Re: [PATCH v1] dbus: Fix add invalid memory during interface removal

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Luiz

On 3/27/2025 10:58 PM, Luiz Augusto von Dentz wrote:
> Hi Shuai,
> 
> On Thu, Mar 27, 2025 at 4:41 AM Shuai Zhang <quic_shuaz@xxxxxxxxxxx> wrote:
>>
>> test setp
>> register_service <uuid>
>> register_application <uuid>
>> unregister_service <uuid>
>> unregister_application
>> register_service <uuid>
>> register_application <uuid>
>> core dump
> 
> Ok, what exactly are you talking about above, you are not referring to
> D-Bus api it seems, are these bluetoothctl commands?
> 

Yes,this is bluetoothctl command. I will add explanation in new patch.

>> invalidate_parent_data is called to add the service to the application's
>> glist when unregister_service. However, this service has already been
>> added to the glist of root object in register_service. This results in
>> services existing in both queues,but only the services in the
>> application's glist are freed upon removal. A null address is stored
>> in root object's glist, a crash dump will occur when get_object is called.
>>
>> Add a check for the parent pointer to avoid adding the service again.
>>
>> 0  0x0000007ff7df6058 in dbus_message_iter_append_basic ()
>>    from /usr/lib/libdbus-1.so.3
>> 1  0x00000055555a3780 in append_object (data=0x31306666,
>>   user_data=0x7ffffff760) at /usr/src/debug/bluez5/5.72/gdbus/object.c:1117
>> 2  0x0000007ff7ece0cc in g_slist_foreach () from /usr/lib/libglib-2.0.so.0
>> 3  0x00000055555a37ac in append_object (data=0x5555642cf0,
>>   user_data=0x7ffffff760) at /usr/src/debug/bluez5/5.72/gdbus/object.c:1122
>> 4  0x0000007ff7ece0cc in g_slist_foreach () from /usr/lib/libglib-2.0.so.0
>> 5  0x00000055555a3630 in get_objects (connection=<optimized out>,
>>     message=<optimized out>, user_data=0x555563b390)
>>     at /usr/src/debug/bluez5/5.72/gdbus/object.c:1154
>> 6  0x00000055555a51d0 in process_message (
>>     connection=connection@entry=0x5555639310,
>>     message=message@entry=0x5555649ac0,
>>     method=method@entry=0x55555facf8 <manager_methods>,
>>     iface_user_data=<optimized out>)
>>     at /usr/src/debug/bluez5/5.72/gdbus/object.c:246
>> 7  0x00000055555a575c in generic_message (connection=0x5555639310,
>>     message=0x5555649ac0, user_data=<optimized out>)
>>
>> Signed-off-by: Shuai Zhang <quic_shuaz@xxxxxxxxxxx>
>> ---
>>  gdbus/object.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/gdbus/object.c b/gdbus/object.c
>> index 7b0476f1a..d87a81160 100644
>> --- a/gdbus/object.c
>> +++ b/gdbus/object.c
>> @@ -809,7 +809,8 @@ static struct generic_data *invalidate_parent_data(DBusConnection *conn,
>>
>>         if (child == NULL || g_slist_find(data->objects, child) != NULL)
>>                 goto done;
>> -
>> +       if(g_slist_find(parent->objects, child) != NULL)
>> +               goto done;
> 
> Use empty lines after if statements, and keep the one you are removing.
> 

I will modify it, thanks.

> 
>>         data->objects = g_slist_prepend(data->objects, child);
>>         child->parent = data;
>>
>> --
>> 2.34.1
>>
>>
> 
> 





[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux