Commit 79aa0156 authored by Kyle Horimoto's avatar Kyle Horimoto Committed by Commit Bot

[CrOS MultiDevice] Re-land crash fix for BleConnectionManagerImpl.

Originally landed as:
https://chromium-review.googlesource.com/c/1352855
Reverted as:
https://chromium-review.googlesource.com/c/chromium/src/+/1354327

First patch set includes original CL, and subsequent patches contain
updates to fix the failing test.

Original CL descrition:

When a SecureChannel disconnects due to authentication failures,
BleConnectionManagerImpl invokes the relevant failure callback, which
then causes ConnectionAttemptBase to cancel the connection attempt.

When the attempt is cancelled, the SecureChannel object is deleted via
BleConnectionManagerImpl::ProcessPotentialLingeringChannel(), but
BleConnectionManagerImpl::HandleSecureChannelDisconnection() assumed
that the object was still valid and tried to to remove itself as an
observer, causing a segfault.

The fix is to check whether the object has been deleted before
attempting to call RemoveObserver().

Bug: 905904, 909883
Change-Id: I770bff8f05865aeac8b7513d7193d0b7a40d056e
Reviewed-on: https://chromium-review.googlesource.com/c/1354333Reviewed-by: default avatarRyan Hansberry <hansberry@chromium.org>
Commit-Queue: Kyle Horimoto <khorimoto@chromium.org>
Cr-Commit-Position: refs/heads/master@{#611937}
parent 235834ce
......@@ -503,6 +503,15 @@ void BleConnectionManagerImpl::HandleSecureChannelDisconnection(
// connection's latency should be reset and started anew.
remote_device_id_to_timestamps_map_[remote_device_id]->Reset();
if (!DoesAuthenticatingChannelExist(remote_device_id)) {
PA_LOG(ERROR) << "BleConnectionManagerImpl::"
<< "HandleSecureChannelDisconnection(): Disconnected channel "
<< "not present in map. Remote device ID: "
<< cryptauth::RemoteDeviceRef::TruncateDeviceIdForLogs(
remote_device_id);
NOTREACHED();
}
for (const auto& details : GetDetailsForRemoteDevice(remote_device_id)) {
switch (details.connection_role()) {
// Initiator role devices are notified of authentication errors as well as
......@@ -525,10 +534,19 @@ void BleConnectionManagerImpl::HandleSecureChannelDisconnection(
}
}
// It is possible that the NotifyBle*Failure() calls above resulted in
// observers responding to the failure by canceling the connection attempt.
// If all attempts to |remote_device_id| were cancelled, the disconnected
// channel will have already been cleaned up via
// ProcessPotentialLingeringChannel().
auto it = remote_device_id_to_secure_channel_map_.find(remote_device_id);
if (it == remote_device_id_to_secure_channel_map_.end())
return;
// Stop observing the disconnected channel and remove it from the map.
remote_device_id_to_secure_channel_map_[remote_device_id]
.first->RemoveObserver(this);
remote_device_id_to_secure_channel_map_.erase(remote_device_id);
SecureChannelWithRole& secure_channel_with_role = it->second;
secure_channel_with_role.first->RemoveObserver(this);
remote_device_id_to_secure_channel_map_.erase(it);
// Since the previous connection failed, the connection attempts that were
// paused in SetAuthenticatingChannel() need to be started up again. Note
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment