Fix the callback crash

 - Add null check
 - Add invalid fd check
 - Add mainloop termination check

Change-Id: I3c7856aaf6143edf7e2229ccd594172d8c05e2f1

diff --git a/src/common/glib-glue.c b/src/common/glib-glue.c
index 630ec37ed91b166dc3dc721ccd87980ec1440627..ef6e6a89fe57986925692dfc7f7be011e6d74078 100644 (file)
--- a/src/common/glib-glue.c
+++ b/src/common/glib-glue.c
@@ -117,7 +117,7 @@ static glib_glue_t* glue_new()
 
 static glib_glue_t* glue_ref(glib_glue_t *glue)
 {
-    g_return_val_if_fail(glue != NULL, NULL);
+    g_return_val_if_fail(glue, NULL);
     g_return_val_if_fail(g_atomic_int_get(&glue->ref_count) > 0, NULL);
 
     g_atomic_int_inc(&glue->ref_count);
@@ -127,7 +127,7 @@ static glib_glue_t* glue_ref(glib_glue_t *glue)
 
 static void glue_unref(glib_glue_t *glue)
 {
-    g_return_if_fail(glue != NULL);
+    g_return_if_fail(glue);
     g_return_if_fail(g_atomic_int_get(&glue->ref_count) > 0);
 
     if (!g_atomic_int_dec_and_test(&glue->ref_count))
@@ -182,7 +182,7 @@ static gboolean io_cb(GIOChannel *ioc, GIOCondition cond, gpointer user_data)
 {
     io_t           *io     = (io_t *)user_data;
     glib_glue_t *glue = (glib_glue_t *)io->glue_data;
-    g_return_val_if_fail(glue_ref(glue) != NULL, FALSE);
+    g_return_val_if_fail(glue_ref(glue), FALSE);
     g_mutex_lock(&glue->glue_callback_lock);
     mrp_io_event_t  events = MRP_IO_EVENT_NONE;
     int             fd     = g_io_channel_unix_get_fd(ioc);
@@ -214,6 +214,8 @@ static void *add_io(void *glue_data, int fd, mrp_io_event_t events,
     io_t         *io;
     glib_glue_t *glue = (glib_glue_t *)glue_data;
 
+    g_return_val_if_fail(glue, NULL);
+
     g_mutex_lock(&glue->glue_internal_lock);
     ioc = g_io_channel_unix_new(fd);
 
@@ -259,6 +261,8 @@ static void del_io(void *glue_data, void *id)
     io_t *io = (io_t *)id;
     glib_glue_t *glue = (glib_glue_t *)glue_data;
 
+    g_return_if_fail(glue);
+
     g_mutex_lock(&glue->glue_internal_lock);
     remove_source(glue_data, io->gl_iow);
     g_io_channel_unref(io->gl_ioc);
@@ -269,9 +273,7 @@ static void del_io(void *glue_data, void *id)
 
 static gboolean timer_cb(gpointer user_data)
 {
-    if (user_data == NULL) {
-        return FALSE;
-    }
+    g_return_val_if_fail(user_data, FALSE);
 
     tmr_t *t = (tmr_t *)user_data;
     glib_glue_t *glue = (glib_glue_t *)t->glue_data;
@@ -299,6 +301,8 @@ static void *add_timer(void *glue_data, unsigned int msecs,
     tmr_t *t;
     glib_glue_t *glue = (glib_glue_t *)glue_data;
 
+    g_return_val_if_fail(glue, NULL);
+
     g_mutex_lock(&glue->glue_internal_lock);
     t = mrp_allocz(sizeof(*t));
 
@@ -327,6 +331,8 @@ static void del_timer(void *glue_data, void *id)
     tmr_t *t = (tmr_t *)id;
     glib_glue_t *glue = (glib_glue_t *)glue_data;
 
+    g_return_if_fail(glue);
+
     g_mutex_lock(&glue->glue_internal_lock);
     remove_source(glue_data, t->gl_t);
     mrp_free(t);
@@ -339,6 +345,8 @@ static void mod_timer(void *glue_data, void *id, unsigned int msecs)
     tmr_t  *t = (tmr_t *)id;
     glib_glue_t *glue = (glib_glue_t *)glue_data;
 
