* [PATCH BlueZ 2/2] gobex: Revert g_obex_pending_req_abort to static pending_req_abort
2013-09-24 14:47 [PATCH BlueZ 1/2] gobex: Fix crash on g_obex_pending_req_abort Luiz Augusto von Dentz
@ 2013-09-24 14:47 ` Luiz Augusto von Dentz
2013-09-29 14:15 ` [PATCH BlueZ 1/2] gobex: Fix crash on g_obex_pending_req_abort Luiz Augusto von Dentz
1 sibling, 0 replies; 3+ messages in thread
From: Luiz Augusto von Dentz @ 2013-09-24 14:47 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Jaganath Kanakkassery
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This reverts the changes introduced in
9095deb82572112fc0870095bf2222964610eafe that made pending_req_abort
public which is not necessary considering g_obex_cancel_req can do the
same and is safe to call even if the request is not pending.
---
gobex/gobex.c | 4 ++--
gobex/gobex.h | 2 --
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/gobex/gobex.c b/gobex/gobex.c
index deeab40..8c08b1e 100644
--- a/gobex/gobex.c
+++ b/gobex/gobex.c
@@ -685,7 +685,7 @@ static int pending_pkt_cmp(gconstpointer a, gconstpointer b)
return (p->id - id);
}
-gboolean g_obex_pending_req_abort(GObex *obex, GError **err)
+static gboolean pending_req_abort(GObex *obex, GError **err)
{
struct pending_pkt *p = obex->pending_req;
GObexPacket *req;
@@ -729,7 +729,7 @@ gboolean g_obex_cancel_req(GObex *obex, guint req_id, gboolean remove_callback)
struct pending_pkt *p;
if (obex->pending_req && obex->pending_req->id == req_id) {
- if (!g_obex_pending_req_abort(obex, NULL)) {
+ if (!pending_req_abort(obex, NULL)) {
p = obex->pending_req;
obex->pending_req = NULL;
goto immediate_completion;
diff --git a/gobex/gobex.h b/gobex/gobex.h
index 3ac7b13..76a224e 100644
--- a/gobex/gobex.h
+++ b/gobex/gobex.h
@@ -50,8 +50,6 @@ guint g_obex_send_req(GObex *obex, GObexPacket *req, int timeout,
gboolean g_obex_cancel_req(GObex *obex, guint req_id,
gboolean remove_callback);
-gboolean g_obex_pending_req_abort(GObex *obex, GError **err);
-
gboolean g_obex_send_rsp(GObex *obex, guint8 rspcode, GError **err,
guint8 first_hdr_type, ...);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH BlueZ 1/2] gobex: Fix crash on g_obex_pending_req_abort
2013-09-24 14:47 [PATCH BlueZ 1/2] gobex: Fix crash on g_obex_pending_req_abort Luiz Augusto von Dentz
2013-09-24 14:47 ` [PATCH BlueZ 2/2] gobex: Revert g_obex_pending_req_abort to static pending_req_abort Luiz Augusto von Dentz
@ 2013-09-29 14:15 ` Luiz Augusto von Dentz
1 sibling, 0 replies; 3+ messages in thread
From: Luiz Augusto von Dentz @ 2013-09-29 14:15 UTC (permalink / raw)
To: linux-bluetooth@vger.kernel.org; +Cc: Jaganath Kanakkassery
Hi,
On Tue, Sep 24, 2013 at 5:47 PM, Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> It is not safe to call g_obex_pending_req_abort directly as pending_req
> can be NULL:
> Invalid read of size 4
> at 0x41231E: g_obex_pending_req_abort (gobex.c:693)
> by 0x416A8A: g_obex_cancel_transfer (gobex-transfer.c:647)
> by 0x42DEF2: obc_transfer_cancel (transfer.c:180)
> by 0x43D833: process_message.isra.5 (object.c:259)
> by 0x3B0701CE85: ??? (in /usr/lib64/libdbus-1.so.3.7.4)
> by 0x3B0700FA30: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.7.4)
> by 0x43A5B7: message_dispatch (mainloop.c:76)
> by 0x3B03C48962: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
> by 0x3B03C47E05: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3600.3)
> by 0x3B03C48157: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
> by 0x3B03C48559: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3600.3)
> by 0x40D53C: main (main.c:319)
> Address 0x30 is not stack'd, malloc'd or (recently) free'd
> ---
> gobex/gobex-transfer.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/gobex/gobex-transfer.c b/gobex/gobex-transfer.c
> index 4203fec..b815d60 100644
> --- a/gobex/gobex-transfer.c
> +++ b/gobex/gobex-transfer.c
> @@ -644,7 +644,10 @@ gboolean g_obex_cancel_transfer(guint id, GObexFunc complete_func,
> transfer->complete_func = complete_func;
> transfer->user_data = user_data;
>
> - ret = g_obex_pending_req_abort(transfer->obex, NULL);
> + if (transfer->req_id == 0)
> + goto done;
> +
> + ret = g_obex_cancel_req(transfer->obex, transfer->req_id, FALSE);
> if (ret)
> return TRUE;
>
> --
> 1.8.3.1
I went ahead an pushed this set upstream.
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 3+ messages in thread