Fingerprint service keeps crashing

[fish47]

Sorry for posting this issue here. It might be in the android_device_xiaomi_sdm660-common. I have done some research before posting and hope that helps.

ROM

lineage-22.2-20250510-UNOFFICIAL-clover.zip

Problem

--------- beginning of crash
06-03 19:16:13.212  1502  1502 F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x80 in tid 1502 (android.hardwar), pid 1502 (android.hardwar)
06-03 19:16:13.288  1573  1573 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-03 19:16:13.288  1573  1573 F DEBUG   : LineageOS Version: 'unknown'
06-03 19:16:13.288  1573  1573 F DEBUG   : Build fingerprint: 'Xiaomi/clover/clover:8.1.0/OPM1.171019.019/V9.6.4.0.ODJCNFD:user/release-keys'
06-03 19:16:13.288  1573  1573 F DEBUG   : Revision: '0'
06-03 19:16:13.288  1573  1573 F DEBUG   : ABI: 'arm64'
06-03 19:16:13.288  1573  1573 F DEBUG   : Timestamp: 2025-06-03 19:16:13.262793944+0800
06-03 19:16:13.288  1573  1573 F DEBUG   : Process uptime: 1s
06-03 19:16:13.288  1573  1573 F DEBUG   : Cmdline: /vendor/bin/hw/android.hardware.biometrics.fingerprint-service.xiaomi_sdm660
06-03 19:16:13.288  1573  1573 F DEBUG   : pid: 1502, tid: 1502, name: android.hardwar  >>> /vendor/bin/hw/android.hardware.biometrics.fingerprint-service.xiaomi_sdm660 <<<
06-03 19:16:13.288  1573  1573 F DEBUG   : uid: 1000
06-03 19:16:13.288  1573  1573 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000080
06-03 19:16:13.288  1573  1573 F DEBUG   : Cause: null pointer dereference
06-03 19:16:13.288  1573  1573 F DEBUG   :     x0  0000000000000001  x1  0000007fd5a79a40  x2  0000000000000005  x3  0fffffffffffffff
06-03 19:16:13.288  1573  1573 F DEBUG   :     x4  0000000000000000  x5  0000000000000000  x6  1f2b72636e677364  x7  7f7f7f7f7f7f7f7f
06-03 19:16:13.288  1573  1573 F DEBUG   :     x8  36d34913145cd3b5  x9  36d34913145cd3b5  x10 0000000000000000  x11 000000003b9ac9ff
06-03 19:16:13.288  1573  1573 F DEBUG   :     x12 0000000000000018  x13 00000000112179ea  x14 000c939bb114e85f  x15 000000000000192c
06-03 19:16:13.288  1573  1573 F DEBUG   :     x16 0000007ecd6af500  x17 0000007ecb9c0900  x18 0000007ed1508000  x19 0000007c77c1ab90
06-03 19:16:13.288  1573  1573 F DEBUG   :     x20 0000000000000000  x21 0000007ed0ca2f80  x22 0000007d87c0dc08  x23 0000007fd5a7a240
06-03 19:16:13.289  1573  1573 F DEBUG   :     x24 0000007ed0ca2f80  x25 0000000000000000  x26 0000000000000000  x27 0000000000000000
06-03 19:16:13.289  1573  1573 F DEBUG   :     x28 0000000000000000  x29 0000007fd5a7a0d0
06-03 19:16:13.289  1573  1573 F DEBUG   :     lr  00000057f49b2970  sp  0000007fd5a7a090  pc  00000057f49b29a4  pst 0000000060000000
06-03 19:16:13.289  1573  1573 F DEBUG   : 3 total frames
06-03 19:16:13.289  1573  1573 F DEBUG   : backtrace:
06-03 19:16:13.289  1573  1573 F DEBUG   :       #00 pc 00000000000099a4  /vendor/bin/hw/android.hardware.biometrics.fingerprint-service.xiaomi_sdm660 (aidl::android::hardware::biometrics::fingerprint::Fingerprint::Fingerprint(std::__1::shared_ptr<aidl::android::hardware::biometrics::fingerprint::FingerprintConfig>)+260) (BuildId: 9bb97cb1c205997dcbfbda2b62966321)
06-03 19:16:13.289  1573  1573 F DEBUG   :       #01 pc 00000000000170ec  /vendor/bin/hw/android.hardware.biometrics.fingerprint-service.xiaomi_sdm660 (main+164) (BuildId: 9bb97cb1c205997dcbfbda2b62966321)
06-03 19:16:13.289  1573  1573 F DEBUG   :       #02 pc 0000000000055248  /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+116) (BuildId: 95e892805867a9df9d038d9e274fce41)

Suspected Cause

// fingerprint/aidl/Fingerprint.cpp

// the crash is in the constructor
Fingerprint::Fingerprint(std::shared_ptr<FingerprintConfig> config)
    : mConfig(std::move(config)), mDevice(openHal()) {
    ...
}

fingerprint_device_t* Fingerprint::openHal() {
    int err;
    fingerprint_device_t* fp_device = getDeviceForVendor("fpc");
    if (0 != (err = fp_device->set_notify(fp_device, Fingerprint::notify))) {
        ALOGE("Can't register fingerprint module callback, error: %d", err);
        fp_device = nullptr;
    }

    // I found this property was still unset, so a crash may happen before here
    if (fp_device != nullptr) {
        property_set("persist.vendor.sys.fp.vendor", "fpc");
    } else {
        property_set("persist.vendor.sys.fp.vendor", "none");
    }
    return fp_device;
}