+    g_return_if_fail(glue);
+
     g_mutex_lock(&glue->glue_internal_lock);
     if (t != NULL) {
         remove_source(glue_data, t->gl_t);
@@ -350,13 +358,11 @@ static void mod_timer(void *glue_data, void *id, unsigned int msecs)
 
 static gboolean defer_cb(void *user_data)
 {
-    if (user_data == NULL) {
-        return FALSE;
-    }
+    g_return_val_if_fail(user_data, FALSE);
 
     dfr_t *d = (dfr_t *)user_data;
     glib_glue_t *glue = (glib_glue_t *)d->glue_data;
-    g_return_val_if_fail(glue_ref(glue) != NULL, FALSE);
+    g_return_val_if_fail(glue_ref(glue), FALSE);
     g_mutex_lock(&glue->glue_callback_lock);
 
     if (d->cb == NULL) {
@@ -380,6 +386,8 @@ static void *add_defer(void *glue_data,
     dfr_t *d;
     glib_glue_t *glue = (glib_glue_t *)glue_data;
 
+    g_return_if_fail(glue);
+
     g_mutex_lock(&glue->glue_internal_lock);
     d = mrp_allocz(sizeof(*d));
 
@@ -408,6 +416,9 @@ static void del_defer(void *glue_data, void *id)
     dfr_t *d = (dfr_t *)id;
     glib_glue_t *glue = (glib_glue_t *)glue_data;
 
+    g_return_if_fail(d);
+    g_return_if_fail(glue);
+
     g_mutex_lock(&glue->glue_internal_lock);
     if (d->gl_t != 0)
         remove_source(glue_data, d->gl_t);
@@ -422,9 +433,8 @@ static void mod_defer(void *glue_data, void *id, int enabled)
     dfr_t *d = (dfr_t *)id;
     glib_glue_t *glue = (glib_glue_t *)glue_data;
 
-    if (d == NULL) {
-        return;
-    }
+    g_return_if_fail(d);
+    g_return_if_fail(glue);
 
     g_mutex_lock(&glue->glue_internal_lock);
     if (enabled && !d->gl_t) {
@@ -442,6 +452,7 @@ static void unregister(void *data)
 {
     glib_glue_t *glue = (glib_glue_t *)data;
     GMainContext *def_ctx = g_main_context_default();
+    g_return_if_fail(glue);
     GMainContext *loop_ctx = g_main_loop_get_context(glue->gml);
     g_mutex_lock(&glue->glue_internal_lock);
     if (loop_ctx && def_ctx != loop_ctx) {
@@ -486,6 +497,7 @@ static gpointer
 thread_main (gpointer data)
 {
     glib_glue_t *glue = (glib_glue_t *)data;
+    g_return_if_fail(glue);
     GMainContext *thread_main_context = g_main_loop_get_context(glue->gml);
 
     /* Set up the thread’s context and run it. */

diff --git a/src/common/mainloop.c b/src/common/mainloop.c
index 950c5819942a6c4e4643ec03f4d6fa68b89b185e..72bc15a195d6e710039cf7c393e510f604110116 100644 (file)
--- a/src/common/mainloop.c
+++ b/src/common/mainloop.c
@@ -37,6 +37,7 @@
 #include <sys/signalfd.h>
 #include <sys/socket.h>
 #include <pthread.h>
+#include <fcntl.h>
 
 #include <murphy/common/macros.h>
 #include <murphy/common/mm.h>
@@ -366,7 +367,7 @@ static void fdtbl_destroy(fdtbl_t *ft)
 
 static void *fdtbl_lookup(fdtbl_t *ft, int fd)
 {
-    if (fd >= 0 && ft != NULL) {
+    if (fd >= 0 && (fcntl(fd, F_GETFL) != -1 || errno != EBADF) && ft != NULL) {
         if (fd < FDTBL_SIZE)
             return ft->t[fd];
         else
@@ -1549,6 +1550,9 @@ static void purge_deleted(mrp_mainloop_t *ml)
     mrp_list_hook_t *p, *n;
     deleted_t       *d;
 
+    if (ml->quit)
+        return;
+
     mrp_list_foreach(&ml->deleted, p, n) {
         d = mrp_list_entry(p, typeof(*d), deleted);
         mrp_list_delete(&d->deleted);