[PATCH 1/2] peer: Append Peer Service content according to the signature

[Tomasz Bursztyka]

This fixes this issue:

connmand[14481]: src/peer.c:append_existing_and_new_peers() new
/net/connman/peer/peer_106f3f7a6c37_8ac9d0c0da67
process 14481: Writing an element of type array, but the expected type
here is struct
The overall signature expected here was '' and we are on byte 175 of
that signature.
File "../../dbus/dbus-marshal-recursive.c" line 1675 process 14481
should not have been reached: bad array element or variant content
written
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x48ced) [0x7ffff78a3ced]
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x4cae9) [0x7ffff78a7ae9]
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x3ae6f) [0x7ffff7895e6f]
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x1eec0) [0x7ffff7879ec0]
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x1f254) [0x7ffff787a254]
/lib/x86_64-linux-gnu/libdbus-1.so.3(dbus_message_iter_open_container+0x348)
[0x7ffff7880bc8]
/home/jku/src/connman/src/connmand() [0x48039c]
/home/jku/src/connman/src/connmand(connman_dbus_property_append_array+0x9f)
[0x4672df]
/home/jku/src/connman/src/connmand() [0x480889]
/home/jku/src/connman/src/connmand() [0x48092a]
/home/jku/src/connman/src/connmand() [0x480994]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_hash_table_foreach+0x60)
[0x7ffff7b06240]
/home/jku/src/connman/src/connmand() [0x4677b2]
/home/jku/src/connman/src/connmand() [0x480446]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(+0x4a613) [0x7ffff7b17613]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_dispatch+0x15d)
[0x7ffff7b16b6d]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(+0x49f48) [0x7ffff7b16f48]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_loop_run+0xc2) [0x7ffff7b17272]
/home/jku/src/connman/src/connmand() [0x40feaa]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7ffff6985b45]
/home/jku/src/connman/src/connmand() [0x41012a]

