2012-01-31 15:59:05

by Santiago Carot

[permalink] [raw]
Subject: [PATCH] device: Fix segmentation fault removing devices

There is an unbalanced control regarding to the GATT channel and its
attachid, we have to to update the attach id value by setting it to
zero whenever we detach a GATT channel.
---
src/device.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/src/device.c b/src/device.c
index c19acd4..9f749b7 100644
--- a/src/device.c
+++ b/src/device.c
@@ -1734,6 +1734,7 @@ static void attrib_disconnected(gpointer user_data)
attrib_channel_detach(device->attrib, device->attachid);
g_attrib_unref(device->attrib);
device->attrib = NULL;
+ device->attachid = 0;

if (device->auto_connect == FALSE)
return;
@@ -1781,6 +1782,7 @@ static void primary_cb(GSList *services, guint8 status, gpointer user_data)

if (device->attios == NULL && device->attios_offline == NULL) {
attrib_channel_detach(device->attrib, device->attachid);
+ device->attachid = 0;
g_attrib_unref(device->attrib);
device->attrib = NULL;
} else
@@ -2854,7 +2856,7 @@ gboolean btd_device_remove_attio_callback(struct btd_device *device, guint id)
if (device->attios != NULL || device->attios_offline != NULL)
return TRUE;

- if (device->attachid) {
+ if (device->attachid > 0) {
attrib_channel_detach(device->attrib, device->attachid);
device->attachid = 0;
}
--
1.7.9



2012-01-31 16:33:14

by Santiago Carot

[permalink] [raw]
Subject: Re: [PATCH] device: Fix segmentation fault removing devices

Hi Anderson,

2012/1/31 Anderson Lizardo <[email protected]>:
> Hi Santiago,
>
> On Tue, Jan 31, 2012 at 11:59 AM, Santiago Carot-Nemesio
> <[email protected]> wrote:
>> There is an unbalanced control regarding to the GATT channel and its
>> attachid, we have to to update the attach id value by setting it to
>> zero whenever we detach a GATT channel.
>
> Can you detail how to reproduce the segfault? I want to test on my own setup.
>

I simply remove a device with a GATT profile, I used thermometer and I
saw that whenever the plugin called to
btd_device_remove_attio_callback, inside this function it was using a
NULL pointer in device->attrib to detach the channel, so I checked it
and I saw that it only is paying attention to the device->attachid
wich was unupdated because it isn't being set to 0 whenever the
channel is detached.

> Thanks
>
>> ---
>> ?src/device.c | ? ?4 +++-
>> ?1 files changed, 3 insertions(+), 1 deletions(-)
>>
>> diff --git a/src/device.c b/src/device.c
>> index c19acd4..9f749b7 100644
>> --- a/src/device.c
>> +++ b/src/device.c
>> @@ -1734,6 +1734,7 @@ static void attrib_disconnected(gpointer user_data)
>> ? ? ? ?attrib_channel_detach(device->attrib, device->attachid);
>> ? ? ? ?g_attrib_unref(device->attrib);
>> ? ? ? ?device->attrib = NULL;
>> + ? ? ? device->attachid = 0;
>>
>> ? ? ? ?if (device->auto_connect == FALSE)
>> ? ? ? ? ? ? ? ?return;
>> @@ -1781,6 +1782,7 @@ static void primary_cb(GSList *services, guint8 status, gpointer user_data)
>>
>> ? ? ? ?if (device->attios == NULL && device->attios_offline == NULL) {
>> ? ? ? ? ? ? ? ?attrib_channel_detach(device->attrib, device->attachid);
>> + ? ? ? ? ? ? ? device->attachid = 0;
>> ? ? ? ? ? ? ? ?g_attrib_unref(device->attrib);
>> ? ? ? ? ? ? ? ?device->attrib = NULL;
>> ? ? ? ?} else
>> @@ -2854,7 +2856,7 @@ gboolean btd_device_remove_attio_callback(struct btd_device *device, guint id)
>> ? ? ? ?if (device->attios != NULL || device->attios_offline != NULL)
>> ? ? ? ? ? ? ? ?return TRUE;
>>
>> - ? ? ? if (device->attachid) {
>> + ? ? ? if (device->attachid > 0) {
>> ? ? ? ? ? ? ? ?attrib_channel_detach(device->attrib, device->attachid);
>> ? ? ? ? ? ? ? ?device->attachid = 0;
>> ? ? ? ?}
>> --
>> 1.7.9
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
>> the body of a message to [email protected]
>> More majordomo info at ?http://vger.kernel.org/majordomo-info.html
>
>
>
> --
> Anderson Lizardo
> Instituto Nokia de Tecnologia - INdT
> Manaus - Brazil

2012-01-31 16:23:04

by Anderson Lizardo

[permalink] [raw]
Subject: Re: [PATCH] device: Fix segmentation fault removing devices

Hi Santiago,

On Tue, Jan 31, 2012 at 11:59 AM, Santiago Carot-Nemesio
<[email protected]> wrote:
> There is an unbalanced control regarding to the GATT channel and its
> attachid, we have to to update the attach id value by setting it to
> zero whenever we detach a GATT channel.

