pipewire/src/modules/spa/module-node-factory.c

366 lines
9 KiB
C
Raw Normal View History

/* PipeWire */
/* SPDX-FileCopyrightText: Copyright © 2018 Wim Taymans */
/* SPDX-License-Identifier: MIT */
#include <string.h>
#include <stdio.h>
#include <errno.h>
#include <dlfcn.h>
2019-10-25 15:01:02 +02:00
#include <spa/utils/result.h>
#include "config.h"
#include "pipewire/impl.h"
2017-07-11 15:57:20 +02:00
#include "spa-node.h"
#define NAME "spa-node-factory"
PW_LOG_TOPIC_STATIC(mod_topic, "mod." NAME);
#define PW_LOG_TOPIC_DEFAULT mod_topic
#define FACTORY_USAGE SPA_KEY_FACTORY_NAME"=<factory-name> " \
"["SPA_KEY_LIBRARY_NAME"=<library-name>]"
2018-06-01 11:23:02 +02:00
static const struct spa_dict_item module_props[] = {
{ PW_KEY_MODULE_AUTHOR, "Wim Taymans <wim.taymans@gmail.com>" },
{ PW_KEY_MODULE_DESCRIPTION, "Provide a factory to make SPA nodes" },
{ PW_KEY_MODULE_VERSION, PACKAGE_VERSION },
2018-06-01 11:23:02 +02:00
};
struct factory_data {
struct pw_context *context;
2019-12-11 11:57:56 +01:00
struct pw_impl_module *module;
struct spa_hook module_listener;
struct pw_impl_factory *factory;
struct spa_hook factory_listener;
struct spa_list node_list;
};
struct node_data {
struct factory_data *data;
struct spa_list link;
2019-12-11 12:41:45 +01:00
struct pw_impl_node *node;
struct spa_hook node_listener;
pipewire: module-spa-node-factory: remove resource listener when node is destroyed Previously, the resource listener was not removed when the `node_data` object was freed, which could lead to a use-after-free when the resource emitted an event later. ==2787072==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000016728 at pc 0x7ffff7175b52 bp 0x7fffffffb930 sp 0x7fffffffb920 WRITE of size 8 at 0x61d000016728 thread T0 #0 0x7ffff7175b51 in spa_list_remove ../spa/include/spa/utils/list.h:77 #1 0x7ffff717cb5a in pw_resource_destroy ../src/pipewire/resource.c:335 #2 0x7ffff7051c56 in pw_global_destroy ../src/pipewire/global.c:417 #3 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #4 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #5 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #6 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #7 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #8 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #9 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #10 0x555555559722 in main ../src/daemon/pipewire.c:131 #11 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) #12 0x7ffff62a5349 in __libc_start_main (/usr/lib/libc.so.6+0x29349) #13 0x5555555582a4 in _start (./src/daemon/pipewire+0x42a4) 0x61d000016728 is located 2216 bytes inside of 2264-byte region [0x61d000015e80,0x61d000016758) freed by thread T0 here: #0 0x7ffff798c672 in __interceptor_free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7ffff70f9bc3 in pw_impl_node_destroy ../src/pipewire/impl-node.c:1880 #2 0x7ffff70d1d57 in global_destroy ../src/pipewire/impl-node.c:638 #3 0x7ffff7051a4f in pw_global_destroy ../src/pipewire/global.c:414 #4 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #5 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #6 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #7 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #8 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #9 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #10 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #11 0x555555559722 in main ../src/daemon/pipewire.c:131 #12 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) previously allocated by thread T0 here: #0 0x7ffff798d411 in __interceptor_calloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x7ffff70e5bb7 in pw_context_create_node ../src/pipewire/impl-node.c:1192 #2 0x7ffff28c748e in pw_spa_node_new ../src/modules/spa/spa-node.c:112 #3 0x7ffff28c9a9f in pw_spa_node_load ../src/modules/spa/spa-node.c:276 #4 0x7ffff28c1618 