From 92f5d537a1290e91ecc3d4a4fb49c3b69247ac0d Mon Sep 17 00:00:00 2001 From: ppalan289 Date: Thu, 13 Aug 2026 13:50:07 +0000 Subject: [PATCH 1/5] RDKEMW-12176: btrCore_PopulateListOfPairedCrash latest Reason for change: Crash fix Test Procedure: Device deepsleep causing the crash Risks: Low Priority: P2 Signed-off-by: ppalan289 --- src/btrCore.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/src/btrCore.c b/src/btrCore.c index d1d5967..cf84d54 100644 --- a/src/btrCore.c +++ b/src/btrCore.c @@ -74,6 +74,9 @@ int b_rdk_logger_enabled = 0; #define BTRCORE_GOOGLE_OUI_LENGTH 8 #define BTCORE_DEFAULT_CONTROLLER_NAME "Game Controller" +/* Prevent UAF during teardown */ +static volatile gint gIsBtrCoreTerminating = 0; + static char * BTRCORE_REMOTE_OUI_VALUES[] = { "20:44:41", //LC103 "E8:0F:C8", //EC302 @@ -1482,10 +1485,21 @@ btrCore_PopulateListOfPairedDevices ( stBTPairedDeviceInfo* pstBTPairedDeviceInfo = NULL; stBTRCoreBTDevice knownDevicesArr[BTRCORE_MAX_NUM_BT_DEVICES]; + if (!apsthBTRCore) { + BTRCORELOG_WARN("apsthBTRCore is null\n"); + return enBTRCoreNotInitialized; + } - if ((pstBTPairedDeviceInfo = g_malloc0(sizeof(stBTPairedDeviceInfo))) == NULL) + /* Prevent UAF when worker threads run during teardown */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n"); return enBTRCoreFailure; + } + if ((pstBTPairedDeviceInfo = g_malloc0(sizeof(stBTPairedDeviceInfo))) == NULL) { + BTRCORELOG_WARN("btrCore: g_malloc0 failed\n") + return enBTRCoreFailure; + } pstBTPairedDeviceInfo->numberOfDevices = 0; for (i_idx = 0; i_idx < BT_MAX_NUM_DEVICE; i_idx++) { @@ -3524,6 +3538,8 @@ BTRCore_Init ( } MEMSET_S(pstlhBTRCore, sizeof(stBTRCoreHdl), 0, sizeof(stBTRCoreHdl)); + /* Reset the variable indicating btrCore is initialized, not terminating */ + g_atomic_int_set(&gIsBtrCoreTerminating, 0); pstlhBTRCore->connHdl = BtrCore_BTInitGetConnection(); if (!pstlhBTRCore->connHdl) { @@ -3688,6 +3704,9 @@ BTRCore_DeInit ( BTRCORELOG_INFO ("hBTRCore = %8p\n", hBTRCore); + /* Set Terminating variable when deinit is in progress. */ + g_atomic_int_set(&gIsBtrCoreTerminating, 1); + if (pstlhBTRCore->hidNameWaitInitialized) { GThread* lapPendingThreads[BTRCORE_MAX_NUM_BT_DISCOVERED_DEVICES]; int liNumPendingThreads = 0; From 0de0d5f92e8d7d0e365c11f3f5845f1b7bff1d4a Mon Sep 17 00:00:00 2001 From: ppalan289 Date: Thu, 13 Aug 2026 13:54:24 +0000 Subject: [PATCH 2/5] RDKEMW-12176: btrCore_PopulateListOfPairedCrash l Reason for change: Crash fix Test Procedure: Device deepsleep causing the crash Risks: Low Priority: P2 Signed-off-by: ppalan289 --- src/btrCore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/btrCore.c b/src/btrCore.c index cf84d54..27bfb54 100644 --- a/src/btrCore.c +++ b/src/btrCore.c @@ -1490,7 +1490,7 @@ btrCore_PopulateListOfPairedDevices ( return enBTRCoreNotInitialized; } - /* Prevent UAF when worker threads run during teardown */ + /* Prevent UAF when during teardown is in progress */ if(g_atomic_int_get(&gIsBtrCoreTerminating)) { BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n"); return enBTRCoreFailure; From 10e9a84870af9747b9b166146bc3120e0831cca6 Mon Sep 17 00:00:00 2001 From: ppalan289 Date: Thu, 13 Aug 2026 14:02:53 +0000 Subject: [PATCH 3/5] RDKEMW-12176: btrCore_PopulateListOfPairedCrash l Reason for change: Crash fix Test Procedure: Device deepsleep causing the crash Risks: Low Priority: P2 Signed-off-by: ppalan289 --- src/btrCore.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/btrCore.c b/src/btrCore.c index 27bfb54..f92c4ac 100644 --- a/src/btrCore.c +++ b/src/btrCore.c @@ -1497,7 +1497,7 @@ btrCore_PopulateListOfPairedDevices ( } if ((pstBTPairedDeviceInfo = g_malloc0(sizeof(stBTPairedDeviceInfo))) == NULL) { - BTRCORELOG_WARN("btrCore: g_malloc0 failed\n") + BTRCORELOG_WARN("btrCore: g_malloc0 failed\n"); return enBTRCoreFailure; } @@ -3702,11 +3702,11 @@ BTRCore_DeInit ( pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; - BTRCORELOG_INFO ("hBTRCore = %8p\n", hBTRCore); - /* Set Terminating variable when deinit is in progress. */ g_atomic_int_set(&gIsBtrCoreTerminating, 1); + BTRCORELOG_INFO ("hBTRCore = %8p\n", hBTRCore); + if (pstlhBTRCore->hidNameWaitInitialized) { GThread* lapPendingThreads[BTRCORE_MAX_NUM_BT_DISCOVERED_DEVICES]; int liNumPendingThreads = 0; From aaf1688553239ef90515a6e9f38d4dde018d043b Mon Sep 17 00:00:00 2001 From: ppalan289 Date: Thu, 13 Aug 2026 15:15:28 +0000 Subject: [PATCH 4/5] RDKEMW-12176: btrCore_PopulateListOfPairedCrash l Reason for change: Crash fix Test Procedure: Device deepsleep causing the crash Risks: Low Priority: P2 Signed-off-by: ppalan289 --- src/btrCore.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 59 insertions(+), 1 deletion(-) diff --git a/src/btrCore.c b/src/btrCore.c index f92c4ac..2770841 100644 --- a/src/btrCore.c +++ b/src/btrCore.c @@ -1490,7 +1490,7 @@ btrCore_PopulateListOfPairedDevices ( return enBTRCoreNotInitialized; } - /* Prevent UAF when during teardown is in progress */ + /* Prevent UAF during teardown is in progress */ if(g_atomic_int_get(&gIsBtrCoreTerminating)) { BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n"); return enBTRCoreFailure; @@ -1695,6 +1695,17 @@ btrCore_GetDeviceInfo ( unsigned int ui32NumOfDevices = 0; unsigned int ui32LoopIdx = 0; + if (!apsthBTRCore) { + BTRCORELOG_WARN("apsthBTRCore is null\n"); + return enBTRCoreNotInitialized; + } + + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring btrCore_GetDeviceInfo during termination\n"); + return enBTRCoreFailure; + } + if (!apsthBTRCore->numOfPairedDevices) { BTRCORELOG_INFO ("Possibly the list is not populated; like booted and connecting\n"); btrCore_PopulateListOfPairedDevices(apsthBTRCore, apsthBTRCore->curAdapterPath); /* Keep the list upto date */ @@ -1863,6 +1874,17 @@ btrCore_GetDeviceInfoKnown ( unsigned int ui32NumOfDevices = 0; unsigned int ui32LoopIdx = 0; + if (!apsthBTRCore) { + BTRCORELOG_WARN("apsthBTRCore is null\n"); + return enBTRCoreNotInitialized; + } + + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring btrCore_GetDeviceInfoKnown during termination\n"); + return enBTRCoreFailure; + } + if (!apsthBTRCore->numOfPairedDevices) { BTRCORELOG_INFO ("Possibly the list is not populated; like booted and connecting\n"); btrCore_PopulateListOfPairedDevices(apsthBTRCore, apsthBTRCore->curAdapterPath); /* Keep the list upto date */ @@ -4658,6 +4680,12 @@ BTRCore_PairDevice ( return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring accessing stBTRCoreHdl_p during termination\n"); + return enBTRCoreFailure; + } + pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; if (aBTRCoreDevId < BTRCORE_MAX_NUM_BT_DISCOVERED_DEVICES) { @@ -4770,6 +4798,12 @@ BTRCore_UnPairDevice ( return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring accessing hBTRCore during termination\n"); + return enBTRCoreFailure; + } + pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; if ((lenBTRCoreRet = btrCore_GetDeviceInfoKnown(pstlhBTRCore, aBTRCoreDevId, aenBTRCoreDevType, @@ -4839,6 +4873,12 @@ BTRCore_GetListOfPairedDevices ( return enBTRCoreInvalidArg; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring hBTRCore access during termination\n"); + return enBTRCoreFailure; + } + pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; if (btrCore_PopulateListOfPairedDevices(pstlhBTRCore, pstlhBTRCore->curAdapterPath) == enBTRCoreSuccess) { @@ -5047,6 +5087,12 @@ BTRCore_IsDeviceConnectable ( return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: ignoring accessing hBTRCore while termination\n"); + return enBTRCoreFailure; + } + pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; if (!pstlhBTRCore->numOfPairedDevices) { @@ -5419,6 +5465,12 @@ enBTRCoreRet BTRCore_refreshLEActionListForGamepads(tBTRCoreHandle hBTRCore) return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring BTRCore_refreshLEActionListForGamepads during termination\n"); + return enBTRCoreFailure; + } + if (btrCore_PopulateListOfPairedDevices(pstlhBTRCore, pstlhBTRCore->curAdapterPath) == enBTRCoreSuccess) { for (i32DevIdx = 0; i32DevIdx < pstlhBTRCore->numOfPairedDevices; i32DevIdx++) { //only refresh action list for LE gamepads @@ -5483,6 +5535,12 @@ enBTRCoreRet BTRCore_clearLEActionListForGamepads(tBTRCoreHandle hBTRCore) return enBTRCoreNotInitialized; } + /* Prevent UAF during teardown is in progress */ + if(g_atomic_int_get(&gIsBtrCoreTerminating)) { + BTRCORELOG_WARN("btrCore: Ignoring BTRCore_clearLEActionListForGamepads during termination\n"); + return enBTRCoreFailure; + } + if (btrCore_PopulateListOfPairedDevices(pstlhBTRCore, pstlhBTRCore->curAdapterPath) == enBTRCoreSuccess) { for (i32DevIdx = 0; i32DevIdx < pstlhBTRCore->numOfPairedDevices; i32DevIdx++) { //only refresh action list for LE gamepads From f05c279f578b8c845e95eb3f649eb42ff6cbba1f Mon Sep 17 00:00:00 2001 From: ppalan289 Date: Thu, 13 Aug 2026 15:37:57 +0000 Subject: [PATCH 5/5] RDKEMW-12176: btrCore_PopulateListOfPairedCrash l Reason for change: Crash fix Test Procedure: Device deepsleep causing the crash Risks: Low Priority: P2 Signed-off-by: ppalan289 --- src/btrCore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/btrCore.c b/src/btrCore.c index 2770841..b1b1649 100644 --- a/src/btrCore.c +++ b/src/btrCore.c @@ -75,7 +75,7 @@ int b_rdk_logger_enabled = 0; #define BTCORE_DEFAULT_CONTROLLER_NAME "Game Controller" /* Prevent UAF during teardown */ -static volatile gint gIsBtrCoreTerminating = 0; +static gint gIsBtrCoreTerminating = 0; static char * BTRCORE_REMOTE_OUI_VALUES[] = { "20:44:41", //LC103