Received: by 2002:a6b:fb09:0:0:0:0:0 with SMTP id h9csp1293032iog; Thu, 30 Jun 2022 22:54:01 -0700 (PDT) X-Google-Smtp-Source: AGRyM1tr80cZyMfgjBRmkc2sh8n6+o2nYyUDZeK3cjqp9LOWnC8y821mA1bE9ouT1+LY18pbpeIe X-Received: by 2002:a17:90a:7acd:b0:1ea:d721:eb5e with SMTP id b13-20020a17090a7acd00b001ead721eb5emr16714098pjl.238.1656654841769; Thu, 30 Jun 2022 22:54:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1656654841; cv=none; d=google.com; s=arc-20160816; b=D3w4RRPMr8xYz085Um2J8xbCfn9BzjrgsTIXgBdXM7sYJCG0EaHPEBMeEchQ8kbLPY kzDpoHdFTcSVR58X5Kc01MkeRc2gfnhCsTzzSOqdqgxAs/k4Y4AMzHQPwC9FCHV55xpi vA2T2l2cuCM4SuBEN1syKeWjIbtn0zSKMQiqYDwmoOVgk4hPQKnhi2oPddBp2eB2yDyJ Nh0gsaIwD+Q96RKVFX7iUAJ2EyijAsEaVvESeASCFdFttqETfQKdds5WunytzhqsfOo7 w12ZBWvwBTp2O5VM4zxsbqWdUmC6J2MJhfip02kcXcwVZ88m+Lpv1AA/+F4H+QWBcY0Q 6+wQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:feedback-id:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from; bh=8f/AJAwNOkjLnxmOMaAmfUSo3dSXW4m13zrvav7rYHU=; b=CuhOKzU8NHZ6vD6kCJM8AJlcHRv527rwHVndaJ8aD2wHL6fAOw7I3mzYon+yLKcMN3 w0m+EuCiyk2FvG8wfykNScO4CpQNNLel2+HR7hDimZS70cN4JgcebDW/JHn+X/uMT/o2 xBmp/jENifyOH6GZ2XHyuUnL0RENm7bgY6nIUrkI2+19hn9YC2zI7X1Do0BPkT1MmrIl qmGsMykR6h7lM+Hm5MSQjemvkIQMc/uNhGL71ECsWnbQ9bur9Q8nGiv/ClmFrQovNlmf PthwLqC9yodmty4bNNoTBS7tJYUSOAapgtp98fAiAfcg5JYgvXQQnYQCZC+LvYu02LQ5 hLvA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id w12-20020a170902d3cc00b0016b8008c00csi108549plb.131.2022.06.30.22.53.34; Thu, 30 Jun 2022 22:54:01 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234092AbiGAFw4 (ORCPT + 99 others); Fri, 1 Jul 2022 01:52:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59156 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234024AbiGAFwz (ORCPT ); Fri, 1 Jul 2022 01:52:55 -0400 Received: from smtpbgjp3.qq.com (smtpbgjp3.qq.com [54.92.39.34]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BB3DC6B27C for ; Thu, 30 Jun 2022 22:52:52 -0700 (PDT) X-QQ-mid: bizesmtp69t1656654766te3oumrp Received: from localhost.localdomain ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Fri, 01 Jul 2022 13:52:40 +0800 (CST) X-QQ-SSF: 01400000002000C0E000000A0000000 X-QQ-FEAT: jfdGVjI73+Tf7pKylkarlaL6NjaDJ8XIF/2zZnsDgxXviXviZLCwot79UonKZ JVYmhYJyycSSGf7ucV0bUy+XP0ocMpo56It2Fiw35W7h4MorcNLlTl/TXqYcWbNHhVWsghx l3PsTpqa+b6zMK/JVVESf98WObW2vFz8LIiydgQ07T8dqo9VyNCf9khKDtmjeJ0iNjHPI91 QkcFi0Km3oRdnokkKfQFxlgdahCD/SD/KEij++MhADgYsDcb7g9VOV/UZ6/JSb+JLZZK8QQ 4FCXoBE4EVlZix/ZcTfzUNFLCmp00bXVgDZ9Am8O5g7MEQy8lrO7qnRYXzGbAR3YbxaaOiJ 3fMHqf9qA6J4ZjMamosVQgLMN/pNg== X-QQ-GoodBg: 1 From: Youwan Wang To: linux-bluetooth@vger.kernel.org Cc: Youwan Wang Subject: [PATCH] obexd: fix crashed after cancel the on-going transfer Date: Fri, 1 Jul 2022 13:52:37 +0800 Message-Id: <20220701055237.2946-1-wangyouwan@uniontech.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-QQ-SENDSIZE: 520 Feedback-ID: bizesmtp:uniontech.com:qybgforeign:qybgforeign8 X-QQ-Bgrelay: 1 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE, SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org There is a use after released.transfer->req_id different obex->pending_req->id,See the following log, The packages is removd in cancel_complete func are not the same package in req_timeout func, but transfer pointer is released. log: g_obex_cancel_req() transfer->req_id 23 id 22 obex->pending_req(0x55b642c3e100) g_obex_cancel_req() match->data (0x55b642c344a0) g_obex_ref() ref 4 cancel_complete() pending req timeout 176 id 22 obex(0x55b642c3e100) transfer_response() obex 0x55b642c36480 transfer(0x55b642c3d000) g_obex_drop_tx_queue() g_obex_unref() obex 0x55b642c36480 g_obex_unref() ref 3 transfer_free() obex 0x55b642c36480 transfer 0x55b642c3d000 g_obex_unref() obex 0x55b642c36480 g_obex_unref() ref 2 pending_pkt_free() timeout_id 0 pending_pkt (0x55b642c344a0) step: [obex]# connect 28:33:34:1E:96:98 Attempting to connect to 28:33:34:1E:96:98 [NEW] Session /org/bluez/obex/client/session2 [default] [NEW] ObjectPush /org/bluez/obex/client/session2 Connection