[PATCH v1] gobex: Fix use-after-free when cancelling SRM PUT transfer

[Rahul Samana <rahul.samana@oss.qualcomm.com>]

In SRM mode put_get_data() queues the next packet during encoding of
the current one, so transfer->req_id and pending_req->id can diverge.
When g_obex_cancel_transfer() cancels the queued packet from tx_queue,
cancel_complete() frees the transfer while pending_req still holds a
callback pointing to it. Its G_OBEX_DEFAULT_TIMEOUT (10s) then fires
on freed memory causing a SIGSEGV.

Fix by clearing pending_req->rsp_func if it belongs to the same
transfer being cancelled.

Signed-off-by: Rahul Samana <rahul.samana@oss.qualcomm.com>
---
 gobex/gobex.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/gobex/gobex.c b/gobex/gobex.c
index df80d79f3..10a438391 100644
--- a/gobex/gobex.c
+++ b/gobex/gobex.c
@@ -861,6 +861,14 @@ gboolean g_obex_cancel_req(GObex *obex, guint req_id, gboolean remove_callback)
 
 	g_queue_delete_link(obex->tx_queue, match);
 
+	/* In SRM mode pending_req may belong to the same transfer but carry
+	 * a different req_id. Clear its callback to avoid use-after-free
+	 * when its timeout fires after transfer_free().
+	 */
+	if (remove_callback && obex->pending_req &&
+				obex->pending_req->rsp_data == p->rsp_data)
+		obex->pending_req->rsp_func = NULL;
+
 immediate_completion:
 	p->cancelled = TRUE;
 	p->obex = g_obex_ref(obex);
-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project