in create_object ../src/modules/spa/module-node-factory.c:134 #5 0x7ffff7106c4e in pw_impl_factory_create_object ../src/pipewire/impl-factory.c:273 #6 0x7ffff6f86dd7 in core_create_object ../src/pipewire/impl-core.c:349 #7 0x7ffff3a5cba9 in core_method_demarshal_create_object ../src/modules/module-protocol-native/protocol-native.c:680 #8 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #9 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #10 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #11 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #12 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #13 0x555555559722 in main ../src/daemon/pipewire.c:131 #14 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) SUMMARY: AddressSanitizer: heap-use-after-free ../spa/include/spa/utils/list.h:77 in spa_list_remove
2022-05-16 19:13:17 +02:00
struct pw_resource *resource;
struct spa_hook resource_listener;
unsigned int linger:1;
struct pw_core *core;
struct spa_hook core_listener;
struct spa_hook core_proxy_listener;
struct pw_proxy *proxy;
struct spa_hook proxy_listener;
};
static void proxy_removed(void *_data)
{
struct node_data *nd = _data;
pw_log_debug("%p: removed", nd);
pw_proxy_destroy(nd->proxy);
}
static void proxy_destroy(void *_data)
{
struct node_data *nd = _data;
pw_log_debug("%p: destroy", nd);
spa_hook_remove(&nd->proxy_listener);
nd->proxy = NULL;
if (nd->node)
pw_impl_node_destroy(nd->node);
}
static const struct pw_proxy_events proxy_events = {
PW_VERSION_PROXY_EVENTS,
.removed = proxy_removed,
.destroy = proxy_destroy,
};
static void core_error(void *data, uint32_t id, int seq, int res, const char *message)
{
struct node_data *nd = data;
pw_log_error("error id:%u seq:%d res:%d (%s): %s",
id, seq, res, spa_strerror(res), message);
if (id == PW_ID_CORE && res == -EPIPE)
pw_impl_node_destroy(nd->node);
}
static const struct pw_core_events core_events = {
PW_VERSION_CORE_EVENTS,
.error = core_error,
};
static void core_removed(void *d)
{
struct node_data *nd = d;
pw_log_debug("%p: removed", nd);
spa_hook_remove(&nd->core_proxy_listener);
spa_hook_remove(&nd->core_listener);
nd->core = NULL;
if (nd->node)
pw_impl_node_destroy(nd->node);
}
static const struct pw_proxy_events core_proxy_events = {
.removed = core_removed,
};
static int export_node(struct node_data *nd, struct pw_properties *props)
{
const char *str;
str = pw_properties_get(props, PW_KEY_REMOTE_NAME);
nd->core = pw_context_connect(nd->data->context,
pw_properties_new(
PW_KEY_REMOTE_NAME, str,
NULL),
0);
if (nd->core == NULL) {
pw_log_error("can't connect: %m");
return -errno;
}
pw_proxy_add_listener((struct pw_proxy*)nd->core,
&nd->core_proxy_listener,
&core_proxy_events, nd);
pw_core_add_listener(nd->core,
&nd->core_listener,
&core_events, nd);
pw_log_debug("%p: export node %p", nd, nd->node);
nd->proxy = pw_core_export(nd->core,
PW_TYPE_INTERFACE_Node, NULL, nd->node, 0);
if (nd->proxy == NULL)
return -errno;
pw_proxy_add_listener(nd->proxy, &nd->proxy_listener, &proxy_events, nd);
return 0;
}
static void resource_destroy(void *data)
{
struct node_data *nd = data;
2019-07-17 15:29:18 +02:00
pw_log_debug("node %p", nd);
spa_hook_remove(&nd->resource_listener);
pipewire: module-spa-node-factory: remove resource listener when node is destroyed Previously, the resource listener was not removed when the `node_data` object was freed, which could lead to a use-after-free when the resource emitted an event later. ==2787072==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000016728 at pc 0x7ffff7175b52 bp 0x7fffffffb930 sp 0x7fffffffb920 WRITE of size 8 at 0x61d000016728 thread T0 #0 0x7ffff7175b51 in spa_list_remove ../spa/include/spa/utils/list.h:77 #1 0x7ffff717cb5a in pw_resource_destroy ../src/pipewire/resource.c:335 #2 0x7ffff7051c56 in pw_global_destroy ../src/pipewire/global.c:417 #3 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #4 