| Message ID | 20241209205843.1394081-1-luiz.dentz@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [BlueZ,v1,1/3] shared/gatt-db: Fix possible crash on gatt_db_clone | expand |
This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=916123 ---Test result--- Test Summary: CheckPatch PENDING 0.25 seconds GitLint PENDING 0.21 seconds BuildEll PASS 20.58 seconds BluezMake PASS 1622.58 seconds MakeCheck PASS 13.49 seconds MakeDistcheck PASS 158.61 seconds CheckValgrind PASS 213.09 seconds CheckSmatch WARNING 271.64 seconds bluezmakeextell PASS 98.67 seconds IncrementalBuild PENDING 0.30 seconds ScanBuild PASS 841.73 seconds Details ############################## Test: CheckPatch - PENDING Desc: Run checkpatch.pl script Output: ############################## Test: GitLint - PENDING Desc: Run gitlint Output: ############################## Test: CheckSmatch - WARNING Desc: Run smatch tool with source Output: monitor/att.c: note: in included file:monitor/display.h:82:26: warning: Variable length array is used.monitor/packet.c: note: in included file:monitor/display.h:82:26: warning: Variable length array is used.monitor/packet.c:1868:26: warning: Variable length array is used.monitor/packet.c: note: in included file:monitor/bt.h:3606:52: warning: array of flexible structuresmonitor/bt.h:3594:40: warning: array of flexible structures ############################## Test: IncrementalBuild - PENDING Desc: Incremental build with the patches in the series Output: --- Regards, Linux Bluetooth
Hello: This series was applied to bluetooth/bluez.git (master) by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>: On Mon, 9 Dec 2024 15:58:41 -0500 you wrote: > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > > The following crash can happen if the original gatt_db has incomplete > service definitions since the attribute might still be discovering: > > Invalid read of size 4 > at 0x1E5A39: bt_uuid_len (uuid.h:289) > by 0x1E5A39: service_clone (gatt-db.c:284) > by 0x1D5EBB: queue_foreach (queue.c:207) > by 0x1E61CD: gatt_db_clone (gatt-db.c:329) > by 0x1C18F0: btd_device_set_gatt_db (device.c:7110) > by 0x1C9F96: foreach_rsi (set.c:295) > by 0x1D5EBB: queue_foreach (queue.c:207) > by 0x48EA91F: g_slist_foreach (in /usr/lib64/libglib-2.0.so.0.8000.3) > by 0x1CA2C8: btd_set_add_device (set.c:357) > by 0x1BB9AB: btd_device_add_set (device.c:2049) > by 0x17FF76: csip_ready (csip.c:243) > by 0x1FD5CC: csip_notify_ready (csip.c:546) > by 0x1FD5CC: csip_idle (csip.c:630) > by 0x1DE20C: idle_notify (gatt-client.c:171) > Address 0xc is not stack'd, malloc'd or (recently) free'd > > [...] Here is the summary with links: - [BlueZ,v1,1/3] shared/gatt-db: Fix possible crash on gatt_db_clone https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=0d9f5f6a8c14 - [BlueZ,v1,2/3] main.conf: Add GATT.ExportClaimedServices https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=dbd6591bd1d0 - [BlueZ,v1,3/3] monitor: Allow caching of temporary gatt_db (no matching commit) You are awesome, thank you!
diff --git a/src/shared/gatt-db.c b/src/shared/gatt-db.c index b35763410d17..72254c7e41ba 100644 --- a/src/shared/gatt-db.c +++ b/src/shared/gatt-db.c @@ -278,6 +278,9 @@ static void service_clone(void *data, void *user_data) for (i = 0; i < service->num_handles; i++) { struct gatt_db_attribute *attr = service->attributes[i]; + if (!attr) + continue; + /* Only clone values for characteristics declaration since that * is considered when calculating the db hash. */
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> The following crash can happen if the original gatt_db has incomplete service definitions since the attribute might still be discovering: Invalid read of size 4 at 0x1E5A39: bt_uuid_len (uuid.h:289) by 0x1E5A39: service_clone (gatt-db.c:284) by 0x1D5EBB: queue_foreach (queue.c:207) by 0x1E61CD: gatt_db_clone (gatt-db.c:329) by 0x1C18F0: btd_device_set_gatt_db (device.c:7110) by 0x1C9F96: foreach_rsi (set.c:295) by 0x1D5EBB: queue_foreach (queue.c:207) by 0x48EA91F: g_slist_foreach (in /usr/lib64/libglib-2.0.so.0.8000.3) by 0x1CA2C8: btd_set_add_device (set.c:357) by 0x1BB9AB: btd_device_add_set (device.c:2049) by 0x17FF76: csip_ready (csip.c:243) by 0x1FD5CC: csip_notify_ready (csip.c:546) by 0x1FD5CC: csip_idle (csip.c:630) by 0x1DE20C: idle_notify (gatt-client.c:171) Address 0xc is not stack'd, malloc'd or (recently) free'd --- src/shared/gatt-db.c | 3 +++ 1 file changed, 3 insertions(+)