Gnssd crash

Gdd

Guys i got this crash... On main user. Latest gos version. Px9 pro xl

What can it be?

type: crash
osVersion: google/komodo/komodo:16/BP2A.250705.008/2025070800:user/release-keys
uid: 1021 (u:r:gnssd:s0)
cmdline: /vendor/bin/hw/gnssd
processUptime: 0s

signal: 11 (SIGSEGV), code 1 (SEGV_MAPERR), faultAddr 30
cause: null pointer dereference
threadName: lal_state_threa
MTE: enabled

backtrace:
/vendor/bin/hw/gnssd (lal_metrics_start_timing+24, pc d24bc)
/vendor/bin/hw/gnssd (process_pending_timers+24, pc d7ed0)
/vendor/bin/hw/gnssd (lal_router_process_pending+2756, pc d1e84)
/vendor/bin/hw/gnssd (lal_state_thread+1720, pc d3338)
/apex/com.android.runtime/lib64/bionic/libc.so (pthread_start(void*)+180, pc 8e254)
/apex/com.android.runtime/lib64/bionic/libc.so (start_thread+68, pc 7f9f4)

Gdd

I have more logs:

type: logcat
osVersion: google/komodo/komodo:16/BP2A.250705.008/2025070800:user/release-keys
buffers: crash
level: verbose

--------- beginning of crash
07-14 21:59:10.191 gps 1053 1758 F libc : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x30 in tid 1758 (lal_state_threa), pid 1053 (gnssd)
07-14 21:59:10.240 gps 1765 1765 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
07-14 21:59:10.240 gps 1765 1765 F DEBUG : Build fingerprint: 'google/komodo/komodo:16/BP2A.250705.008/2025070800:user/release-keys'
07-14 21:59:10.240 gps 1765 1765 F DEBUG : Revision: 'MP1.0'
07-14 21:59:10.240 gps 1765 1765 F DEBUG : ABI: 'arm64'
07-14 21:59:10.240 gps 1765 1765 F DEBUG : Timestamp: 2025-07-14 18:59:10.215212894-0300
07-14 21:59:10.240 gps 1765 1765 F DEBUG : Process uptime: 0s
07-14 21:59:10.240 gps 1765 1765 F DEBUG : Cmdline: /vendor/bin/hw/gnssd
07-14 21:59:10.240 gps 1765 1765 F DEBUG : pid: 1053, tid: 1758, name: lal_state_threa >>> /vendor/bin/hw/gnssd <<<
07-14 21:59:10.240 gps 1765 1765 F DEBUG : uid: 1021
07-14 21:59:10.240 gps 1765 1765 F DEBUG : tagged_addr_ctrl: 000000000007fff7 (PR_TAGGED_ADDR_ENABLE, PR_MTE_TCF_SYNC, PR_MTE_TCF_ASYNC, mask 0xfffe)
07-14 21:59:10.240 gps 1765 1765 F DEBUG : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
07-14 21:59:10.240 gps 1765 1765 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000030
07-14 21:59:10.240 gps 1765 1765 F DEBUG : Cause: null pointer dereference
07-14 21:59:10.240 gps 1765 1765 F DEBUG : x0 000000000086cebb x1 0000d33f10f95b48 x2 0000000000000018 x3 00000000211ac810
07-14 21:59:10.240 gps 1765 1765 F DEBUG : x4 00ffffffffffffff x5 0000000000001130 x6 0000000000000000 x7 0000000000000000
07-14 21:59:10.240 gps 1765 1765 F DEBUG : x8 c2fdac705bc91b00 x9 c2fdac705bc91b00 x10 00000000000f4240 x11 0000000000000000
07-14 21:59:10.240 gps 1765 1765 F DEBUG : x12 0000000000000008 x13 000000007fffffff x14 0000000000001130 x15 00000000211c0ea0
07-14 21:59:10.240 gps 1765 1765 F DEBUG : x16 00318d5387c10000 x17 0000000028b0aaab x18 0000d33f0fd70000 x19 0000000000000000
07-14 21:59:10.240 gps 1765 1765 F DEBUG : x20 0000c1117e1cf000 x21 0000c1117e1cf000 x22 0000c1117e1cf000 x23 0200d3836f306e40
07-14 21:59:10.240 gps 1765 1765 F DEBUG : x24 0000c1117e1cf6c0 x25 0000000000000001 x26 0000c1117e1cf688 x27 0f00d3836f306880
07-14 21:59:10.240 gps 1765 1765 F DEBUG : x28 0000c1117e1cf000 x29 0000000000000001
07-14 21:59:10.240 gps 1765 1765 F DEBUG : lr 0000c1117dede4bc sp 0000d33f10f95b70 pc 0000c1117dede4bc pst 0000000060001000
07-14 21:59:10.240 gps 1765 1765 F DEBUG : 6 total frames
07-14 21:59:10.240 gps 1765 1765 F DEBUG : backtrace:
07-14 21:59:10.240 gps 1765 1765 F DEBUG : #00 pc 00000000000d24bc /vendor/bin/hw/gnssd (lal_metrics_start_timing+24) (BuildId: 45be70f6ee9f724b8886efe9359a5b81e7164aea)
07-14 21:59:10.240 gps 1765 1765 F DEBUG : #01 pc 00000000000d7ed0 /vendor/bin/hw/gnssd (process_pending_timers+24) (BuildId: 45be70f6ee9f724b8886efe9359a5b81e7164aea)
07-14 21:59:10.240 gps 1765 1765 F DEBUG : #02 pc 00000000000d1e84 /vendor/bin/hw/gnssd (lal_router_process_pending+2756) (BuildId: 45be70f6ee9f724b8886efe9359a5b81e7164aea)
07-14 21:59:10.240 gps 1765 1765 F DEBUG : #03 pc 00000000000d3338 /vendor/bin/hw/gnssd (lal_state_thread+1720) (BuildId: 45be70f6ee9f724b8886efe9359a5b81e7164aea)
07-14 21:59:10.240 gps 1765 1765 F DEBUG : #04 pc 000000000008e254 /apex/com.android.runtime/lib64/bionic/libc.so (pthread_start(void*)+180) (BuildId: e688446b48f00a577c82f6e36cac2c6e)
07-14 21:59:10.240 gps 1765 1765 F DEBUG : #05 pc 000000000007f9f4 /apex/com.android.runtime/lib64/bionic/libc.so (start_thread+68) (BuildId: e688446b48f00a577c82f6e36cac2c6e)