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #5 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #6 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #7 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #8 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #9 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #10 0x555555559722 in main ../src/daemon/pipewire.c:131 #11 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) #12 0x7ffff62a5349 in __libc_start_main (/usr/lib/libc.so.6+0x29349) #13 0x5555555582a4 in _start (./src/daemon/pipewire+0x42a4) 0x61d000016728 is located 2216 bytes inside of 2264-byte region [0x61d000015e80,0x61d000016758) freed by thread T0 here: #0 0x7ffff798c672 in __interceptor_free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7ffff70f9bc3 in pw_impl_node_destroy ../src/pipewire/impl-node.c:1880 #2 0x7ffff70d1d57 in global_destroy ../src/pipewire/impl-node.c:638 #3 0x7ffff7051a4f in pw_global_destroy ../src/pipewire/global.c:414 #4 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #5 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #6 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #7 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #8 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #9 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #10 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #11 0x555555559722 in main ../src/daemon/pipewire.c:131 #12 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) previously allocated by thread T0 here: #0 0x7ffff798d411 in __interceptor_calloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x7ffff70e5bb7 in pw_context_create_node ../src/pipewire/impl-node.c:1192 #2 0x7ffff28c748e in pw_spa_node_new ../src/modules/spa/spa-node.c:112 #3 0x7ffff28c9a9f in pw_spa_node_load ../src/modules/spa/spa-node.c:276 #4 0x7ffff28c1618 in create_object ../src/modules/spa/module-node-factory.c:134 #5 0x7ffff7106c4e in pw_impl_factory_create_object ../src/pipewire/impl-factory.c:273 #6 0x7ffff6f86dd7 in core_create_object ../src/pipewire/impl-core.c:349 #7 0x7ffff3a5cba9 in core_method_demarshal_create_object ../src/modules/module-protocol-native/protocol-native.c:680 #8 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #9 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #10 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #11 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #12 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #13 0x555555559722 in main ../src/daemon/pipewire.c:131 #14 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) SUMMARY: AddressSanitizer: heap-use-after-free ../spa/include/spa/utils/list.h:77 in spa_list_remove
2022-05-16 19:13:17 +02:00
nd->resource = NULL;
if (nd->node && !nd->linger)
2019-12-11 12:41:45 +01:00
pw_impl_node_destroy(nd->node);
}
static const struct pw_resource_events resource_events = {
PW_VERSION_RESOURCE_EVENTS,
.destroy = resource_destroy
};
static void node_destroy(void *data)
{
struct node_data *nd = data;
2019-07-17 15:29:18 +02:00
pw_log_debug("node %p", nd);
spa_list_remove(&nd->link);
2018-05-17 17:30:30 +02:00
spa_hook_remove(&nd->node_listener);
nd->node = NULL;
pipewire: module-spa-node-factory: remove resource listener when node is destroyed Previously, the resource listener was not removed when the `node_data` object was freed, which could lead to a use-after-free when the resource emitted an event later. ==2787072==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000016728 at pc 0x7ffff7175b52 bp 0x7fffffffb930 sp 0x7fffffffb920 WRITE of size 8 at 0x61d000016728 thread T0 #0 0x7ffff7175b51 in spa_list_remove ../spa/include/spa/utils/list.h:77 #1 0x7ffff717cb5a in pw_resource_destroy ../src/pipewire/resource.c:335 #2 0x7ffff7051c56 in pw_global_destroy ../src/pipewire/global.c:417 #3 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #4 