From: Bastien Nocera <hadess@hadess.net>
To: Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
linux-bluetooth@vger.kernel.org
Subject: Re: [PATCH BlueZ] control: Fix invalid access
Date: Fri, 24 Nov 2017 18:56:28 +0100 [thread overview]
Message-ID: <1511546188.11411.26.camel@hadess.net> (raw)
In-Reply-To: <20171123130145.10480-1-luiz.dentz@gmail.com>
On Thu, 2017-11-23 at 15:01 +0200, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> When both controller and target roles are supported by a device they
> would share the same btd_service user_data pointer which would lead
> to
> use after free once either service is removed.
After this patch, I'm getting this backtrace when removing remote
devices:
bluetoothd[8327]: profiles/audio/control.c:path_unregister() Unregistered interface org.bluez.MediaControl1 on path /org/bluez/hci0/dev_38_71_DE_C0_FC_26
bluetoothd[8327]: Assertion failed: (service->state == BTD_SERVICE_STATE_UNAVAILABLE) src/service.c:323 in btd_service_set_user_data
bluetoothd[8327]: ++++++++ backtrace ++++++++
bluetoothd[8327]: #1 btd_service_set_user_data+0x2c (src/service.c:324) [0x46a23c]
bluetoothd[8327]: #2 path_unregister+0x33 (profiles/audio/control.c:280) [0x41fd13]
bluetoothd[8327]: #3 remove_interface+0x53 (gdbus/object.c:668) [0x488b43]
bluetoothd[8327]: #4 g_dbus_unregister_interface+0x3a (gdbus/object.c:1391) [0x48904a]
bluetoothd[8327]: #5 service_remove+0x29 (src/service.c:177) [0x469ff9]
bluetoothd[8327]: #6 device_remove+0x6a (src/device.c:4043) [0x4758ca]
bluetoothd[8327]: #7 btd_adapter_remove_device+0x10d (src/adapter.c:1209) [0x461c4d]
bluetoothd[8327]: #8 remove_device+0x73 (src/adapter.c:3034) [0x462963]
bluetoothd[8327]: #9 process_message.isra.7+0x1b (gdbus/object.c:261) [0x4898cb]
bluetoothd[8327]: #10 _dbus_object_tree_dispatch_and_unlock+0x170 (/usr/lib64/libdbus-1.so.3.19.2) [0x7f206c84d3e0]
bluetoothd[8327]: #11 dbus_connection_dispatch+0x32a (/usr/lib64/libdbus-1.so.3.19.2) [0x7f206c83e20a]
bluetoothd[8327]: #12 message_dispatch+0x10 (gdbus/mainloop.c:72) [0x4865a0]
bluetoothd[8327]: #13 g_idle_dispatch+0x17 (/usr/lib64/libglib-2.0.so.0.5400.2) [0x7f206cabf597]
bluetoothd[8327]: #14 g_main_context_dispatch+0x157 (/usr/lib64/libglib-2.0.so.0.5400.2) [0x7f206cac2bb7]
bluetoothd[8327]: #15 g_main_context_iterate.isra.25+0x200 (/usr/lib64/libglib-2.0.so.0.5400.2) [0x7f206cac2f60]
bluetoothd[8327]: #16 g_main_loop_run+0xc2 (/usr/lib64/libglib-2.0.so.0.5400.2) [0x7f206cac3272]
bluetoothd[8327]: #17 main+0x839 (src/main.c:772) [0x40bd99]
bluetoothd[8327]: #18 __libc_start_main+0xe7 (../csu/libc-start.c:340) [0x7f206bd5c187]
bluetoothd[8327]: #19 _start+0x2a (/home/hadess/Projects/jhbuild/bluez/src/bluetoothd) [0x40c5ca]
bluetoothd[8327]: +++++++++++++++++++++++++++
This is with git master + an irrelevant patch to the autopair plugin
prev parent reply other threads:[~2017-11-24 17:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-23 13:01 [PATCH BlueZ] control: Fix invalid access Luiz Augusto von Dentz
2017-11-24 9:12 ` Luiz Augusto von Dentz
2017-11-24 17:56 ` Bastien Nocera [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1511546188.11411.26.camel@hadess.net \
--to=hadess@hadess.net \
--cc=linux-bluetooth@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).