Re: [PATCH 1/4] tc65: Replace tc65 plugin with cinterion plugin

[Alex J Lennon <ajlennon@dynamicdevices.co.uk>]

[-- Attachment #1: Type: text/plain, Size: 1111 bytes --]



On 13/05/2015 17:18, Philip Paeps wrote:
> On 2015-05-12 18:22:59 (+0100), Alex J Lennon <ajlennon@dynamicdevices.co.uk> wrote:
>> [...]
> Just paging through this driver this afternoon.  Sorry for not reviewing
> the earlier patches.  This caught my eye:
>
>> +static void cinterion_set_online(struct ofono_modem *modem, ofono_bool_t online,
>> +			ofono_modem_online_cb_t cb, void *user_data)
>> +{
>> +	GAtChat *chat = ofono_modem_get_data(modem);
>> +	struct cb_data *cbd = cb_data_new(cb, user_data);
>> +	char const *command = online ? "AT+CFUN=1" : "AT+CFUN=7";
>> +
>> +	DBG("modem %p %s", modem, online ? "online" : "offline");
>> +
>> +	if (g_at_chat_send(chat, command, NULL, set_online_cb, cbd, g_free))
>> +		return;
>> +
>> +	g_free(cbd);
>> +
>> +	CALLBACK_WITH_FAILURE(cb, cbd->data);
>> +}
> Doesn't this expand into a use after free bug if g_at_chat_send() fails?
>

Yes I see what you mean. I also see other plugins (e.g. ublox) reverse
the order of the free and callback.

Have provided a patch to bring the cinterion plugin into line.

Regards,

Alex