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #5 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #6 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #7 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #8 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #9 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #10 0x555555559722 in main ../src/daemon/pipewire.c:131 #11 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) #12 0x7ffff62a5349 in __libc_start_main (/usr/lib/libc.so.6+0x29349) #13 0x5555555582a4 in _start (./src/daemon/pipewire+0x42a4) 0x61d000016728 is located 2216 bytes inside of 2264-byte region [0x61d000015e80,0x61d000016758) freed by thread T0 here: #0 0x7ffff798c672 in __interceptor_free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7ffff70f9bc3 in pw_impl_node_destroy ../src/pipewire/impl-node.c:1880 #2 0x7ffff70d1d57 in global_destroy ../src/pipewire/impl-node.c:638 #3 0x7ffff7051a4f in pw_global_destroy ../src/pipewire/global.c:414 #4 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #5 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #6 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #7 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #8 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #9 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #10 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #11 0x555555559722 in main ../src/daemon/pipewire.c:131 #12 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) previously allocated by thread T0 here: #0 0x7ffff798d411 in __interceptor_calloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x7ffff70e5bb7 in pw_context_create_node ../src/pipewire/impl-node.c:1192 #2 0x7ffff28c748e in pw_spa_node_new ../src/modules/spa/spa-node.c:112 #3 0x7ffff28c9a9f in pw_spa_node_load ../src/modules/spa/spa-node.c:276 #4 0x7ffff28c1618 in create_object ../src/modules/spa/module-node-factory.c:134 #5 0x7ffff7106c4e in pw_impl_factory_create_object ../src/pipewire/impl-factory.c:273 #6 0x7ffff6f86dd7 in core_create_object ../src/pipewire/impl-core.c:349 #7 0x7ffff3a5cba9 in core_method_demarshal_create_object ../src/modules/module-protocol-native/protocol-native.c:680 #8 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #9 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #10 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #11 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #12 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #13 0x555555559722 in main ../src/daemon/pipewire.c:131 #14 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) SUMMARY: AddressSanitizer: heap-use-after-free ../spa/include/spa/utils/list.h:77 in spa_list_remove
2022-05-16 19:13:17 +02:00
if (nd->resource) {
spa_hook_remove(&nd->resource_listener);
nd->resource = NULL;
}
if (nd->core) {
pw_core_disconnect(nd->core);
nd->core = NULL;
}
}
2019-12-11 12:41:45 +01:00
static const struct pw_impl_node_events node_events = {
PW_VERSION_IMPL_NODE_EVENTS,
.destroy = node_destroy,
};
static void *create_object(void *_data,
struct pw_resource *resource,
const char *type,
uint32_t version,
struct pw_properties *properties,
uint32_t new_id)
{
struct factory_data *data = _data;
struct pw_context *context = data->context;
2019-12-11 12:41:45 +01:00
struct pw_impl_node *node;
const char *factory_name;
struct node_data *nd;
2019-06-20 11:04:34 +02:00
int res;
2019-12-11 11:21:43 +01:00
struct pw_impl_client *client;
bool linger;
if (properties == NULL)
2019-06-20 11:04:34 +02:00
goto error_properties;
factory_name = pw_properties_get(properties, SPA_KEY_FACTORY_NAME);
if (factory_name == NULL)
2019-06-20 11:04:34 +02:00
goto error_properties;
pw_properties_setf(properties, PW_KEY_FACTORY_ID, "%d",
pw_global_get_id(pw_impl_factory_get_global(data->factory)));
linger = pw_properties_get_bool(properties, PW_KEY_OBJECT_LINGER, false);
