[PATCH] hfpmodem: Fix segfault in CIEV GAtChat callback

[PATCH] hfpmodem: Fix segfault in CIEV GAtChat callback

[Claudio Takahasi]

[-- Attachment #1: Type: text/plain, Size: 1939 bytes --]

This patch fixes segmentation fault when the network registration
watch is called without being initialized. CIEV GAtChat callback can
be called before ofono_netreg_register().

==15101== Invalid read of size 8
==15101==    at 0x492B56: ofono_netreg_register (network.c:2073)
==15101==    by 0x47245E: hfp_netreg_probe (network-registration.c:311)
==15101==    by 0x492A8D: ofono_netreg_create (network.c:1881)
==15101==    by 0x4849D5: hfp_pre_sim (hfp_hf_bluez5.c:288)
==15101==    by 0x48C486: ofono_modem_set_powered (modem.c:1194)
==15101==    by 0x484E9D: slc_established (hfp_hf_bluez5.c:85)
==15101==    by 0x4702AD: chld_cb (slc.c:147)
==15101==    by 0x440457: at_chat_finish_command (gatchat.c:461)
==15101==    by 0x44109F: new_bytes (gatchat.c:532)
==15101==    by 0x4433B7: received_data (gatio.c:122)
==15101==    by 0x3CBAA47824: g_main_context_dispatch (gmain.c:2539)
==15101==    by 0x3CBAA47B57: g_main_context_iterate.isra.23
(gmain.c:3146)
==15101==  Address 0x18 is not stack'd, malloc'd or (recently) free'd
---
 drivers/hfpmodem/network-registration.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hfpmodem/network-registration.c b/drivers/hfpmodem/network-registration.c
index 4b9f875..5a5e1f7 100644
--- a/drivers/hfpmodem/network-registration.c
+++ b/drivers/hfpmodem/network-registration.c
@@ -304,6 +304,9 @@ static gboolean hfp_netreg_register(gpointer user_data)
 
 	ofono_netreg_register(netreg);
 
+	g_at_chat_register(nd->chat, "+CIEV:", ciev_notify, FALSE,
+							netreg, NULL);
+
 	return FALSE;
 }
 
@@ -321,9 +324,6 @@ static int hfp_netreg_probe(struct ofono_netreg *netreg, unsigned int vendor,
 
 	ofono_netreg_set_data(netreg, nd);
 
-	g_at_chat_register(nd->chat, "+CIEV:", ciev_notify, FALSE,
-				netreg, NULL);
-
 	nd->register_source = g_idle_add(hfp_netreg_register, netreg);
 
 	return 0;
-- 
1.7.11.7

Re: [PATCH] hfpmodem: Fix segfault in CIEV GAtChat callback

[Denis Kenzior]

[-- Attachment #1: Type: text/plain, Size: 1328 bytes --]

Hi Claudio,

On 02/21/2013 04:24 PM, Claudio Takahasi wrote:
> This  patch fixes segmentation fault when the network registration
> watch is called without being initialized. CIEV GAtChat callback can
> be called before ofono_netreg_register().
>
> ==15101== Invalid read of size 8
> ==15101==    at 0x492B56: ofono_netreg_register (network.c:2073)
> ==15101==    by 0x47245E: hfp_netreg_probe (network-registration.c:311)
> ==15101==    by 0x492A8D: ofono_netreg_create (network.c:1881)
> ==15101==    by 0x4849D5: hfp_pre_sim (hfp_hf_bluez5.c:288)
> ==15101==    by 0x48C486: ofono_modem_set_powered (modem.c:1194)
> ==15101==    by 0x484E9D: slc_established (hfp_hf_bluez5.c:85)
> ==15101==    by 0x4702AD: chld_cb (slc.c:147)
> ==15101==    by 0x440457: at_chat_finish_command (gatchat.c:461)
> ==15101==    by 0x44109F: new_bytes (gatchat.c:532)
> ==15101==    by 0x4433B7: received_data (gatio.c:122)
> ==15101==    by 0x3CBAA47824: g_main_context_dispatch (gmain.c:2539)
> ==15101==    by 0x3CBAA47B57: g_main_context_iterate.isra.23
> (gmain.c:3146)
> ==15101==  Address 0x18 is not stack'd, malloc'd or (recently) free'd
> ---
>   drivers/hfpmodem/network-registration.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>

Patch has been applied, thanks.

Regards,
-Denis