From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: Youwan Wang <wangyouwan@uniontech.com>
Cc: "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
Subject: Re: [PATCH] obexd: Fix crash of transfer pointer has being freed
Date: Wed, 29 Jun 2022 16:52:39 -0700 [thread overview]
Message-ID: <CABBYNZ+X2ST_ZZ6dQernrmnAD2rNdF3X_4xY=z4_s8yyRB0+YQ@mail.gmail.com> (raw)
In-Reply-To: <CABBYNZK+8KHiDcz8yoMP-g3PFzxFTXXPaUEnECU+wmKtLo3cPA@mail.gmail.com>
Hi Youwan,
On Fri, Jun 17, 2022 at 3:58 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Youwan,
>
> On Wed, Jun 15, 2022 at 5:54 AM Youwan Wang <wangyouwan@uniontech.com> wrote:
> >
> > PC1 -> PC2 in the process of transferring the file,
> > PC2 terminate the reception.
> > It is found that PC1 will receive the Rcvd
> > Forbiden message.
> > transfer_response func is called and go to failed:
> > transfer_complete func is called and go to transfer_free
> >
> > Invalid read of size 8
> > at 0x129C9B: put_get_data (gobex-transfer.c:138)
> > by 0x128675: get_body (gobex-packet.c:397)
> > by 0x128675: g_obex_packet_encode (gobex-packet.c:451)
> > by 0x1264ED: write_data (gobex.c:461)
> > by 0x1264ED: write_data (gobex.c:431)
> > by 0x49B7E97: g_main_context_dispatch ()
> > by 0x49B8287: ??? ()
> > by 0x49B8581: g_main_loop_run ()
> > by 0x120834: main (main.c:322)
> > Address 0x7300028 is 56 bytes inside a block of size 64 free'd
> > at 0x48369AB: free (vg_replace_malloc.c:530)
> > by 0x12A404: transfer_response (gobex-transfer.c:245)
> > by 0x126B02: handle_response (gobex.c:1128)
> > by 0x127087: incoming_data (gobex.c:1373)
> > by 0x49B7E97: g_main_context_dispatch ()
> > by 0x49B8287: ??? ()
> > by 0x49B8581: g_main_loop_run ()
> > by 0x120834: main (main.c:322)
> > Block was alloc'd at
> > at 0x4837B65: calloc (vg_replace_malloc.c:752)
> > by 0x49BD9D8: g_malloc0 ()
> > by 0x129A49: transfer_new (gobex-transfer.c:258)
> > by 0x12A612: g_obex_put_req_pkt (gobex-transfer.c:282)
> > by 0x12A612: g_obex_put_req_pkt (gobex-transfer.c:271)
> > by 0x145862: transfer_start_put (transfer.c:880)
> > by 0x145862: obc_transfer_start (transfer.c:911)
> > by 0x13B487: session_process_transfer (session.c:836)
> > by 0x13C128: session_process_queue (session.c:887)
> > by 0x13C128: session_process_queue (session.c:872)
> > by 0x13C18F: session_process (session.c:820)
> > by 0x49B7E97: g_main_context_dispatch (in /usr/lib/x86_64-linux-gnu/)
> > by 0x49B8287: ??? (in /usr/lib/x86_64-linux-gnu/)
> > by 0x49B8581: g_main_loop_run (in /usr/lib/x86_64-linux-gnu/)
> > by 0x120834: main (main.c:322)
> > ---
> > gobex/gobex-transfer.c | 8 ++++++++
> > 1 file changed, 8 insertions(+)
> >
> > diff --git a/gobex/gobex-transfer.c b/gobex/gobex-transfer.c
> > index c94d018b2..8e97fc73e 100644
> > --- a/gobex/gobex-transfer.c
> > +++ b/gobex/gobex-transfer.c
> > @@ -197,6 +197,14 @@ static void transfer_response(GObex *obex, GError *err, GObexPacket *rsp,
> > }
> >
> > rspcode = g_obex_packet_get_operation(rsp, &final);
> > + if (rspcode == G_OBEX_RSP_FORBIDDEN) {
> > + err = g_error_new(G_OBEX_ERROR, rspcode, "%s",
> > + g_obex_strerror(rspcode));
> > + g_obex_debug(G_OBEX_DEBUG_ERROR, "%s", err->message);
> > + g_error_free(err);
> > + return;
> > + }
>
> This is not quite right, in fact the if statement below already treat
> such errors, we might be missing something like final:
>
> /* Reset if final so it can no longer be cancelled */
> if (final_rsp)
> obex->pending_req = NULL;
>
> This would be a problem on the remote implementation which is
> indicating that perhaps it is just a temporary failure, anyway then:
>
> id = transfer->req_id;
> transfer->req_id = 0;
>
> This resets the req_id so on transfer_free the following code is not run:
>
> if (transfer->req_id > 0)
> g_obex_cancel_req(transfer->obex, transfer->req_id, TRUE);
>
> So either we have to restore the transfer->req_id = id or not reset it
> to 0, so perhaps something like this works better:
>
> diff --git a/gobex/gobex-transfer.c b/gobex/gobex-transfer.c
> index c94d018b2..8fae65d8d 100644
> --- a/gobex/gobex-transfer.c
> +++ b/gobex/gobex-transfer.c
> @@ -200,6 +200,11 @@ static void transfer_response(GObex *obex, GError
> *err, GObexPacket *rsp,
> if (rspcode != G_OBEX_RSP_SUCCESS && rspcode != G_OBEX_RSP_CONTINUE) {
> err = g_error_new(G_OBEX_ERROR, rspcode, "%s",
> g_obex_strerror(rspcode));
> + /* If not marked as final response but transfer_complete gonna
> + * be called restore the req_id so it can be properly cancelled
> + */
> + if (!final)
> + transport->req_id = id;
> goto failed;
> }
You haven't responded about this one, I believe there are quite a few
patches of yours that are trying to circumvent this very issue.
> > +
> > if (rspcode != G_OBEX_RSP_SUCCESS && rspcode != G_OBEX_RSP_CONTINUE) {
> > err = g_error_new(G_OBEX_ERROR, rspcode, "%s",
> > g_obex_strerror(rspcode));
> > --
> > 2.20.1
> >
> >
> >
>
>
> --
> Luiz Augusto von Dentz
--
Luiz Augusto von Dentz
prev parent reply other threads:[~2022-06-29 23:52 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-15 12:49 [PATCH] obexd: Fix crash of transfer pointer has being freed Youwan Wang
2022-06-15 14:39 ` bluez.test.bot
2022-06-17 22:58 ` [PATCH] " Luiz Augusto von Dentz
2022-06-29 23:52 ` Luiz Augusto von Dentz [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CABBYNZ+X2ST_ZZ6dQernrmnAD2rNdF3X_4xY=z4_s8yyRB0+YQ@mail.gmail.com' \
--to=luiz.dentz@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=wangyouwan@uniontech.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).