2019-10-02 20:16:12 +02:00
client = resource ? pw_resource_get_client(resource) : NULL;
if (client && !linger) {
pw_properties_setf(properties, PW_KEY_CLIENT_ID, "%d",
pw_global_get_id(pw_impl_client_get_global(client)));
}
node = pw_spa_node_load(context,
factory_name,
2018-01-16 16:50:53 +01:00
PW_SPA_NODE_FLAG_ACTIVATE,
properties,
sizeof(struct node_data));
if (node == NULL)
2019-06-20 11:04:34 +02:00
goto error_create_node;
nd = pw_spa_node_get_user_data(node);
nd->data = data;
nd->node = node;
nd->linger = linger;
spa_list_append(&data->node_list, &nd->link);
2019-12-11 12:41:45 +01:00
pw_impl_node_add_listener(node, &nd->node_listener, &node_events, nd);
2019-10-02 20:16:12 +02:00
if (client) {
2019-12-11 12:41:45 +01:00
res = pw_global_bind(pw_impl_node_get_global(node),
client, PW_PERM_ALL, version, new_id);
if (res < 0)
goto error_bind;
pipewire: module-spa-node-factory: remove resource listener when node is destroyed Previously, the resource listener was not removed when the `node_data` object was freed, which could lead to a use-after-free when the resource emitted an event later. ==2787072==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000016728 at pc 0x7ffff7175b52 bp 0x7fffffffb930 sp 0x7fffffffb920 WRITE of size 8 at 0x61d000016728 thread T0 #0 0x7ffff7175b51 in spa_list_remove ../spa/include/spa/utils/list.h:77 #1 0x7ffff717cb5a in pw_resource_destroy ../src/pipewire/resource.c:335 #2 0x7ffff7051c56 in pw_global_destroy ../src/pipewire/global.c:417 #3 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #4 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #5 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #6 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #7 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #8 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #9 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #10 0x555555559722 in main ../src/daemon/pipewire.c:131 #11 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) #12 0x7ffff62a5349 in __libc_start_main (/usr/lib/libc.so.6+0x29349) #13 0x5555555582a4 in _start (./src/daemon/pipewire+0x42a4) 0x61d000016728 is located 2216 bytes inside of 2264-byte region [0x61d000015e80,0x61d000016758) freed by thread T0 here: #0 0x7ffff798c672 in __interceptor_free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7ffff70f9bc3 in pw_impl_node_destroy ../src/pipewire/impl-node.c:1880 #2 0x7ffff70d1d57 in global_destroy ../src/pipewire/impl-node.c:638 #3 0x7ffff7051a4f in pw_global_destroy ../src/pipewire/global.c:414 #4 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #5 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #6 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #7 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #8 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #9 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #10 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #11 0x555555559722 in main ../src/daemon/pipewire.c:131 #12 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) previously allocated by thread T0 here: #0 0x7ffff798d411 in __interceptor_calloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x7ffff70e5bb7 in pw_context_create_node ../src/pipewire/impl-node.c:1192 #2 0x7ffff28c748e in pw_spa_node_new ../src/modules/spa/spa-node.c:112 #3 0x7ffff28c9a9f in pw_spa_node_load ../src/modules/spa/spa-node.c:276 #4 0x7ffff28c1618 in create_object ../src/modules/spa/module-node-factory.c:134 #5 0x7ffff7106c4e in pw_impl_factory_create_object ../src/pipewire/impl-factory.c:273 #6 0x7ffff6f86dd7 in core_create_object ../src/pipewire/impl-core.c:349 #7 0x7ffff3a5cba9 in core_method_demarshal_create_object ../src/modules/module-protocol-native/protocol-native.c:680 #8 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #9 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #10 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #11 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #12 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #13 0x555555559722 in main ../src/daemon/pipewire.c:131 #14 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) SUMMARY: AddressSanitizer: heap-use-after-free ../spa/include/spa/utils/list.h:77 in spa_list_remove
