mesh: Static Analysis clean-up

PATCH In review Brian Gix 2 participants 9 messages May 22, 2020 – May 25, 2020 Bluetooth drivers

lore

Share & tools

lore

Brian Gix

author

2020-05-22 21:13 UTC #0 lore raw

v2 cover mesh: Static Analysis clean-up

This patchset fixes static analysis identified issues in the mesh daemon.

v2: Clean-up PB-ADV queue

Brian Gix (4):
mesh: Fix using uninitialized bytes
mesh: Fix leaked mesh_net allocation
mesh: Fix leaked message reference
mesh: Destroy PB-ADV queue when provisioning done

 mesh/crypto.c  | 1 +
 mesh/manager.c | 3 ++-
 mesh/node.c    | 4 ++--
 mesh/pb-adv.c  | 5 +++++
 4 files changed, 10 insertions(+), 3 deletions(-)

Signature · 1 line

2.25.4

Brian Gix

author

2020-05-22 21:13 UTC #1 lore raw

PATCH v2 1/4 mesh: Fix using uninitialized bytes

Fixes two problems found with static analysis

---
 mesh/crypto.c | 1 +
 mesh/node.c   | 2 ++
 2 files changed, 3 insertions(+)

mesh/crypto.c +1 -0

index 99536594b..70b96c51b 100644
@@ -553,6 +553,7 @@ bool mesh_crypto_packet_build(bool ctl, uint8_t ttl,
 	if (seq > SEQ_MASK)
 		return false;
 
+	packet[0] = 0;
 	l_put_be32(seq, packet + 1);
 	packet[1] = (ctl ? CTL : 0) | (ttl & TTL_MASK);

mesh/node.c +2 -0

index dd28dfd77..49ba7c885 100644
@@ -1596,6 +1596,8 @@ static void get_managed_objects_cb(struct l_dbus_message *msg, void *user_data)
 		/* Generate device and primary network keys */
 		l_getrandom(dev_key, sizeof(dev_key));
 		l_getrandom(net_key.old_key, sizeof(net_key.old_key));
+		memcpy(net_key.new_key, net_key.old_key,
+						sizeof(net_key.old_key));
 		net_key.net_idx = PRIMARY_NET_IDX;
 		net_key.phase = KEY_REFRESH_PHASE_NONE;

Signature · 1 line

2.25.4

Brian Gix

author

2020-05-22 21:13 UTC #2 lore raw

PATCH v2 2/4 mesh: Fix leaked mesh_net allocation

In reply to Brian Gix

---
 mesh/node.c | 2 --
 1 file changed, 2 deletions(-)

mesh/node.c +0 -2

index 49ba7c885..db888d27c 100644
@@ -1313,8 +1313,6 @@ static bool add_local_node(struct mesh_node *node, uint16_t unicast, bool kr,
 				bool ivu, uint32_t iv_idx, uint8_t dev_key[16],
 				uint16_t net_key_idx, uint8_t net_key[16])
 {
-	node->net = mesh_net_new(node);
-
 	if (!nodes)
 		nodes = l_queue_new();

Signature · 1 line

2.25.4

[email protected]

2020-05-22 23:37 UTC #3 lore raw

RE: [BlueZ,v2,2/4] mesh: Fix leaked mesh_net allocation

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. While we are preparing for reviewing the patches, we found the following issue/warning.

Test Result:
checkgitlint Failed

Outputs:
3: B6 Body message is missing

---
Regards,
Linux Bluetooth

Brian Gix

author

2020-05-22 21:13 UTC #4 lore raw

PATCH v2 3/4 mesh: Fix leaked message reference

In reply to Brian Gix

---
 mesh/manager.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

mesh/manager.c +2 -1

index 0242bb9e9..a7383e4d5 100644
@@ -228,6 +228,7 @@ static void add_start(void *user_data, int err)
 				"Failed to start provisioning initiator");
 
 	l_dbus_send(dbus_get_bus(), reply);
+	l_dbus_message_unref(add_pending->msg);
 
 	add_pending->msg = NULL;
 }

@@ -264,7 +265,6 @@ static struct l_dbus_message *add_node_call(struct l_dbus *dbus,
 	/* Invoke Prov Initiator */
 
 	add_pending = l_new(struct add_data, 1);
-	add_pending->msg = l_dbus_message_ref(msg);
 	memcpy(add_pending->uuid, uuid, 16);
 	add_pending->node = node;
 	add_pending->agent = node_get_agent(node);

@@ -277,6 +277,7 @@ static struct l_dbus_message *add_node_call(struct l_dbus *dbus,
 		goto fail;
 	}
 
+	add_pending->msg = l_dbus_message_ref(msg);
 	initiator_start(PB_ADV, uuid, 99, 60, add_pending->agent, add_start,
 				add_data_get, add_cmplt, node, add_pending);

Signature · 1 line

2.25.4

[email protected]

2020-05-22 23:37 UTC #5 lore raw

RE: [BlueZ,v2,3/4] mesh: Fix leaked message reference

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. While we are preparing for reviewing the patches, we found the following issue/warning.

Test Result:
checkgitlint Failed

Outputs:
3: B6 Body message is missing

---
Regards,
Linux Bluetooth

Brian Gix

author

2020-05-22 21:13 UTC #6 lore raw

PATCH v2 4/4 mesh: Destroy PB-ADV queue when provisioning done

In reply to Brian Gix

---
 mesh/pb-adv.c | 5 +++++
 1 file changed, 5 insertions(+)

mesh/pb-adv.c +5 -0

index 291d92651..c1316ed1b 100644
@@ -560,4 +560,9 @@ void pb_adv_unreg(void *user_data)
 	send_close_ind(session, 0);
 	l_queue_remove(pb_sessions, session);
 	l_free(session);
+
+	if (!l_queue_length(pb_sessions)) {
+		l_queue_destroy(pb_sessions, l_free);
+		pb_sessions = NULL;
+	}
 }

Signature · 1 line

2.25.4

[email protected]

2020-05-22 23:37 UTC #7 lore raw

RE: [BlueZ,v2,4/4] mesh: Destroy PB-ADV queue when provisioning done

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. While we are preparing for reviewing the patches, we found the following issue/warning.

Test Result:
checkgitlint Failed

Outputs:
3: B6 Body message is missing

---
Regards,
Linux Bluetooth

Gix, Brian

author

2020-05-25 14:15 UTC #8 lore raw

In reply to Brian Gix

Patchset Applied

Quoted 18 lines · Brian Gix

This patchset fixes static analysis identified issues in the mesh daemon.
v2: Clean-up PB-ADV queue
Brian Gix (4):
mesh: Fix using uninitialized bytes
mesh: Fix leaked mesh_net allocation
mesh: Fix leaked message reference
mesh: Destroy PB-ADV queue when provisioning done
 mesh/crypto.c  | 1 +
 mesh/manager.c | 3 ++-
 mesh/node.c    | 4 ++--
 mesh/pb-adv.c  | 5 +++++
 4 files changed, 10 insertions(+), 3 deletions(-)