summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohan Hedberg <johan.hedberg@intel.com>2012-09-27 08:58:57 -0300
committerPatrik Flykt <patrik.flykt@linux.intel.com>2012-09-28 15:17:05 +0300
commit1a7a2357056cc52f554f3d3dee6a246b0c9b094e (patch)
tree7ab94055a302d916d048f7a6aa13c5b7a74800b3
parent8ea20cbb549b13e27f0987f2fa92898a64eceb05 (diff)
downloadconnman-1a7a2357056cc52f554f3d3dee6a246b0c9b094e.tar.gz
connman-1a7a2357056cc52f554f3d3dee6a246b0c9b094e.tar.bz2
connman-1a7a2357056cc52f554f3d3dee6a246b0c9b094e.zip
gdbus: Fix crash when getting disconnected from the bus
When getting disconnected from the bus sometimes (maybe always?) dbus_watch_handle() can cause the "info" context to be free'd meaning that we should not try to access it after the call. The only member we need access to is the connection pointer and as the code already has a ref() call for it it's only natural to solve the issue by adding a local variable not dependent on "info". The backtrace of the crash fixed looks as follows: Invalid read of size 8 at 0x121085: watch_func (mainloop.c:105) by 0x4C72694: g_main_context_dispatch (gmain.c:2539) by 0x4C729C7: g_main_context_iterate.isra.23 (gmain.c:3146) by 0x4C72DC1: g_main_loop_run (gmain.c:3340) by 0x120541: main (main.c:551) Address 0x5bbcd90 is 16 bytes inside a block of size 24 free'd at 0x4A079AE: free (vg_replace_malloc.c:427) by 0x4C7837E: g_free (gmem.c:252) by 0x4F708BF: dbus_watch_set_data (dbus-watch.c:614) by 0x4F70938: _dbus_watch_unref (dbus-watch.c:132) by 0x4F6E9A7: _dbus_transport_handle_watch (dbus-transport.c:884) by 0x4F59AFB: _dbus_connection_handle_watch (dbus-connection.c:1497) by 0x4F70AF9: dbus_watch_handle (dbus-watch.c:683) by 0x121084: watch_func (mainloop.c:103) by 0x4C72694: g_main_context_dispatch (gmain.c:2539) by 0x4C729C7: g_main_context_iterate.isra.23 (gmain.c:3146) by 0x4C72DC1: g_main_loop_run (gmain.c:3340) by 0x120541: main (main.c:551)
-rw-r--r--gdbus/mainloop.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/gdbus/mainloop.c b/gdbus/mainloop.c
index cff326f6..099b67fe 100644
--- a/gdbus/mainloop.c
+++ b/gdbus/mainloop.c
@@ -92,8 +92,9 @@ static gboolean watch_func(GIOChannel *chan, GIOCondition cond, gpointer data)
struct watch_info *info = data;
unsigned int flags = 0;
DBusDispatchStatus status;
+ DBusConnection *conn;
- dbus_connection_ref(info->conn);
+ conn = dbus_connection_ref(info->conn);
if (cond & G_IO_IN) flags |= DBUS_WATCH_READABLE;
if (cond & G_IO_OUT) flags |= DBUS_WATCH_WRITABLE;
@@ -102,10 +103,10 @@ static gboolean watch_func(GIOChannel *chan, GIOCondition cond, gpointer data)
dbus_watch_handle(info->watch, flags);
- status = dbus_connection_get_dispatch_status(info->conn);
- queue_dispatch(info->conn, status);
+ status = dbus_connection_get_dispatch_status(conn);
+ queue_dispatch(conn, status);
- dbus_connection_unref(info->conn);
+ dbus_connection_unref(conn);
return TRUE;
}