Program received signal SIGABRT, Aborted.
0x00007ffff6999077 in __GI_raise (sig=***@entry=6)
at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007ffff6999077 in __GI_raise (sig=***@entry=6)
at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007ffff699a458 in __GI_abort () at abort.c:89
#2 0x00007ffff78a7b04 in _dbus_abort () at ../../dbus/dbus-sysdeps.c:91
#3 0x00007ffff7895e6f in _dbus_real_assert_not_reached (
explanation=***@entry=0x7ffff78af988 "bad array element or
variant content written",
file=***@entry=0x7ffff78af1e8 "../../dbus/dbus-marshal-recursive.c",
line=***@entry=1675) at ../../dbus/dbus-internals.c:943
#4 0x00007ffff7879ec0 in writer_recurse_init_and_check (sub=0x7fffffffde70,
container_type=97, writer=<optimized out>)
at ../../dbus/dbus-marshal-recursive.c:1675
#5 _dbus_type_writer_recurse_contained_len (
writer=***@entry=0x7fffffffdf40,
container_type=***@entry=97,
contained_type=***@entry=0x7fffffffde00,
contained_type_start=***@entry=0,
contained_type_len=<optimized out>, sub=***@entry=0x7fffffffde70,
is_array_append=0) at ../../dbus/dbus-marshal-recursive.c:2060
#6 0x00007ffff787a254 in _dbus_type_writer_recurse (
writer=***@entry=0x7fffffffdf40,
container_type=***@entry=97,
contained_type=***@entry=0x7fffffffde00,
contained_type_start=***@entry=0,
sub=***@entry=0x7fffffffde70) at ../../dbus/dbus-marshal-recursive.c:2119
#7 0x00007ffff7880bc8 in dbus_message_iter_open_container (
iter=***@entry=0x7fffffffdf30, type=***@entry=97,
contained_signature=***@entry=0x48efe7 "{sv}",
sub=***@entry=0x7fffffffde60) at ../../dbus/dbus-message.c:2889
#8 0x000000000048039c in connman_dbus_dict_open (dict=0x7fffffffde60,
iter=0x7fffffffdf30) at ./include/connman/dbus.h:94
#9 append_peer_services (iter=***@entry=0x7fffffffdf30,
user_data=***@entry=0x71ddd0) at src/peer.c:300
#10 0x00000000004672df in connman_dbus_property_append_array (
iter=***@entry=0x7fffffffe010, key=***@entry=0x493973 "Services",
type=***@entry=101,
function=***@entry=0x480350 <append_peer_services>,
user_data=***@entry=0x71ddd0) at src/dbus.c:224
#11 0x0000000000480889 in connman_dbus_dict_append_array (
key=0x493973 "Services", type=101,
function=0x480350 <append_peer_services>, user_data=0x71ddd0,
dict=0x7fffffffdfc0) at ./include/connman/dbus.h:156
#12 append_properties (iter=***@entry=0x7fffffffe080,
peer=***@entry=0x71ddd0) at src/peer.c:328
#13 0x000000000048092a in append_peer_struct (key=***@entry=0x7137d0,
value=***@entry=0x71ddd0, user_data=***@entry=0x7fffffffe240)
at src/peer.c:372
#14 0x0000000000480994 in append_existing_and_new_peers (key=0x7137d0,
value=0x71ddd0, user_data=0x7fffffffe240) at src/peer.c:402
#15 0x00007ffff7b06240 in g_hash_table_foreach (hash_table=0x6f1a40,
func=0x480940 <append_existing_and_new_peers>, user_data=0x7fffffffe240)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/ghash.c:1550
#16 0x00000000004677b2 in __connman_dbus_append_objpath_dict_array (
msg=***@entry=0x706190,
function=***@entry=0x4804e0 <peer_append_all>,
user_data=***@entry=0x0) at src/dbus.c:404
#17 0x0000000000480446 in peer_send_changed (
data=<error reading variable: value has been optimized out>)
at src/peer.c:450
#18 0x00007ffff7b17613 in g_timeout_dispatch (source=0x719290,
callback=<optimized out>, user_data=<optimized out>)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:4520
#19 0x00007ffff7b16b6d in g_main_dispatch (context=0x6ef540)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:3111
#20 g_main_context_dispatch (context=***@entry=0x6ef540)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:3710
#21 0x00007ffff7b16f48 in g_main_context_iterate (context=0x6ef540,
block=***@entry=1, dispatch=***@entry=1, self=<optimized out>)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:3781
#22 0x00007ffff7b17272 in g_main_loop_run (loop=0x6d3220)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:3975
#23 0x000000000040feaa in main (argc=1, argv=0x7fffffffe598)
at src/main.c:689

Reported-by: Jussi Kukkonen <***@intel.com>
---
src/peer.c | 44 ++++++++++++++++++++++++++++++--------------
1 file changed, 30 insertions(+), 14 deletions(-)

diff --git a/src/peer.c b/src/peer.c
index 5dddd4e..8e99e6a 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -288,28 +288,44 @@ static void append_ipv4(DBusMessageIter *iter, void *user_data)
__connman_ipconfig_append_ipv4(peer->ipconfig, iter);
}

+static void append_peer_service(DBusMessageIter *iter,
+ struct _peer_service *service)
+{
+ DBusMessageIter dict;
+
+ connman_dbus_dict_open(iter, &dict);
+
+ switch (service->type) {
+ case CONNMAN_PEER_SERVICE_UNKNOWN:
+ /* Should never happen */
+ break;
+ case CONNMAN_PEER_SERVICE_WIFI_DISPLAY:
+ connman_dbus_property_append_fixed_array(&dict,
+ "WiFiDisplayIEs", DBUS_TYPE_BYTE,
+ &service->data, service->length);
+ break;
+ }
+
+ connman_dbus_dict_close(iter, &dict);
+}
+
static void append_peer_services(DBusMessageIter *iter, void *user_data)
{
struct connman_peer *peer = user_data;
DBusMessageIter dict;
GSList *list;

