| Message ID | 20220701094102.25917-1-wangyouwan@uniontech.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | obexd: fix crashed after cancel the on-going transfer | expand |
| Context | Check | Description |
|---|---|---|
| tedd_an/pre-ci_am | success | Success |
| tedd_an/checkpatch | success | Checkpatch PASS |
| tedd_an/gitlint | success | Gitlint PASS |
| tedd_an/setupell | success | Setup ELL PASS |
| tedd_an/buildprep | success | Build Prep PASS |
| tedd_an/build | success | Build Configuration PASS |
| tedd_an/makecheck | success | Make Check PASS |
| tedd_an/makecheckvalgrind | success | Make Check PASS |
| tedd_an/makedistcheck | success | Make Distcheck PASS |
| tedd_an/build_extell | success | Build External ELL PASS |
| tedd_an/build_extell_make | success | Build Make with External ELL PASS |
| tedd_an/scan_build | warning | Scan-Build: gobex/gobex-transfer.c:421:7: warning: Use of memory after it is freed if (!g_slist_find(transfers, transfer)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. |
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=655762
---Test result---
Test Summary:
CheckPatch PASS 1.71 seconds
GitLint PASS 1.01 seconds
Prep - Setup ELL PASS 32.21 seconds
Build - Prep PASS 0.90 seconds
Build - Configure PASS 10.07 seconds
Build - Make PASS 952.54 seconds
Make Check PASS 12.37 seconds
Make Check w/Valgrind PASS 331.34 seconds
Make Distcheck PASS 274.42 seconds
Build w/ext ELL - Configure PASS 10.30 seconds
Build w/ext ELL - Make PASS 94.52 seconds
Incremental Build w/ patches PASS 0.00 seconds
Scan Build WARNING 564.04 seconds
Details
##############################
Test: Scan Build - WARNING
Desc: Run Scan Build with patches
Output:
*****************************************************************************
The bugs reported by the scan-build may or may not be caused by your patches.
Please check the list and fix the bugs if they are caused by your patch.
*****************************************************************************
gobex/gobex-transfer.c:421:7: warning: Use of memory after it is freed
if (!g_slist_find(transfers, transfer))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
---
Regards,
Linux Bluetooth
diff --git a/gobex/gobex-transfer.c b/gobex/gobex-transfer.c index c94d018b2..2b6b0321d 100644 --- a/gobex/gobex-transfer.c +++ b/gobex/gobex-transfer.c @@ -83,15 +83,20 @@ static struct transfer *find_transfer(guint id) static void transfer_complete(struct transfer *transfer, GError *err) { - guint id = transfer->id; + guint id; - g_obex_debug(G_OBEX_DEBUG_TRANSFER, "transfer %u", id); + if (!g_slist_find(transfers, transfer)) + return; + + transfer->req_id = 0; + g_obex_debug(G_OBEX_DEBUG_TRANSFER, "transfer %u", transfer->id); if (err) { /* No further tx must be performed */ g_obex_drop_tx_queue(transfer->obex); } + id = transfer->id; transfer->complete_func(transfer->obex, err, transfer->user_data); /* Check if the complete_func removed the transfer */ if (find_transfer(id) == NULL) @@ -107,8 +112,6 @@ static void transfer_abort_response(GObex *obex, GError *err, GObexPacket *rsp, g_obex_debug(G_OBEX_DEBUG_TRANSFER, "transfer %u", transfer->id); - transfer->req_id = 0; - /* Intentionally override error */ err = g_error_new(G_OBEX_ERROR, G_OBEX_ERROR_CANCELLED, "Operation was aborted"); @@ -184,12 +187,6 @@ static void transfer_response(GObex *obex, GError *err, GObexPacket *rsp, struct transfer *transfer = user_data; GObexPacket *req; gboolean rspcode, final; - guint id; - - g_obex_debug(G_OBEX_DEBUG_TRANSFER, "transfer %u", transfer->id); - - id = transfer->req_id; - transfer->req_id = 0; if (err != NULL) { transfer_complete(transfer, err); @@ -203,6 +200,9 @@ static void transfer_response(GObex *obex, GError *err, GObexPacket *rsp, goto failed; } + if (!g_slist_find(transfers, transfer)) + return; + if (transfer->opcode == G_OBEX_OP_GET) { handle_get_body(transfer, rsp, &err); if (err != NULL) @@ -222,8 +222,6 @@ static void transfer_response(GObex *obex, GError *err, GObexPacket *rsp, req = g_obex_packet_new(transfer->opcode, TRUE, G_OBEX_HDR_INVALID); } else { - /* Keep id since request still outstanting */ - transfer->req_id = id; return; }
There is a use after released.transfer->req_id different obex->pending_req->id,See the following log, The packages is removd in cancel_complete func are not the same package in req_timeout func, but transfer pointer is released. log: g_obex_cancel_req() transfer->req_id 23 id 22 obex->pending_req(0x55b642c3e100) g_obex_cancel_req() match->data (0x55b642c344a0) g_obex_ref() ref 4 cancel_complete() pending req timeout 176 id 22 obex(0x55b642c3e100) transfer_response() obex 0x55b642c36480 transfer(0x55b642c3d000) g_obex_drop_tx_queue() g_obex_unref() obex 0x55b642c36480 g_obex_unref() ref 3 transfer_free() obex 0x55b642c36480 transfer 0x55b642c3d000 g_obex_unref() obex 0x55b642c36480 g_obex_unref() ref 2 pending_pkt_free() timeout_id 0 pending_pkt (0x55b642c344a0) step: [obex]# connect 28:33:34:1E:96:98 Attempting to connect to 28:33:34:1E:96:98 [NEW] Session /org/bluez/obex/client/session2 [default] [NEW] ObjectPush /org/bluez/obex/client/session2 Connection successful [28:33:34:1E:96:98]# send /home/uos/Desktop/systemd.zip Attempting to send /home/uos/Desktop/systemd.zip [NEW] Transfer /org/bluez/obex/client/session2/transfer2 Transfer /org/bluez/obex/client/session2/transfer2 Status: queued Name: systemd.zip Size: 33466053 Filename: /home/uos/Desktop/systemd.zip Session: /org/bluez/obex/client/session2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 er2 33:34:1E:96:98]# cancel /org/bluez/obex/client/sessi Attempting to cancel transfer /org/bluez/obex/client/s Cancel successful valgrind trace: ==11431== Invalid read of size 4 ==11431== at 0x12B442: transfer_response () ==11431== by 0x127764: req_timeout () ==11431== by 0x49B8922: ??? ( ) ==11431== by 0x49B7E97: g_main_context_dispatch () ==11431== by 0x49B8287: ??? (in ) ==11431== by 0x49B8581: g_main_loop_run () ==11431== by 0x121834: main (main.c:322) ==11431== Address 0x7344fa0 is 16 bytes inside a block of size ==11431== at 0x48369AB: free () ==11431== by 0x12B459: transfer_response () ==11431== by 0x127B3D: cancel_complete () ==11431== by 0x49B7E97: g_main_context_dispatch () ==11431== by 0x49B8287: ??? () ==11431== by 0x49B8581: g_main_loop_run () ==11431== by 0x121834: main (main.c:322) ==11431== Block was alloc'd at ==11431== at 0x4837B65: calloc () ==11431== by 0x49BD9D8: g_malloc0 () ==11431== by 0x12AB89: transfer_new () ==11431== by 0x12B732: g_obex_put_req_pkt () ==11431== by 0x12B732: g_obex_put_req_pkt () ==11431== by 0x146982: transfer_start_put () ==11431== by 0x146982: obc_transfer_start () ==11431== by 0x13C5A7: session_process_transfer () ==11431== by 0x13D248: session_process_queue () ==11431== by 0x13D248: session_process_queue () ==11431== by 0x13D2AF: session_process () ==11431== by 0x49B7E97: g_main_context_dispatch () ==11431== by 0x49B8287: ??? (i) ==11431== by 0x49B8581: g_main_loop_run () ==11431== by 0x121834: main () ==11431== ==11431== (action on error) vgdb me ... --- gobex/gobex-transfer.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-)