Several changes here:
* Updated to use the non-deprecated MMModemBand values.
* Added support for GSM 450, GSM 480 and GSM 750.
* Added support for UMTS bands 11 and 19.
Program received signal SIGSEGV, Segmentation fault.
strchr () at ../sysdeps/arm/armv6/strchr.S:28
28 ../sysdeps/arm/armv6/strchr.S: No such file or directory.
(gdb) bt
#0 strchr () at ../sysdeps/arm/armv6/strchr.S:28
#1 0x76b121c8 in g_param_spec_pool_lookup () from ~/buildroot/output/staging/lib/libgobject-2.0.so.0
#2 0x76b0cf44 in g_object_new_valist () from ~/buildroot/output/staging/lib/libgobject-2.0.so.0
#3 0x76b0d39c in g_object_new () from ~/buildroot/output/staging/lib/libgobject-2.0.so.0
#4 0x75f75e40 in mm_plugin_create () at ublox/mm-plugin-ublox.c:99
#5 0x00031550 in load_plugin (path=0xe9b68 "/usr/lib/ModemManager/libmm-plugin-ublox.so") at mm-plugin-manager.c:1521
#6 load_plugins (error=0x7efffa68, self=0xdc4f0) at mm-plugin-manager.c:1574
#7 initable_init (initable=<optimized out>, cancellable=<optimized out>, error=0x7efffa68) at mm-plugin-manager.c:1679
#8 0x76b9b278 in g_initable_new_valist () from ~/buildroot/output/staging/lib/libgio-2.0.so.0
#9 0x76b9b2e0 in g_initable_new () from ~/buildroot/output/staging/lib/libgio-2.0.so.0
#10 0x000324d0 in mm_plugin_manager_new (plugin_dir=0xe9c40 "/usr/lib/ModemManager", error=error@entry=0x7efffa68) at mm-plugin-manager.c:1620
#11 0x0002da08 in initable_init (initable=0xddb40, cancellable=<optimized out>, error=0x7efffa68) at mm-base-manager.c:1113
#12 0x76b9b278 in g_initable_new_valist () from ~/buildroot/output/staging/lib/libgio-2.0.so.0
#13 0x76b9b2e0 in g_initable_new () from ~/buildroot/output/staging/lib/libgio-2.0.so.0
#14 0x0002e81c in mm_base_manager_new (connection=connection@entry=0xe1070, plugin_dir=plugin_dir@entry=0x9efb0 "/usr/lib/ModemManager",
auto_scan=auto_scan@entry=1, initial_kernel_events=initial_kernel_events@entry=0x0, enable_test=0, error=0x7efffa68, error@entry=0x7efffa60)
at mm-base-manager.c:957
#15 0x0002b6ec in bus_acquired_cb (connection=0xe1070, name=<optimized out>, user_data=<optimized out>) at main.c:87
#16 0x76c26864 in connection_get_cb () from ~/buildroot/output/staging/lib/libgio-2.0.so.0
#17 0x76bc76cc in g_task_return_now () from ~/buildroot/output/staging/lib/libgio-2.0.so.0
#18 0x76bc7d50 in g_task_return () from
~/buildroot/output/staging/lib/libgio-2.0.so.0
See similar bug in GStreamer:
https://bugzilla.gnome.org/show_bug.cgi?id=740191
Instead of reusing the caller GTask, use a new GTask to wrap the
execution of the subclass' async method implementation.
Also, rename the _ready() methods implemented in the GObject
initialization flow so that we can use the load_sim_identifier_ready()
function name.
When transitioning between power-low and power-on modes, Telit modems
switch the SIM off/on, which leads to the emission of #QSS unsolicited not
related to actual SIM swaps.
To handle this #QSS unsolicited, this patch:
* disables reacting on #QSS unsolicited when modem_power_down is received
* implements modem_after_power_up that:
- checks whether the SIM has been changed, matching cached SIM
Identifier with the value in the current SIM. If SIM Identifier,
is different, sim hot swap ports detected is called.
- re-enables reacting on #QSS unsolicited
Currently when the modem is disabled, it releases SIM hot swap ports context,
and is not able to receive any notification about the SIM status.