Can you detail how to reproduce the segfault? I want to test on my own setup.

Thanks

> ---
> ?src/device.c | ? ?4 +++-
> ?1 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/src/device.c b/src/device.c
> index c19acd4..9f749b7 100644
> --- a/src/device.c
> +++ b/src/device.c
> @@ -1734,6 +1734,7 @@ static void attrib_disconnected(gpointer user_data)
> ? ? ? ?attrib_channel_detach(device->attrib, device->attachid);
> ? ? ? ?g_attrib_unref(device->attrib);
> ? ? ? ?device->attrib = NULL;
> + ? ? ? device->attachid = 0;
>
> ? ? ? ?if (device->auto_connect == FALSE)
> ? ? ? ? ? ? ? ?return;
> @@ -1781,6 +1782,7 @@ static void primary_cb(GSList *services, guint8 status, gpointer user_data)
>
> ? ? ? ?if (device->attios == NULL && device->attios_offline == NULL) {
> ? ? ? ? ? ? ? ?attrib_channel_detach(device->attrib, device->attachid);
> + ? ? ? ? ? ? ? device->attachid = 0;
> ? ? ? ? ? ? ? ?g_attrib_unref(device->attrib);
> ? ? ? ? ? ? ? ?device->attrib = NULL;
> ? ? ? ?} else
> @@ -2854,7 +2856,7 @@ gboolean btd_device_remove_attio_callback(struct btd_device *device, guint id)
> ? ? ? ?if (device->attios != NULL || device->attios_offline != NULL)
> ? ? ? ? ? ? ? ?return TRUE;
>
> - ? ? ? if (device->attachid) {
> + ? ? ? if (device->attachid > 0) {
> ? ? ? ? ? ? ? ?attrib_channel_detach(device->attrib, device->attachid);
> ? ? ? ? ? ? ? ?device->attachid = 0;
> ? ? ? ?}
> --
> 1.7.9
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
> the body of a message to [email protected]
> More majordomo info at ?http://vger.kernel.org/majordomo-info.html



--
Anderson Lizardo
Instituto Nokia de Tecnologia - INdT
Manaus - Brazil

2012-02-02 19:58:52

by Johan Hedberg

[permalink] [raw]
Subject: Re: [PATCH] device: Fix segmentation fault removing devices

Hi Santiago,

On Tue, Jan 31, 2012, Santiago Carot-Nemesio wrote:
> There is an unbalanced control regarding to the GATT channel and its
> attachid, we have to to update the attach id value by setting it to
> zero whenever we detach a GATT channel.
> ---
> src/device.c | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)

Applied. Thanks.

Johan

2012-02-02 19:26:47

by Claudio Takahasi

[permalink] [raw]
Subject: Re: [PATCH] device: Fix segmentation fault removing devices

Hi Santiago,

On Tue, Jan 31, 2012 at 1:33 PM, Santiago Carot <[email protected]> wrote:
> Hi Anderson,
>
> 2012/1/31 Anderson Lizardo <[email protected]>:
>> Hi Santiago,
>>
>> On Tue, Jan 31, 2012 at 11:59 AM, Santiago Carot-Nemesio
>> <[email protected]> wrote:
>>> There is an unbalanced control regarding to the GATT channel and its
>>> attachid, we have to to update the attach id value by setting it to
>>> zero whenever we detach a GATT channel.
>>
>> Can you detail how to reproduce the segfault? I want to test on my own setup.
>>
>
> I simply remove a device with a GATT profile, I used thermometer and I
> saw that whenever the plugin called to
> btd_device_remove_attio_callback, inside this function it was using a
> NULL pointer in device->attrib to detach the channel, so I checked it
> and I saw that it only is paying attention to the device->attachid
> wich was unupdated because it isn't being set to 0 whenever the
> channel is detached.
>
>> Thanks
>>

Ack.

This bug is also easily reproducible after a local initiated disconnection.
For BLE keep the link up an call test-device disconnect "address"
followed by test-device remove "address"

Claudio.