Skip to content

Commit b6859d7

Browse files
tehampsontehampson
authored
No longer provide OperationDeviceProxy in OnDeviceConnected callback (#21256)
Previous implementations of OnDeviceConnected held onto OperationalDeviceProxy when they really should not have could lead to use after free should something else free that OperationalDeviceProxy.
1 parent ee04eb6 commit b6859d7

File tree

72 files changed

+653
-471
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+653
-471
lines changed

‎examples/all-clusters-app/all-clusters-common/src/binding-handler.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,8 @@ static void RegisterSwitchCommands()
6767
}
6868
#endif // defined(ENABLE_CHIP_SHELL)
6969

70-
static void BoundDeviceChangedHandler(const EmberBindingTableEntry & binding, chip::DeviceProxy * peer_device, void * context)
70+
static void BoundDeviceChangedHandler(const EmberBindingTableEntry & binding, chip::OperationalDeviceProxy * peer_device,
71+
void * context)
7172
{
7273
using namespace chip;
7374
using namespace chip::app;
@@ -88,6 +89,7 @@ static void BoundDeviceChangedHandler(const EmberBindingTableEntry & binding, ch
8889
ChipLogError(NotSpecified, "OnOff command failed: %" CHIP_ERROR_FORMAT, error.Format());
8990
};
9091

92+
VerifyOrDie(peer_device != nullptr && peer_device->ConnectionReady());
9193
if (sSwitchOnOffState)
9294
{
9395
Clusters::OnOff::Commands::On::Type onCommand;

‎examples/all-clusters-app/ameba/main/BindingHandler.cpp‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,8 @@ Engine sShellSwitchBindingSubCommands;
5050

5151
namespace {
5252

53-
void ProcessOnOffUnicastBindingCommand(CommandId commandId, const EmberBindingTableEntry & binding, DeviceProxy * peer_device)
53+
void ProcessOnOffUnicastBindingCommand(CommandId commandId, const EmberBindingTableEntry & binding,
54+
OperationalDeviceProxy * peer_device)
5455
{
5556
auto onSuccess = [](const ConcreteCommandPath & commandPath, const StatusIB & status, const auto & dataResponse) {
5657
ChipLogProgress(NotSpecified, "OnOff command succeeds");
@@ -60,6 +61,7 @@ void ProcessOnOffUnicastBindingCommand(CommandId commandId, const EmberBindingTa
6061
ChipLogError(NotSpecified, "OnOff command failed: %" CHIP_ERROR_FORMAT, error.Format());
6162
};
6263

64+
VerifyOrDie(peer_device != nullptr && peer_device->ConnectionReady());
6365
switch (commandId)
6466
{
6567
case Clusters::OnOff::Commands::Toggle::Id:
@@ -106,7 +108,7 @@ void ProcessOnOffGroupBindingCommand(CommandId commandId, const EmberBindingTabl
106108
}
107109
}
108110

109-
void LightSwitchChangedHandler(const EmberBindingTableEntry & binding, DeviceProxy * peer_device, void * context)
111+
void LightSwitchChangedHandler(const EmberBindingTableEntry & binding, OperationalDeviceProxy * peer_device, void * context)
110112
{
111113
VerifyOrReturn(context != nullptr, ChipLogError(NotSpecified, "OnDeviceConnectedFn: context is null"));
112114
BindingCommandData * data = static_cast<BindingCommandData *>(context);

‎examples/all-clusters-app/esp32/main/include/ShellCommands.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ class CASECommands
134134

135135
private:
136136
CASECommands() {}
137-
static void OnConnected(void * context, OperationalDeviceProxy * deviceProxy)
137+
static void OnConnected(void * context, Messaging::ExchangeManager & exchangeMgr, SessionHandle & sessionHandle)
138138
{
139139
streamer_printf(streamer_get(), "Establish CASESession Success!\r\n");
140140
GetInstance().SetOnConnecting(false);

‎examples/all-clusters-app/nxp/mw320/binding-handler.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,8 @@ static void RegisterSwitchCommands()
6868
}
6969
#endif // defined(ENABLE_CHIP_SHELL)
7070

