
[00:00:18.663,116] <err> os: ***** BUS FAULT *****
[00:00:18.663,146] <err> os:   Precise data bus error
[00:00:18.663,146] <err> os:   BFAR Address: 0x50008158
[00:00:18.663,146] <err> os: r0/a1:  0x00000000  r1/a2:  0x00000000  r2/a3:  0x00000074
[00:00:18.663,177] <err> os: r3/a4:  0x00000000 r12/ip:  0x00000000 r14/lr:  0x0004a8d7
[00:00:18.663,177] <err> os:  xpsr:  0x41050000
[00:00:18.663,177] <err> os: Faulting instruction address (r15/pc): 0x00055ce6
[00:00:18.663,238] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
[00:00:18.663,299] <err> os: Current thread: 0x20016400 (download_client)
[00:00:18.775,939] <err> fatal_error: Resetting system

While debugging I saw that the hard fault is caused exactly when socket is closed while recv is called (and is waiting for incoming data in blocking mode).

Unfortunately I do not get a hard fault with that sample but once I call disconnect, I see a reboot at some point.

[Håkon Alseth]

Hi,

 

Could you try to resolve the LR and PC addresses using arm-none-eabi-addr2line?

arm-none-eabi-addr2line -e my-build-folder\zephyr\zephyr.elf 0x4a8d7

arm-none-eabi-addr2line -e my-build-folder\zephyr\zephyr.elf 0x55ce6

 

From the fault info, the resolving above addresses should have been called from the download_client thread:

[00:00:18.663,299] <err> os: Current thread: 0x20016400 (download_client)

 

Kind regards,

Håkon