2022-05-16 19:13:17 +02:00
if ((nd->resource = pw_impl_client_find_resource(client, new_id)) == NULL)
goto error_bind;
pipewire: module-spa-node-factory: remove resource listener when node is destroyed Previously, the resource listener was not removed when the `node_data` object was freed, which could lead to a use-after-free when the resource emitted an event later. ==2787072==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000016728 at pc 0x7ffff7175b52 bp 0x7fffffffb930 sp 0x7fffffffb920 WRITE of size 8 at 0x61d000016728 thread T0 #0 0x7ffff7175b51 in spa_list_remove ../spa/include/spa/utils/list.h:77 #1 0x7ffff717cb5a in pw_resource_destroy ../src/pipewire/resource.c:335 #2 0x7ffff7051c56 in pw_global_destroy ../src/pipewire/global.c:417 #3 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #4 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #5 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #6 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #7 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #8 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #9 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #10 0x555555559722 in main ../src/daemon/pipewire.c:131 #11 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) #12 0x7ffff62a5349 in __libc_start_main (/usr/lib/libc.so.6+0x29349) #13 0x5555555582a4 in _start (./src/daemon/pipewire+0x42a4) 0x61d000016728 is located 2216 bytes inside of 2264-byte region [0x61d000015e80,0x61d000016758) freed by thread T0 here: #0 0x7ffff798c672 in __interceptor_free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x7ffff70f9bc3 in pw_impl_node_destroy ../src/pipewire/impl-node.c:1880 #2 0x7ffff70d1d57 in global_destroy ../src/pipewire/impl-node.c:638 #3 0x7ffff7051a4f in pw_global_destroy ../src/pipewire/global.c:414 #4 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130 #5 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784 #6 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #7 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #8 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #9 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #10 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #11 0x555555559722 in main ../src/daemon/pipewire.c:131 #12 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) previously allocated by thread T0 here: #0 0x7ffff798d411 in __interceptor_calloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x7ffff70e5bb7 in pw_context_create_node ../src/pipewire/impl-node.c:1192 #2 0x7ffff28c748e in pw_spa_node_new ../src/modules/spa/spa-node.c:112 #3 0x7ffff28c9a9f in pw_spa_node_load ../src/modules/spa/spa-node.c:276 #4 0x7ffff28c1618 in create_object ../src/modules/spa/module-node-factory.c:134 #5 0x7ffff7106c4e in pw_impl_factory_create_object ../src/pipewire/impl-factory.c:273 #6 0x7ffff6f86dd7 in core_create_object ../src/pipewire/impl-core.c:349 #7 0x7ffff3a5cba9 in core_method_demarshal_create_object ../src/modules/module-protocol-native/protocol-native.c:680 #8 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352 #9 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423 #10 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427 #11 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409 #12 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148 #13 0x555555559722 in main ../src/daemon/pipewire.c:131 #14 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f) SUMMARY: AddressSanitizer: heap-use-after-free ../spa/include/spa/utils/list.h:77 in spa_list_remove