71-
static void BoundDeviceChangedHandler(const EmberBindingTableEntry & binding, chip::DeviceProxy * peer_device, void * context)
71+
static void BoundDeviceChangedHandler(const EmberBindingTableEntry & binding, chip::OperationalDeviceProxy * peer_device,
72+
void * context)
7273
{
7374
using namespace chip;
7475
using namespace chip::app;
@@ -92,6 +93,7 @@ static void BoundDeviceChangedHandler(const EmberBindingTableEntry & binding, ch
9293
// command (SwitchCommandHandler)
9394
{
9495
Clusters::OnOff::Commands::Toggle::Type toggleCommand;
96+
VerifyOrDie(peer_device != nullptr && peer_device->ConnectionReady());
9597
Controller::InvokeCommandRequest(peer_device->GetExchangeManager(), peer_device->GetSecureSession().Value(),
9698
binding.remote, toggleCommand, onSuccess, onFailure);
9799
}

‎examples/all-clusters-minimal-app/esp32/main/include/ShellCommands.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ class CASECommands
134134

135135
private:
136136
CASECommands() {}
137-
static void OnConnected(void * context, OperationalDeviceProxy * deviceProxy)
137+
static void OnConnected(void * context, Messaging::ExchangeManager & exchangeMgr, SessionHandle & sessionHandle)
138138
{
139139
streamer_printf(streamer_get(), "Establish CASESession Success!\r\n");
140140
GetInstance().SetOnConnecting(false);

‎examples/chip-tool/commands/clusters/ModelCommand.cpp‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,14 @@ CHIP_ERROR ModelCommand::RunCommand()
4646
&mOnDeviceConnectionFailureCallback);
4747
}
4848

49-
void ModelCommand::OnDeviceConnectedFn(void * context, chip::OperationalDeviceProxy * device)
49+
void ModelCommand::OnDeviceConnectedFn(void * context, chip::Messaging::ExchangeManager & exchangeMgr,
50+
chip::SessionHandle & sessionHandle)
5051
{
5152
ModelCommand * command = reinterpret_cast<ModelCommand *>(context);
5253
VerifyOrReturn(command != nullptr, ChipLogError(chipTool, "OnDeviceConnectedFn: context is null"));
5354

54-
CHIP_ERROR err = command->SendCommand(device, command->mEndPointId);
55+
chip::OperationalDeviceProxy device(&exchangeMgr, sessionHandle);
56+
CHIP_ERROR err = command->SendCommand(&device, command->mEndPointId);
5557
VerifyOrReturn(CHIP_NO_ERROR == err, command->SetCommandExitStatus(err));
5658
}
5759

‎examples/chip-tool/commands/clusters/ModelCommand.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,8 @@ class ModelCommand : public CHIPCommand
6969
chip::NodeId mDestinationId;
7070
std::vector<chip::EndpointId> mEndPointId;
7171

72-
static void OnDeviceConnectedFn(void * context, chip::OperationalDeviceProxy * device);
72+
static void OnDeviceConnectedFn(void * context, chip::Messaging::ExchangeManager & exchangeMgr,
73+
chip::SessionHandle & sessionHandle);
7374
static void OnDeviceConnectionFailureFn(void * context, const chip::ScopedNodeId & peerId, CHIP_ERROR error);
7475

7576
chip::Callback::Callback<chip::OnDeviceConnected> mOnDeviceConnectedCallback;

‎examples/chip-tool/commands/pairing/CloseSessionCommand.cpp‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,16 @@ CHIP_ERROR CloseSessionCommand::RunCommand()
2828
CommissioneeDeviceProxy * commissioneeDeviceProxy = nullptr;
2929
if (CHIP_NO_ERROR == CurrentCommissioner().GetDeviceBeingCommissioned(mDestinationId, &commissioneeDeviceProxy))
3030
{
31-
return CloseSession(commissioneeDeviceProxy);
31+
VerifyOrReturnError(commissioneeDeviceProxy->GetSecureSession().HasValue(), CHIP_ERROR_INCORRECT_STATE);
32+
return CloseSession(*commissioneeDeviceProxy->GetExchangeManager(), commissioneeDeviceProxy->GetSecureSession().Value());
3233
}
3334

3435
return CurrentCommissioner().GetConnectedDevice(mDestinationId, &mOnDeviceConnectedCallback,
3536
&mOnDeviceConnectionFailureCallback);
3637
}
3738

38-
CHIP_ERROR CloseSessionCommand::CloseSession(DeviceProxy * device)
39+
CHIP_ERROR CloseSessionCommand::CloseSession(Messaging::ExchangeManager & exchangeMgr, const SessionHandle & sessionHandle)
3940
{
40-
VerifyOrReturnError(device->GetSecureSession().HasValue(), CHIP_ERROR_INCORRECT_STATE);
41-
4241
// TODO perhaps factor out this code into something on StatusReport that
4342
// takes an exchange and maybe a SendMessageFlags?
4443
SecureChannel::StatusReport statusReport(SecureChannel::GeneralStatusCode::kSuccess, SecureChannel::Id,
@@ -51,7 +50,7 @@ CHIP_ERROR CloseSessionCommand::CloseSession(DeviceProxy * device)
5150
System::PacketBufferHandle msg = bbuf.Finalize();
5251
VerifyOrReturnError(!msg.IsNull(), CHIP_ERROR_NO_MEMORY);
5352

