Skip to content

Fix gatt-db munmap_chunk invalid pointer

Frédéric Danis linux-bluetooth 4 versions – In review

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v4 Latest2 patches 1 replyIn review
  2. v31 patch 3 repliesSuperseded
  3. v21 patch 1 replySuperseded
Earlier versions · 1
VersionPostedPatchesRepliesStatus
v11 patch3 repliesSuperseded

Patches in v4 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/2shared/gatt-db: Fix munmap_chunk invalid pointersrc/shared/gatt-db.c+10 -91 reply
2/2unit/test-gatt: Add unordered setup db testunit/test-gatt.c+72 -10 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v4 yet.

Read the v4 thread

Cover letter [PATCH v4 0/2] Fix gatt-db munmap_chunk invalid pointer

PTS test GATT/CL/GAD/BV-03-C published a service starting at handle 0xfffd and ending at 0xffff.
This resets the next_handle to 0 in gatt_db_insert_service() instead of setting it to 0x10000. Other services are added later.
This could end-up by a crash in db_hash_update() if not enough space has been allocated for hash.iov and some entries are overwritten.

Next_handle can be replaced by a last_handle variable which will not loop over. This can be replaced by queue_peek_tail() and computing the value, but keeping last_handle will avoid this sort of lookup.

Add a unit test to check regression.

v1 -> v2: Replace next_handle by last_handle
Check empty db using gatt_db_isempty(db) instead of
next_handle == 0
Add robustness unit test to check that gatt_db_get_hash()
doesn't crash
v2 -> v3: Fix line length checkpatch errors
v3 -> v4: Update commit comment to explain reason for keeping last_handle
Split unit test to its own commit
Rephrase db setup comment in unit test

Frédéric Danis (2):
shared/gatt-db: Fix munmap_chunk invalid pointer unit/test-gatt: Add unordered setup db test

 src/shared/gatt-db.c | 19 ++++++------
 unit/test-gatt.c     | 73 +++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 82 insertions(+), 10 deletions(-)
Signature · 1 line
2.34.1