Fix asan issue of heap-use-after-free

 - Module released by _ms_ipc_module_cleanup() could be used again in ms_ipc_create_data_dispatch_worker
 - Put into protected critical section for ms_ipc_create_data_dispatch_worker()
 - Update dlog for debugging module handle

Change-Id: Idcbb2efa5ab10a176128d0254613cac6cb85c2dc

diff --git a/packaging/mused.spec b/packaging/mused.spec
index 78a82ee0bd31552d8a603bd4414d2f3a29175b60..1b350167b0e01164ccecadf466b41528802bd7a8 100644 (file)
--- a/packaging/mused.spec
+++ b/packaging/mused.spec
@@ -1,6 +1,6 @@
 Name:       mused
 Summary:    A multimedia daemon
-Version:    0.3.152
+Version:    0.3.153
 Release:    0
 Group:      System/Libraries
 License:    Apache-2.0

diff --git a/server/src/muse_server_ipc.c b/server/src/muse_server_ipc.c
index 1ff6e05846537659d1975d0f35e2d7ec843a8e64..6723c4c0de36e01297028a4e2bf82264644cff2f 100644 (file)
--- a/server/src/muse_server_ipc.c
+++ b/server/src/muse_server_ipc.c
@@ -421,7 +421,7 @@ gboolean ms_ipc_create_msg_dispatch_worker(muse_module_h m)
        GError *error = NULL;
        muse_server_h ms = ms_get_instance();
 
-       LOGD("Enter");
+       LOGD("Enter %p", m);
 
        muse_return_val_if_fail(ms, FALSE);
        muse_return_val_if_fail(ms_is_server_ready(), FALSE);
@@ -446,13 +446,19 @@ gboolean ms_ipc_create_data_dispatch_worker(muse_module_h m)
 {
        GError *error = NULL;
        muse_server_h ms = ms_get_instance();
+       ms_connection_t *connection = NULL;
 
-       LOGD("Enter");
+       LOGD("Enter %p", m);
 
        muse_return_val_if_fail(ms, FALSE);
        muse_return_val_if_fail(ms_is_server_ready(), FALSE);
        muse_return_val_if_fail(muse_server_module_is_valid(m), TRUE);
 
+       connection = ms->connection;
+       muse_return_val_if_fail(connection, FALSE);
+
+       ms_connection_lock(connection);
+
        m->ch[MUSE_CHANNEL_DATA].thread = g_thread_try_new(DATA_THREAD_NAME, _ms_ipc_data_worker, (gpointer)m, &error);
        if (!m->ch[MUSE_CHANNEL_DATA].thread) {
                LOGE("thread creation failed : %s", error->message);
@@ -460,10 +466,13 @@ gboolean ms_ipc_create_data_dispatch_worker(muse_module_h m)
                ms_log_process_info(ms->pid);
                ms_cmd_dispatch(m, MUSE_MODULE_COMMAND_RESOURCE_NOT_AVAILABLE);
                muse_core_connection_close(m->ch[MUSE_CHANNEL_MSG].sock_fd);
+               ms_connection_unlock(connection);
+               return FALSE;
        }
 
-       muse_return_val_if_fail(m->ch[MUSE_CHANNEL_DATA].thread, FALSE);
+       LOGD("Leave %p", m);
+
+       ms_connection_unlock(connection);
 
-       LOGD("Leave");
        return TRUE;
 }