54-
auto * exchange = device->GetExchangeManager()->NewContext(device->GetSecureSession().Value(), nullptr);
53+
auto * exchange = exchangeMgr.NewContext(sessionHandle, nullptr);
5554
VerifyOrReturnError(exchange != nullptr, CHIP_ERROR_NO_MEMORY);
5655

5756
// Per spec, CloseSession reports are always sent with MRP disabled.
@@ -69,12 +68,13 @@ CHIP_ERROR CloseSessionCommand::CloseSession(DeviceProxy * device)
6968
return err;
7069
}
7170

72-
void CloseSessionCommand::OnDeviceConnectedFn(void * context, OperationalDeviceProxy * device)
71+
void CloseSessionCommand::OnDeviceConnectedFn(void * context, Messaging::ExchangeManager & exchangeMgr,
72+
SessionHandle & sessionHandle)
7373
{
7474
auto * command = reinterpret_cast<CloseSessionCommand *>(context);
7575
VerifyOrReturn(command != nullptr, ChipLogError(chipTool, "OnDeviceConnectedFn: context is null"));
7676

77-
CHIP_ERROR err = command->CloseSession(device);
77+
CHIP_ERROR err = command->CloseSession(exchangeMgr, sessionHandle);
7878
VerifyOrReturn(CHIP_NO_ERROR == err, command->SetCommandExitStatus(err));
7979
}
8080

‎examples/chip-tool/commands/pairing/CloseSessionCommand.h‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
#pragma once
2020

2121
#include "../common/CHIPCommand.h"
22-
#include <app/OperationalDeviceProxy.h>
22+
#include <app/OperationalSessionSetup.h>
2323
#include <lib/core/CHIPCallback.h>
2424
#include <lib/core/DataModelTypes.h>
2525

@@ -46,11 +46,12 @@ class CloseSessionCommand : public CHIPCommand
4646
chip::NodeId mDestinationId;
4747
chip::Optional<uint16_t> mTimeoutSecs;
4848

49-
static void OnDeviceConnectedFn(void * context, chip::OperationalDeviceProxy * device);
49+
static void OnDeviceConnectedFn(void * context, chip::Messaging::ExchangeManager & exchangeMgr,
50+
chip::SessionHandle & sessionHandle);
5051
static void OnDeviceConnectionFailureFn(void * context, const chip::ScopedNodeId & peerId, CHIP_ERROR error);
5152

5253
// Try to send the action CloseSession status report.
53-
CHIP_ERROR CloseSession(chip::DeviceProxy * device);
54+
CHIP_ERROR CloseSession(chip::Messaging::ExchangeManager & exchangeMgr, const chip::SessionHandle & sessionHandle);
5455

5556
chip::Callback::Callback<chip::OnDeviceConnected> mOnDeviceConnectedCallback;
5657
chip::Callback::Callback<chip::OnDeviceConnectionFailure> mOnDeviceConnectionFailureCallback;

‎examples/chip-tool/commands/tests/TestCommand.cpp‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,12 +51,13 @@ CHIP_ERROR TestCommand::WaitForCommissionee(const char * identity,
5151
&mOnDeviceConnectionFailureCallback);
5252
}
5353

54-
void TestCommand::OnDeviceConnectedFn(void * context, chip::OperationalDeviceProxy * device)
54+
void TestCommand::OnDeviceConnectedFn(void * context, chip::Messaging::ExchangeManager & exchangeMgr,
55+
chip::SessionHandle & sessionHandle)
5556
{
5657
ChipLogProgress(chipTool, " **** Test Setup: Device Connected\n");
5758
auto * command = static_cast<TestCommand *>(context);
5859
VerifyOrReturn(command != nullptr, ChipLogError(chipTool, "Device connected, but cannot run the test, as the context is null"));
59-
command->mDevices[command->GetIdentity()] = device;
60+
command->mDevices[command->GetIdentity()] = std::make_unique<chip::OperationalDeviceProxy>(&exchangeMgr, sessionHandle);
6061

6162
LogErrorOnFailure(command->ContinueOnChipMainThread(CHIP_NO_ERROR));
6263
}

0 commit comments

Comments
 (0)