This patch keeps these ports opened when Modem is disabled and released them
only when SIM swap is detected or when modem is released.
When a USB modem is switching its USB configuration, udev may deliver
the remove events of USB interfaces associated with the old USB
configuration and the add events of USB interfaces associated with the new USB
configuration in an interleaved fashion. An interleaved remove event of USB
interface could trigger the special case handling code in
mm-base-manager.c:device_removed() and incorrectly remove a MMDevice under
probing.
See https://lists.freedesktop.org/archives/modemmanager-devel/2017-August/005626.html
for more details.
This patch adds a check to ensure that only remove events of USB
device (i.e. not interface) can trigger the special handling code.
Instead of having a method that returns the expected length after the
conversion and the amount of input UTF-8 characters that couldn't be
converted to the given charset, simplify the logic and just define a
method that returns a boolean specifying whether the conversion is
possible or not.
Also, include unit tests.
In case mbim-proxy crashes, ModemManager needs to be able to
recognize this and respawn the proxy so we don't lose access
to the modem. Do this by subscribing to the device removal
signal on MbimDevice and reprobing the modem when we lose the
connection to mbim-proxy.
We can't just restart mbim-proxy because the reopened mbim-proxy
will give us a different client ID, and so unsolicitied
notifications will fail and MM gets very confused otherwise.
get_device_ids() in mm-kernel-device-udev.c accepts a NULL 'vendor' or
'product' argument, but the current implementation could result in a
potential NULL dereferences of the 'vendor' argument. Given that
get_device_ids() is a local helper and its only caller provides a
non-NULL 'vendor' and 'product' argument, this patch removes the NULL
checks (i.e. get_device_ids() expects non-NULL 'vendor' and 'product').
This patch also rearranges the code such that the 'vendor' argument is
updated only when the function returns TRUE, just like how the 'product'
argument is handled.
The while loop in mm_charset_get_encoded_len() iterates through each
valid UTF-8 encoded character in the given NULL-terminated UTF-8 string.
It uses g_utf8_find_next_char() to find the position of the next
character. In case, g_utf8_find_next_char() returns NULL, it tries to
find the end (i.e. the NULL character) of the string.
This patch fixes the following issues in the while loop:
1. The loop uses both 'next' and 'end' to track the position of the next
character in the string.
When g_utf8_find_next_char() returns a non-NULL value, 'next' is
essentially the same as 'end'.
When g_utf8_find_next_char() returns NULL, 'next' remains NULL while
'end' is adjusted to track the end of the string (but is done
incorrectly as described in #2). After the 'p = next' assignment, the
'while (*p)' check results in a NULL dereference. 'p' should thus be
set to 'end' instead of 'next'.
'next' is thus redundant and can be removed.
2. When g_utf8_find_next_char() returns NULL and 'end' is adjusted to
track the end of string, the 'while (*end++)' loop stops when finding
the NULL character, but 'end' is advanced past the NULL character.
After the 'p = end' assignment, the 'while (*p)' check results in a
dereference of out-of-bounds pointer.
'while (*++end)' should be used instead given that 'p' doesn't point
to a NULL character when 'end = p' happens. 'end' will be updated to
point to the NULL character. After the 'p = end' assignment (fixed in
#1), the 'while (*p)' check will properly stop the loop.
This patch fixes a bug in apply_post_probing_filters() where it iterates
through `self->priv->forbidden_product_strings' but incorrectly accesses
`self->priv->product_strings[i]' inside the loop.
`self->priv->forbidden_product_strings[i]' should be accessed instead.
The init-sequence configured for the TTY that is being used as data
port must not be launched during the port reopen() sequence; instead
we must run it manually after the port flashing has finished.
This patch initializes `match_info' in registration_status_check_ready()
to NULL by default, such that `match_info' is always initialized even if
`self->priv->modem_3gpp_registration_regex' contains no elements.
Though `self->priv->modem_3gpp_registration_regex' always contains some
elements in the current implementation, it's better not to rely on that.
