Fix null-deref crash in OnSessionEstablishmentError. #14654
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pullapprove
bot
requested review from
andy31415,
anush-apple,
austinh0,
balducci-apple,
Byungjoo-Lee,
carol-apple,
chrisdecenzo,
chshu,
chulspro,
Damian-Nordic,
dhrishi,
electrocucaracha,
erjiaqing,
franck-apple,
gjc13,
harimau-qirex,
hawk248,
isiu-apple,
jelderton,
jepenven-silabs,
jmartinez-silabs,
LuDuda,
lzgrablic02,
mlepage-google,
mrjerryjohns,
msandstedt and
sagar-apple
pullapprove
bot
requested review from
saurabhst,
selissia,
tcarmelveilleux,
tecimovic,
vijs,
vivien-apple,
wbschiller,
woody-apple,
xylophone21,
yufengwangca and
yunhanw-google
|
Why aren't we using |
|
PR #14654: Size comparison from 9de9890 to f7b0e7a Increases (2 builds for linux)
Decreases (34 builds for cyw30739, efr32, k32w, linux, mbed, nrfconnect, p6, qpg)
Full report (41 builds for cyw30739, efr32, k32w, linux, mbed, nrfconnect, p6, qpg, telink)
|
Damian-Nordic
approved these changes
Feb 1, 2022
There was a problem hiding this comment.
Approving the fix, but note that on a BLE peripheral closing a BLE endpoint doesn't automatically drops the BLE connection (don't know what's the reason, but see the code:
connectedhomeip/src/ble/BLEEndPoint.cpp
Line 469 in cb9b046
BLEManagerImpl::NotifyChipConnectionClosed which is not implemented by most platforms (I just added an implementation for Zephyr yesterday).
tcarmelveilleux
approved these changes
Feb 1, 2022
Because this code doesn't really have a connection object around.... I could try to figure out where it could get one, if you prefer. |
Indeed, that is a problem the old code had too. |
It's fine. This is better than crashing. |
msandstedt
approved these changes
Feb 1, 2022
Never mind. I was thinking of CancelBleIncompleteConnection. |
We ended up crashing because mServer->getBleLayerObject()->mBleEndPoint was null. The changes mostly remove the changes from project-chip#9845 because those changes made us try to close some random "whatever last BLE endpoint was created", even if it's already closed or has nothing to do with our PASE session. So instead, just do the same thing as we do for CASE establishment and tear down all BLE sessions, if we need to tear down anything at all. The remaining changes are making ReleaseBleConnection private again and removing the broken mBleEndPoint member from BleLayer.
bzbarsky-apple
force-pushed
the
ble-null-deref
branch
from
f7b0e7a to
49e55f4
Compare
|
PR #14654: Size comparison from 8bb93af to 49e55f4 Increases (3 builds for esp32, linux)
Decreases (34 builds for cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, qpg)
Full report (43 builds for cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, qpg, telink)
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We ended up crashing because
mServer->getBleLayerObject()->mBleEndPoint was null.
The changes mostly remove the changes from #9845 because those changes
made us try to close some random "whatever last BLE endpoint was
created", even if it's already closed or has nothing to do with our
PASE session.
So instead, just do the same thing as we do for CASE establishment and
tear down all BLE sessions, if we need to tear down anything at all.
The remaining changes are making ReleaseBleConnection private again
and removing the broken mBleEndPoint member from BleLayer.
Problem
See above.
Change overview
See above.
Testing
Not entirely sure how to test this. #9845 did not have clear test steps.... @sweetymhaiske