successful [28:33:34:1E:96:98]# send /home/uos/Desktop/systemd.zip Attempting to send /home/uos/Desktop/systemd.zip [NEW] Transfer /org/bluez/obex/client/session2/transfer2 Transfer /org/bluez/obex/client/session2/transfer2 Status: queued Name: systemd.zip Size: 33466053 Filename: /home/uos/Desktop/systemd.zip Session: /org/bluez/obex/client/session2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 [CHG] Transfer /org/bluez/obex/client/session2/transfer2 er2 33:34:1E:96:98]# cancel /org/bluez/obex/client/sessi Attempting to cancel transfer /org/bluez/obex/client/s Cancel successful valgrind trace: ==11431== Invalid read of size 4 ==11431== at 0x12B442: transfer_response () ==11431== by 0x127764: req_timeout () ==11431== by 0x49B8922: ??? ( ) ==11431== by 0x49B7E97: g_main_context_dispatch () ==11431== by 0x49B8287: ??? (in ) ==11431== by 0x49B8581: g_main_loop_run () ==11431== by 0x121834: main (main.c:322) ==11431== Address 0x7344fa0 is 16 bytes inside a block of size ==11431== at 0x48369AB: free () ==11431== by 0x12B459: transfer_response () ==11431== by 0x127B3D: cancel_complete () ==11431== by 0x49B7E97: g_main_context_dispatch () ==11431== by 0x49B8287: ??? () ==11431== by 0x49B8581: g_main_loop_run () ==11431== by 0x121834: main (main.c:322) ==11431== Block was alloc'd at ==11431== at 0x4837B65: calloc () ==11431== by 0x49BD9D8: g_malloc0 () ==11431== by 0x12AB89: transfer_new () ==11431== by 0x12B732: g_obex_put_req_pkt () ==11431== by 0x12B732: g_obex_put_req_pkt () ==11431== by 0x146982: transfer_start_put () ==11431== by 0x146982: obc_transfer_start () ==11431== by 0x13C5A7: session_process_transfer () ==11431== by 0x13D248: session_process_queue () ==11431== by 0x13D248: session_process_queue () ==11431== by 0x13D2AF: session_process () ==11431== by 0x49B7E97: g_main_context_dispatch () ==11431== by 0x49B8287: ??? (i) ==11431== by 0x49B8581: g_main_loop_run () ==11431== by 0x121834: main () ==11431== ==11431== (action on error) vgdb me ... --- gobex/gobex-transfer.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/gobex/gobex-transfer.c b/gobex/gobex-transfer.c index c94d018b2..bd820757d 100644 --- a/gobex/gobex-transfer.c +++ b/gobex/gobex-transfer.c @@ -83,15 +83,18 @@ static struct transfer *find_transfer(guint id) static void transfer_complete(struct transfer *transfer, GError *err) { - guint id = transfer->id; + if (!g_slist_find(transfers, transfer)) + return; - g_obex_debug(G_OBEX_DEBUG_TRANSFER, "transfer %u", id); + transfer->req_id = 0; + g_obex_debug(G_OBEX_DEBUG_TRANSFER, "transfer %u", transfer->id); if (err) { /* No further tx must be performed */ g_obex_drop_tx_queue(transfer->obex); } + guint id = transfer->id; transfer->complete_func(transfer->obex, err, transfer->user_data); /* Check if the complete_func removed the transfer */ if (find_transfer(id) == NULL) @@ -106,9 +109,6 @@ static void transfer_abort_response(GObex *obex, GError *err, GObexPacket *rsp, struct transfer *transfer = user_data; g_obex_debug(G_OBEX_DEBUG_TRANSFER, "transfer %u", transfer->id); - - transfer->req_id = 0; - /* Intentionally override error */ err = g_error_new(G_OBEX_ERROR, G_OBEX_ERROR_CANCELLED, "Operation was aborted"); @@ -186,11 +186,6 @@ static void transfer_response(GObex *obex, GError *err, GObexPacket *rsp, gboolean rspcode, final; guint id; - g_obex_debug(G_OBEX_DEBUG_TRANSFER, "transfer %u", transfer->id); - - id = transfer->req_id; - transfer->req_id = 0; - if (err != NULL) { transfer_complete(transfer, err); return; @@ -203,6 +198,9 @@ static void transfer_response(GObex *obex, GError *err, GObexPacket *rsp, goto failed; } + if (!g_slist_find(transfers, transfer)) + return; + if (transfer->opcode == G_OBEX_OP_GET) { handle_get_body(transfer, rsp, &err); if (err != NULL) @@ -222,8 +220,6 @@ static void transfer_response(GObex *obex, GError *err, GObexPacket *rsp, req = g_obex_packet_new(transfer->opcode, TRUE, G_OBEX_HDR_INVALID); } else { - /* Keep id since request still outstanting */ - transfer->req_id = id; return; } -- 2.20.1