This patch fixes an ineffective `g_assert (equip_id)' in
modem_load_equipment_identifier_finish(). After mm_parse_gsn() succeeds,
`equip_id' is freed but not reset to NULL, so `g_assert (equip_id)' will
never assert even if `imei', `meid', and `esn' are all NULL (though that
shouldn't happen when mm_parse_gsn() succeeds).
This patch fixes some potential use-after-freed issues in
dms_get_ids_ready(). When an invalid ESN / MEID is retrieved,
`ctx->self->priv->esn' / `ctx->self->priv->meid' is freed but not reset
to NULL. If no IMEI is retrieved, `str' can be set to the already freed
`ctx->self->priv->esn' / `ctx->self->priv->meid' and then propagated to
a GSimpleAsyncResult object.
This patch fixes an issue in disconnect_set_ready(). If
mbim_message_connect_response_parse(), `session_id' and `nw_error' are
not set to a valid value, and thus shouldn't be used.
This patch fixes cause_code_to_delivery_state() by adding two missing
break statements for the case ERROR_CLASS_TEMPORARY and
ERROR_CLASS_PERMANENT in the `switch (error_class)` statement. Without
the break statements, the switch always falls through to the default and
returns MM_SMS_DELIVERY_STATE_UNKNOWN for an `error_class' of value
ERROR_CLASS_TEMPORARY or ERROR_CLASS_PERMANENT.
Currently, when SIM hot swap fails in either mm-iface or plugin, the
ModemManager still opens ports context and prints a message saying that
SIM hot swap is supported and that it's waiting for SIM insertion,
instead of clearly saying that SIM hot swap is not working.
This patch:
1. introduces a new property MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED
which is FALSE by default and set to TRUE only when
setup_sim_hot_swap_finish() succeded.
2. subordinates the completion of SIM hot swap setup (in
mm-broadband-modem) and the related messages to the the value of
MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED
Finally, this patch replaces the MBIM's sim_hot_swap_on private property
with the new property MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED, since they have the
same meaning.
crm_range_ready() misses a return statement after it invokes
interface_initialization_step(), which will lead to an invalid access of
the already freed InitAsyncContext.
==28664== 4 bytes in 1 blocks are definitely lost in loss record 33 of 4,317
==28664== at 0x4C2BE1F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x4C2E164: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x644E0CF: g_realloc (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C06: ??? (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C61: g_string_sized_new (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x4E8514A: mm_common_build_sms_storages_string (mm-common-helpers.c:116)
==28664== by 0x489035: cpms_query_ready (mm-broadband-modem.c:5428)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== by 0x44EADF: at_command_ready (mm-base-modem-at.c:503)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== by 0x4D8122: serial_command_ready (mm-port-serial-at.c:392)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664==
==28664== 4 bytes in 1 blocks are definitely lost in loss record 34 of 4,317
==28664== at 0x4C2BE1F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x4C2E164: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x644E0CF: g_realloc (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C06: ??? (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C61: g_string_sized_new (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x4E8514A: mm_common_build_sms_storages_string (mm-common-helpers.c:116)
==28664== by 0x489067: cpms_query_ready (mm-broadband-modem.c:5430)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== by 0x44EADF: at_command_ready (mm-base-modem-at.c:503)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== by 0x4D8122: serial_command_ready (mm-port-serial-at.c:392)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== 216 (120 direct, 96 indirect) bytes in 5 blocks are definitely lost in loss record 4,109 of 4,317
==28664== at 0x4C2BEEF: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x644E018: g_malloc (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6465B05: g_slice_alloc (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C32: g_string_sized_new (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x4D7861: parse_response (mm-port-serial-at.c:142)
==28664== by 0x4D3B52: parse_response_buffer (mm-port-serial.c:857)
==28664== by 0x4D40F2: common_input_available (mm-port-serial.c:981)
==28664== by 0x4D41B4: iochannel_input_available (mm-port-serial.c:1004)
==28664== by 0x64488B4: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6448C77: ??? (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6448F91: g_main_loop_run (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x438035: main (main.c:180)
Aleksander Morgado
Carlo Lobrano
Mario Limonciello
Ben Chan
Eric Caruso