[Bluez PATCH v1] core: fix a possible crash when removing devices

* [Bluez PATCH v1] core: fix a possible crash when removing devices
@ 2021-07-20 11:51 Howard Chung
  2021-07-20 12:49 ` [Bluez,v1] " bluez.test.bot
  0 siblings, 1 reply; 3+ messages in thread
From: Howard Chung @ 2021-07-20 11:51 UTC (permalink / raw)
  To: linux-bluetooth, luiz.dentz; +Cc: Yun-Hao Chung

From: Yun-Hao Chung <howardchung@chromium.org>

In probe_service, if the service already exists in device->services, it
returns the service. This might cause dev_probe and device_probe_profile
to add a duplicate service into device->services. When removing the
device, a double-free error might occur.

This patch changes the logic of probe_service so that the same service
will not be added to a device.

---
Hi maintainers,

This was originally found by removing/reprobing profiles in admin_policy
plugin. Since we are going to adopt the other way to block incoming
connection, this patch is no longer causing any issue, but I think it
is still nice to have to prevent potential crashes.

Thanks,
Howard

 src/device.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/device.c b/src/device.c
index faf07ba22270..b29aa195d19b 100644
--- a/src/device.c
+++ b/src/device.c
@@ -4624,8 +4624,11 @@ static struct btd_service *probe_service(struct btd_device *device,
 		return NULL;
 
 	l = find_service_with_profile(device->services, profile);
+	/* If the service already exists, return NULL so that it won't be added
+	 * to the device->services.
+	 */
 	if (l)
-		return l->data;
+		return NULL;
 
 	service = service_create(device, profile);
 
-- 
2.32.0.402.g57bb445576-goog


^ permalink raw reply related	[flat|nested] 3+ messages in thread