ap: remove diagnostic interface when netdev goes down

Commit Message

James Prestwood July 1, 2022, 4:31 p.m. UTC

This fixes a crash associated with toggling the iftype to AP mode
then calling GetDiagnostics. The diagnostic interface is never
cleaned up when netdev goes down so DBus calls can still be made
which ends up crashing since the AP interface objects are no longer
valid.

Running the following iwctl commands in a script (once or twice)
triggers this crash reliably:

iwctl device wlp2s0 set-property Mode ap
iwctl device wlp2s0 set-property Mode station
iwctl device wlp2s0 set-property Mode ap
iwctl ap wlp2s0 start myssid secret123
iwctl ap wlp2s0 show

++++++++ backtrace ++++++++
0  0x7f8f1a8fe320 in /lib64/libc.so.6
1  0x451f35 in ap_dbus_get_diagnostics() at src/ap.c:4043
2  0x4cdf5a in _dbus_object_tree_dispatch() at ell/dbus-service.c:1815
3  0x4bffc7 in message_read_handler() at ell/dbus.c:285
4  0x4b5d7b in io_callback() at ell/io.c:120
5  0x4b489b in l_main_iterate() at ell/main.c:476
6  0x4b49a6 in l_main_run() at ell/main.c:519
7  0x4b4cd9 in l_main_run_with_signal() at ell/main.c:645
8  0x404f5b in main() at src/main.c:600
9  0x7f8f1a8e8b75 in /lib64/libc.so.6
+++++++++++++++++++++++++++
---
 src/ap.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Denis Kenzior July 1, 2022, 5 p.m. UTC | #1

Hi James,

On 7/1/22 11:31, James Prestwood wrote:
> This fixes a crash associated with toggling the iftype to AP mode
> then calling GetDiagnostics. The diagnostic interface is never
> cleaned up when netdev goes down so DBus calls can still be made
> which ends up crashing since the AP interface objects are no longer
> valid.
> 
> Running the following iwctl commands in a script (once or twice)
> triggers this crash reliably:
> 
> iwctl device wlp2s0 set-property Mode ap
> iwctl device wlp2s0 set-property Mode station
> iwctl device wlp2s0 set-property Mode ap
> iwctl ap wlp2s0 start myssid secret123
> iwctl ap wlp2s0 show
> 
> ++++++++ backtrace ++++++++
> 0  0x7f8f1a8fe320 in /lib64/libc.so.6
> 1  0x451f35 in ap_dbus_get_diagnostics() at src/ap.c:4043
> 2  0x4cdf5a in _dbus_object_tree_dispatch() at ell/dbus-service.c:1815
> 3  0x4bffc7 in message_read_handler() at ell/dbus.c:285
> 4  0x4b5d7b in io_callback() at ell/io.c:120
> 5  0x4b489b in l_main_iterate() at ell/main.c:476
> 6  0x4b49a6 in l_main_run() at ell/main.c:519
> 7  0x4b4cd9 in l_main_run_with_signal() at ell/main.c:645
> 8  0x404f5b in main() at src/main.c:600
> 9  0x7f8f1a8e8b75 in /lib64/libc.so.6
> +++++++++++++++++++++++++++
> ---
>   src/ap.c | 2 ++
>   1 file changed, 2 insertions(+)
> 

Applied, thanks.

Regards,
-Denis

Patch

diff --git a/src/ap.c b/src/ap.c
index 7b705c9c..8681189b 100644
--- a/src/ap.c
+++ b/src/ap.c
@@ -4084,6 +4084,8 @@  static void ap_remove_interface(struct netdev *netdev)
 {
 	l_dbus_object_remove_interface(dbus_get_bus(),
 			netdev_get_path(netdev), IWD_AP_INTERFACE);
+	l_dbus_object_remove_interface(dbus_get_bus(),
+			netdev_get_path(netdev), IWD_AP_DIAGNOSTIC_INTERFACE);
 }
 
 static void ap_netdev_watch(struct netdev *netdev,