- for (list = peer->services; list; list = list->next) {
- struct _peer_service *service = list->data;
-
+ if (!peer->services) {
connman_dbus_dict_open(iter, &dict);
-
- switch (service->type) {
- case CONNMAN_PEER_SERVICE_UNKNOWN:
- /* Should never happen */
- break;
- case CONNMAN_PEER_SERVICE_WIFI_DISPLAY:
- connman_dbus_property_append_fixed_array(&dict,
- "WiFiDisplayIEs", DBUS_TYPE_BYTE,
- &service->data, service->length);
- break;
- }
connman_dbus_dict_close(iter, &dict);
+ return;
+ }
+
+ for (list = peer->services; list; list = list->next) {
+ dbus_message_iter_open_container(iter, DBUS_TYPE_STRUCT,
+ NULL, &dict);
+ append_peer_service(&dict, list->data);
+ dbus_message_iter_close_container(iter, &dict);
}
}

[Tomasz Bursztyka]

From: Jussi Kukkonen <***@goto.fi>

It requires to be inserted into a dict entry.
---
src/peer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/peer.c b/src/peer.c
index 8e99e6a..285c174 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -300,7 +300,7 @@ static void append_peer_service(DBusMessageIter *iter,
/* Should never happen */
break;
case CONNMAN_PEER_SERVICE_WIFI_DISPLAY:
- connman_dbus_property_append_fixed_array(&dict,
+ connman_dbus_dict_append_fixed_array(&dict,
"WiFiDisplayIEs", DBUS_TYPE_BYTE,
&service->data, service->length);
break;

[Tomasz Bursztyka]

This fixes this issue:

connmand[14481]: src/peer.c:append_existing_and_new_peers() new
/net/connman/peer/peer_106f3f7a6c37_8ac9d0c0da67
process 14481: Writing an element of type array, but the expected type
here is struct
The overall signature expected here was '' and we are on byte 175 of
that signature.
File "../../dbus/dbus-marshal-recursive.c" line 1675 process 14481
should not have been reached: bad array element or variant content
written
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x48ced) [0x7ffff78a3ced]
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x4cae9) [0x7ffff78a7ae9]
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x3ae6f) [0x7ffff7895e6f]
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x1eec0) [0x7ffff7879ec0]
/lib/x86_64-linux-gnu/libdbus-1.so.3(+0x1f254) [0x7ffff787a254]
/lib/x86_64-linux-gnu/libdbus-1.so.3(dbus_message_iter_open_container+0x348)
[0x7ffff7880bc8]
/home/jku/src/connman/src/connmand() [0x48039c]
/home/jku/src/connman/src/connmand(connman_dbus_property_append_array+0x9f)
[0x4672df]
/home/jku/src/connman/src/connmand() [0x480889]
/home/jku/src/connman/src/connmand() [0x48092a]
/home/jku/src/connman/src/connmand() [0x480994]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_hash_table_foreach+0x60)
[0x7ffff7b06240]
/home/jku/src/connman/src/connmand() [0x4677b2]
/home/jku/src/connman/src/connmand() [0x480446]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(+0x4a613) [0x7ffff7b17613]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_dispatch+0x15d)
[0x7ffff7b16b6d]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(+0x49f48) [0x7ffff7b16f48]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_loop_run+0xc2) [0x7ffff7b17272]
/home/jku/src/connman/src/connmand() [0x40feaa]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7ffff6985b45]
/home/jku/src/connman/src/connmand() [0x41012a]

