RDKB-65948: [8.6p1s2]Observed CcspLMLite Crash due to Presence Detection with Fingerprint 44028269

[im1308]

RDKB-65948: [8.6p1s2]Observed CcspLMLite Crash due to Presence Detection with Fingerprint 44028269

---

RootCause and Fix:

---

The crash at len = strlen(value) is a stale-handle use-after-free. Host_GetEntry returns the row handle after releasing LmHostObjectMutex; the CCSP framework caches it and later calls Host_GetParamStringValue. If the LM background thread deletes/reallocates that host in between, pHost->pStringParaValue[i] is a non-NULL garbage pointer, so strlen faults. The value == NULL check can't catch it.

Adding a new helper IsValidHostHandle() to verify that the PLmObjectHost received through hInsContext still exists in lmHosts.hostArray[].
The validation is performed while holding LmHostObjectMutex, before dereferencing the host object.
If the handle is no longer valid, the function logs a warning, unlocks the mutex, and returns an error instead of dereferencing a potentially stale pointer.

Purpose: Prevent access to a stale PLmObjectHost in case the host entry was removed or replaced after Host_GetEntry() returned the handle.

[Copilot]

Pull request overview

This PR aims to prevent a CcspLMLite crash caused by stale (use-after-free) host instance handles being cached by the CCSP framework and later dereferenced in Host_GetParamStringValue().

Changes:

• Adds IsValidHostHandle() to validate hInsContext (as PLmObjectHost) against lmHosts.hostArray[] under LmHostObjectMutex.
• Adds a guard in Host_GetParamStringValue() to bail out early when a stale host handle is detected.
• Updates GetParamStringValue_common() to use strnlen() (but this currently breaks required-size reporting semantics).

Comments suppressed due to low confidence (1)

source/lm/cosa_hosts_dml.c:156

• strnlen(value, *pUlSize) breaks the TR-181/CCSP GetParamStringValue contract for required-size reporting: when the string is longer than the buffer, strnlen returns *pUlSize, so the code only bumps *pUlSize by 1 instead of returning the full required length. Callers that reallocate and retry once will still fail for long strings.

        len = strnlen(value, *pUlSize); 
        if (len >= *pUlSize)
        {
            *pUlSize = len + 1;
            rc = 1;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Amaresh-Kotekal]

I feel it is not required because for each get call, it will iterate over all the Hosts.
NULL check and mutex lock is sufficient.

[im1308]

My understanding is that the mutex protects concurrent access to lmHosts, but it doesn't validate the lifetime of the hInsContext received from the framework. Since Host_GetEntry() returns the host pointer after releasing the mutex, my concern is that the handle may become stale if the host is removed before a later Host_GetParamStringValue() callback. IsValidHostHandle() is intended to verify that the received handle still belongs to the current hostArray before dereferencing it. If there is an existing guarantee that host objects are never freed (or that hInsContext is always refreshed or reference-counted), then I'm happy to remove the check.

[Amaresh-Kotekal]

In this file, Lot of other places also needs to be handled apart from this function.

[im1308]

This has been handled. Please review the changes

[github-actions]

📋 PR Format Reminder

• Description missing:
  • Reason for change
  • Test Procedure
  • Risks (Low / Medium / High)
  • Priority (P0 / P1 / P2)

Expected:

TICKET-123 : brief description

Reason for change: why
Test Procedure: how to verify
Risks: Low / Medium / High
Priority: P0 / P1 / P2

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/lm/cosa_hosts_dml.c:156

• GetParamStringValue_common() now has a stray block after strnlen(...), which results in an else without a matching if (compile error) and also breaks the buffer-size logic. If the intent is to preserve the original "return 1 and set *pUlSize to required size" behavior, the size check needs to be restored (and using strlen() here is appropriate once the handle is validated elsewhere).

        len = strnlen(value, *pUlSize); 
        {
            *pUlSize = len + 1;
            rc = 1;
        }