SymbX/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

quectel: fix UAF in RDY URC handler

Browse Source 
Defer the validity change (which triggers modem reprobe/removal) to an
idle callback in rdy_handler().

Calling mm_base_modem_set_valid(FALSE) synchronously from the URC
handler triggers the immediate destruction of the modem object while the
serial port is still iterating the unsolicited message handlers. Deferring
the operation to an idle callback and taking a reference to the modem
ensures the modem object is kept alive until parse_unsolicited() has
returned.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1072

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
This commit is contained in:
Aleksander Morgado
2026-07-10 15:00:07 +02:00
committed by Aleksander Morgado
parent 46a91399ca
commit 166d6c5bc8
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/plugins/quectel/mm-shared-quectel.c
+12 -2
View File
@@ -152,6 +152,14 @@ mm_shared_quectel_create_wwan_port (MMBaseModem *self,
/*****************************************************************************/
/* RDY unsolicited event handler */
static gboolean
rdy_handler_idle (MMBroadbandModem *self)
{
mm_base_modem_set_reprobe (MM_BASE_MODEM (self), TRUE);
mm_base_modem_set_valid (MM_BASE_MODEM (self), FALSE);
return G_SOURCE_REMOVE;
}
static void
rdy_handler (MMPortSerialAt *port,
GMatchInfo *match_info,
@@ -162,8 +170,10 @@ rdy_handler (MMPortSerialAt *port,
* re-synchronize modem and ModemManager states by re-probing.
*/
mm_obj_warn (self, "modem reset detected, triggering reprobe");
mm_base_modem_set_reprobe (MM_BASE_MODEM (self), TRUE);
mm_base_modem_set_valid (MM_BASE_MODEM (self), FALSE);
g_idle_add_full (G_PRIORITY_DEFAULT_IDLE,
(GSourceFunc) rdy_handler_idle,
g_object_ref (self),
g_object_unref);
}
/*****************************************************************************/