Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Methods of reproducing: in loop 1) connmanctl tether wifi on my_ssid my_pasword 2) conencting client 3) connmanctl tether wifi off con[14819.539062] tether: port 1(wlan0) entered disabled state nmand2[3831]: ../git/src/technology.c:set_property() property Tethering connmand2[3831]: ../git/plugins/wifi.c:tech_set_tethering() connmand2[3831]: ../git/src/technology.c:connman_technology_tethering_notify() technology 0xb57006e0 enabled 0 connmand2[3831]: ../git/src/tethering.c:__connman_tethering_set_disabled() enabled 0 ================================================================= ==3831==ERROR: AddressSanitizer: heap-use-after-free on address 0xb490c370 at pc 0x41c2e9c0 bp 0xbedf7494 sp 0xbedf7060 READ of size 2 at 0xb490c370 thread T0 #0 0x41c2e9bf (/usr/lib/libasan.so.5+0x41c2e9bf) 0xb490c370 is located 0 bytes inside of 18-byte region [0xb490c370,0xb490c382) freed by thread T0 here: #0 0x41c73ee7 in free (/usr/lib/libasan.so.5+0x41c73ee7) #1 0x42877473 (/usr/lib/libglib-2.0.so.0+0x42877473) previously allocated by thread T0 here: #0 0x41c7421b in malloc (/usr/lib/libasan.so.5+0x41c7421b) #1 0x42890b8b in g_malloc (/usr/lib/libglib-2.0.so.0+0x42890b8b) sailfishos#2 0x9d3a7 in sta_authorized ../git/plugins/wifi.c:3004 sailfishos#3 0xa79eb in callback_sta_authorized ../git/gsupplicant/supplicant.c:626 sailfishos#4 0xc3dd7 in signal_sta_authorized ../git/gsupplicant/supplicant.c:2779 sailfishos#5 0xceb2f in g_supplicant_filter ../git/gsupplicant/supplicant.c:3620 sailfishos#6 0x419fb123 in dbus_connection_dispatch (/usr/lib/libdbus-1.so.3+0x419fb123) sailfishos#7 0xb2501d17 (<unknown module>) SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib/libasan.so.5+0x41c2e9bf) Shadow bytes around the buggy address: 0x36921810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36921820: fa fa fa fa fa fa fa fa fa fa fa fa fd fd fd fd 0x36921830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36921840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36921850: fa fa fa fa fa fa 00 00 00 fa fa fa fa fa fa fa =>0x36921860: fa fa 00 00 00 00 fa fa fa fa fa fa fa fa[fd]fd 0x36921870: fd fa fa fa 00 00 00 00 fa fa fa fa fa fa fa fa 0x36921880: fa fa fa fa fa fa 00 00 00 04 fa fa fa fa fa fa 0x36921890: fa fa fa fa fa fa fa fa fd fd fd fd fa fa fa fa 0x369218a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x369218b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3831==ABORTING (cherry picked from commit 799334d)
- Loading branch information