2022-05-16 19:13:17 +02:00
pw_resource_add_listener(nd->resource, &nd->resource_listener, &resource_events, nd);
}
if (pw_properties_get_bool(properties, PW_KEY_OBJECT_EXPORT, false)) {
res = export_node(nd, properties);
if (res < 0)
goto error_export;
}
return node;
2019-06-20 11:04:34 +02:00
error_properties:
res = -EINVAL;
pw_resource_errorf_id(resource, new_id, res, "usage: "FACTORY_USAGE);
2019-06-20 11:04:34 +02:00
goto error_exit_cleanup;
error_create_node:
res = -errno;
pw_resource_errorf_id(resource, new_id, res,
"can't create node: %s", spa_strerror(res));
2019-06-20 11:04:34 +02:00
goto error_exit;
error_bind:
pw_resource_errorf_id(resource, new_id, res, "can't bind node");
pw_impl_node_destroy(node);
goto error_exit;
error_export:
pw_resource_errorf_id(resource, new_id, res, "can't export node");
pw_impl_node_destroy(node);
goto error_exit;
2019-06-20 11:04:34 +02:00
error_exit_cleanup:
pw_properties_free(properties);
2019-06-20 11:04:34 +02:00
error_exit:
errno = -res;
return NULL;
}
2019-12-11 11:45:27 +01:00
static const struct pw_impl_factory_implementation factory_impl = {
PW_VERSION_IMPL_FACTORY_IMPLEMENTATION,
.create_object = create_object,
};
static void factory_destroy(void *data)
{
struct factory_data *d = data;
struct node_data *nd;
spa_hook_remove(&d->factory_listener);
spa_list_consume(nd, &d->node_list, link)
2019-12-11 12:41:45 +01:00
pw_impl_node_destroy(nd->node);
d->factory = NULL;
if (d->module)
pw_impl_module_destroy(d->module);
}
2019-12-11 11:45:27 +01:00
static const struct pw_impl_factory_events factory_events = {
PW_VERSION_IMPL_FACTORY_EVENTS,
.destroy = factory_destroy,
};
static void module_destroy(void *data)
{
struct factory_data *d = data;
spa_hook_remove(&d->module_listener);
d->module = NULL;
if (d->factory)
pw_impl_factory_destroy(d->factory);
}
static void module_registered(void *data)
{
struct factory_data *d = data;
2019-12-11 11:57:56 +01:00
struct pw_impl_module *module = d->module;
struct pw_impl_factory *factory = d->factory;
struct spa_dict_item items[1];
char id[16];
int res;
2019-12-11 11:57:56 +01:00
snprintf(id, sizeof(id), "%d", pw_global_get_id(pw_impl_module_get_global(module)));
items[0] = SPA_DICT_ITEM_INIT(PW_KEY_MODULE_ID, id);
2019-12-11 11:45:27 +01:00
pw_impl_factory_update_properties(factory, &SPA_DICT_INIT(items, 1));
2019-12-11 11:45:27 +01:00
if ((res = pw_impl_factory_register(factory, NULL)) < 0) {
pw_log_error("%p: can't register factory: %s", factory, spa_strerror(res));
}
}
2019-12-11 11:57:56 +01:00
static const struct pw_impl_module_events module_events = {
PW_VERSION_IMPL_MODULE_EVENTS,
.destroy = module_destroy,
.registered = module_registered,
};
SPA_EXPORT
2019-12-11 11:57:56 +01:00
int pipewire__module_init(struct pw_impl_module *module, const char *args)
{
2019-12-11 11:57:56 +01:00
struct pw_context *context = pw_impl_module_get_context(module);
2019-12-11 11:45:27 +01:00
struct pw_impl_factory *factory;
struct factory_data *data;
PW_LOG_TOPIC_INIT(mod_topic);
factory = pw_context_create_factory(context,
"spa-node-factory",
PW_TYPE_INTERFACE_Node,
2019-12-11 15:26:11 +01:00
PW_VERSION_NODE,
NULL,
sizeof(*data));
if (factory == NULL)
2019-06-19 16:22:22 +02:00
return -errno;
2019-12-11 11:45:27 +01:00
data = pw_impl_factory_get_user_data(factory);
data->factory = factory;
data->context = context;
data->module = module;
spa_list_init(&data->node_list);
2019-12-11 11:45:27 +01:00
pw_impl_factory_add_listener(factory, &data->factory_listener, &factory_events, data);
pw_impl_factory_set_implementation(factory, &factory_impl, data);
pw_log_debug("module %p: new", module);
2019-12-11 11:57:56 +01:00
pw_impl_module_add_listener(module, &data->module_listener, &module_events, data);
2019-12-11 11:57:56 +01:00
pw_impl_module_update_properties(module, &SPA_DICT_INIT_ARRAY(module_props));
2018-06-01 11:23:02 +02:00
return 0;
}