Program received signal SIGABRT, Aborted.
0x00007ffff6999077 in __GI_raise (sig=***@entry=6)
at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007ffff6999077 in __GI_raise (sig=***@entry=6)
at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007ffff699a458 in __GI_abort () at abort.c:89
#2 0x00007ffff78a7b04 in _dbus_abort () at ../../dbus/dbus-sysdeps.c:91
#3 0x00007ffff7895e6f in _dbus_real_assert_not_reached (
explanation=***@entry=0x7ffff78af988 "bad array element or
variant content written",
file=***@entry=0x7ffff78af1e8 "../../dbus/dbus-marshal-recursive.c",
line=***@entry=1675) at ../../dbus/dbus-internals.c:943
#4 0x00007ffff7879ec0 in writer_recurse_init_and_check (sub=0x7fffffffde70,
container_type=97, writer=<optimized out>)
at ../../dbus/dbus-marshal-recursive.c:1675
#5 _dbus_type_writer_recurse_contained_len (
writer=***@entry=0x7fffffffdf40,
container_type=***@entry=97,
contained_type=***@entry=0x7fffffffde00,
contained_type_start=***@entry=0,
contained_type_len=<optimized out>, sub=***@entry=0x7fffffffde70,
is_array_append=0) at ../../dbus/dbus-marshal-recursive.c:2060
#6 0x00007ffff787a254 in _dbus_type_writer_recurse (
writer=***@entry=0x7fffffffdf40,
container_type=***@entry=97,
contained_type=***@entry=0x7fffffffde00,
contained_type_start=***@entry=0,
sub=***@entry=0x7fffffffde70) at ../../dbus/dbus-marshal-recursive.c:2119
#7 0x00007ffff7880bc8 in dbus_message_iter_open_container (
iter=***@entry=0x7fffffffdf30, type=***@entry=97,
contained_signature=***@entry=0x48efe7 "{sv}",
sub=***@entry=0x7fffffffde60) at ../../dbus/dbus-message.c:2889
#8 0x000000000048039c in connman_dbus_dict_open (dict=0x7fffffffde60,
iter=0x7fffffffdf30) at ./include/connman/dbus.h:94
#9 append_peer_services (iter=***@entry=0x7fffffffdf30,
user_data=***@entry=0x71ddd0) at src/peer.c:300
#10 0x00000000004672df in connman_dbus_property_append_array (
iter=***@entry=0x7fffffffe010, key=***@entry=0x493973 "Services",
type=***@entry=101,
function=***@entry=0x480350 <append_peer_services>,
user_data=***@entry=0x71ddd0) at src/dbus.c:224
#11 0x0000000000480889 in connman_dbus_dict_append_array (
key=0x493973 "Services", type=101,
function=0x480350 <append_peer_services>, user_data=0x71ddd0,
dict=0x7fffffffdfc0) at ./include/connman/dbus.h:156
#12 append_properties (iter=***@entry=0x7fffffffe080,
peer=***@entry=0x71ddd0) at src/peer.c:328
#13 0x000000000048092a in append_peer_struct (key=***@entry=0x7137d0,
value=***@entry=0x71ddd0, user_data=***@entry=0x7fffffffe240)
at src/peer.c:372
#14 0x0000000000480994 in append_existing_and_new_peers (key=0x7137d0,
value=0x71ddd0, user_data=0x7fffffffe240) at src/peer.c:402
#15 0x00007ffff7b06240 in g_hash_table_foreach (hash_table=0x6f1a40,
func=0x480940 <append_existing_and_new_peers>, user_data=0x7fffffffe240)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/ghash.c:1550
#16 0x00000000004677b2 in __connman_dbus_append_objpath_dict_array (
msg=***@entry=0x706190,
function=***@entry=0x4804e0 <peer_append_all>,
user_data=***@entry=0x0) at src/dbus.c:404
#17 0x0000000000480446 in peer_send_changed (
data=<error reading variable: value has been optimized out>)
at src/peer.c:450
#18 0x00007ffff7b17613 in g_timeout_dispatch (source=0x719290,
callback=<optimized out>, user_data=<optimized out>)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:4520
#19 0x00007ffff7b16b6d in g_main_dispatch (context=0x6ef540)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:3111
#20 g_main_context_dispatch (context=***@entry=0x6ef540)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:3710
#21 0x00007ffff7b16f48 in g_main_context_iterate (context=0x6ef540,
block=***@entry=1, dispatch=***@entry=1, self=<optimized out>)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:3781
#22 0x00007ffff7b17272 in g_main_loop_run (loop=0x6d3220)
at /build/glib2.0-dt6trg/glib2.0-2.42.0/./glib/gmain.c:3975
#23 0x000000000040feaa in main (argc=1, argv=0x7fffffffe598)
at src/main.c:689