Gdd

Do you guys need a system log? Its a big onde but i van provide... Just tell me

Gdd

Looks like a code bug that could lead to a very sophisticated RCE attack what you guys think?

Byteang3l

Gdd graphenes protections and the fact that hardened malloc and or MTE tripped would very likely mitigate any GNSS RCE but I agree the odds of this being exploitable aren't 0 either. Is this the first time this has happened or is it persistent?

CGG

Byteang3l im sorry, i have lost this past account pass And have used the gdd ACC instead. So it was me that reported the crash... Well it was the first time happening and happened on the very start of the process. Also the memory location indicate that this is more a code fault then an attack... The question is that proccess is a system processo with low uid so there is a chance to be a potential exploit opportunity (some privilege escalation or others). It happened just for the first time, i will wait to get more information if it happens again. I appreciate your recommendations and your analisys.
Thank you

Byteang3l

CGG no worries, I honestly wouldn't have noticed tbh lol. And you're welcome, nothing here indicates an attack has happened already, in short MTE did exactly what it was designed to do and put a stop to it misbehaving before it became a problem. If it happens again I would say it's worth investigating but there's been a few one off bugs throughout the forums here including one I encountered and if they don't repeat they're very likely nothing to worry about.

CGG

I agree with you. Lets always be vigilant and try to help this project at maximum effort. Best regards

Byteang3l

CGG agreed.