korg/bluez
0
0
Fork 0
mirror of https://git.kernel.org/pub/scm/bluetooth/bluez.git synced 2024-11-24 04:34:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

adapter: Fix possible crash when stopping discovery

Browse Source 
If the client disconnect/crash while MGMT_OP_STOP_DISCOVERY was pending
it would possibly cause a crash as the client pointer is passed to
mgmt_send and accessed in the callback after being freed.

To fix this the adapter itself is now passed to the callback so the
client is not accessed directly, instead the code now checks if
discovery_list has not been cleared in the meantime and only then
proceed to access the client pointer which is how
MGMT_OP_START_DISCOVERY is handled.
This commit is contained in:
Luiz Augusto von Dentz 2020-06-08 14:55:57 -07:00
parent 1b46f5410d
commit 9dd6df753a
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/adapter.c
View File

@ -1926,11 +1926,19 @@ static bool set_discovery_discoverable(struct btd_adapter *adapter, bool enable)
static void stop_discovery_complete(uint8_t status, uint16_t length,
const void *param, void *user_data)
{
struct watch_client *client = user_data;
struct btd_adapter *adapter = client->adapter;
struct btd_adapter *adapter = user_data;
struct watch_client *client;
DBG("status 0x%02x", status);
/* Is there are no clients the discovery must have been stopped while
* discovery command was pending.
*/
if (!adapter->discovery_list)
return;
client = adapter->discovery_list->data;
discovery_reply(client, status);
if (status != MGMT_STATUS_SUCCESS)