Reported-by: Jussi Kukkonen <***@intel.com>
---
src/peer.c | 48 +++++++++++++++++++++++++++++++++---------------
1 file changed, 33 insertions(+), 15 deletions(-)

diff --git a/src/peer.c b/src/peer.c
index 5dddd4e..564d089 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -288,29 +288,47 @@ static void append_ipv4(DBusMessageIter *iter, void *user_data)
__connman_ipconfig_append_ipv4(peer->ipconfig, iter);
}

+static void append_peer_service(DBusMessageIter *iter,
+ struct _peer_service *service)
+{
+ DBusMessageIter dict;
+
+ connman_dbus_dict_open(iter, &dict);
+
+ switch (service->type) {
+ case CONNMAN_PEER_SERVICE_UNKNOWN:
+ /* Should never happen */
+ break;
+ case CONNMAN_PEER_SERVICE_WIFI_DISPLAY:
+ connman_dbus_property_append_fixed_array(&dict,
+ "WiFiDisplayIEs", DBUS_TYPE_BYTE,
+ &service->data, service->length);
+ break;
+ }
+
+ connman_dbus_dict_close(iter, &dict);
+}
+
static void append_peer_services(DBusMessageIter *iter, void *user_data)
{
struct connman_peer *peer = user_data;
- DBusMessageIter dict;
+ DBusMessageIter container;
GSList *list;

- for (list = peer->services; list; list = list->next) {
- struct _peer_service *service = list->data;
+ dbus_message_iter_open_container(iter, DBUS_TYPE_STRUCT,
+ NULL, &container);

- connman_dbus_dict_open(iter, &dict);
+ if (!peer->services) {
+ DBusMessageIter dict;

- switch (service->type) {
- case CONNMAN_PEER_SERVICE_UNKNOWN:
- /* Should never happen */
- break;
- case CONNMAN_PEER_SERVICE_WIFI_DISPLAY:
- connman_dbus_property_append_fixed_array(&dict,
- "WiFiDisplayIEs", DBUS_TYPE_BYTE,
- &service->data, service->length);
- break;
- }
- connman_dbus_dict_close(iter, &dict);
+ connman_dbus_dict_open(&container, &dict);
+ connman_dbus_dict_close(&container, &dict);
+ } else {
+ for (list = peer->services; list; list = list->next)
+ append_peer_service(&container, list->data);
}
+
+ dbus_message_iter_close_container(iter, &container);
}

static void append_properties(DBusMessageIter *iter, struct connman_peer *peer)

[Tomasz Bursztyka]

From: Jussi Kukkonen <***@goto.fi>

It requires to be inserted into a dict entry.
---
src/peer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/peer.c b/src/peer.c
index 564d089..caff70c 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -300,7 +300,7 @@ static void append_peer_service(DBusMessageIter *iter,
/* Should never happen */
break;
case CONNMAN_PEER_SERVICE_WIFI_DISPLAY:
- connman_dbus_property_append_fixed_array(&dict,
+ connman_dbus_dict_append_fixed_array(&dict,
"WiFiDisplayIEs", DBUS_TYPE_BYTE,
&service->data, service->length);
break;

[Patrik Flykt]

DBus content was not matching its signature.
peer: Use correct helper function to append WiFiDisplayIEs
peer: Append Peer Service content according to the signature

What changed in v2?

Patrik

[Tomasz Bursztyka]

Post by Patrik Flykt
What changed in v2?

Sorry: patch 1/2, the struct container is always opened, even when there
will be no peer service appended to the array.

Tomasz

[Patrik Flykt]

DBus content was not matching its signature.
peer: Use correct helper function to append WiFiDisplayIEs
peer: Append Peer Service content according to the signature

Applied both patches, thanks!

Patrik