From d4cd7ba4be72bbdd6474bda0ad4640a739c373c1 Mon Sep 17 00:00:00 2001 From: Edwin Wu Date: Fri, 29 May 2026 05:05:21 -0700 Subject: [PATCH] [Nearby Connections] Fix UAF in OfflineServiceController during shutdown PiperOrigin-RevId: 923343443 --- .../offline_service_controller.cc | 2 ++ .../offline_service_controller_test.cc | 27 +++++++++++++++++++ connections/implementation/pcp_manager.cc | 1 + 3 files changed, 30 insertions(+) diff --git a/connections/implementation/offline_service_controller.cc b/connections/implementation/offline_service_controller.cc index 4e667773..af10471e 100644 --- a/connections/implementation/offline_service_controller.cc +++ b/connections/implementation/offline_service_controller.cc @@ -90,6 +90,7 @@ OfflineServiceController::StartListeningForIncomingConnections( ClientProxy* client, absl::string_view service_id, v3::ConnectionListener listener, const v3::ConnectionListeningOptions& options) { + if (stop_) return {{Status::kOutOfOrderApiCall}, {}}; LOG(INFO) << "Client " << client->GetClientId() << " requested to start listening for service_id " << service_id; return pcp_manager_.StartListeningForIncomingConnections( @@ -98,6 +99,7 @@ OfflineServiceController::StartListeningForIncomingConnections( void OfflineServiceController::StopListeningForIncomingConnections( ClientProxy* client) { + if (stop_) return; LOG(INFO) << "Client " << client->GetClientId() << " requested to stop listening for service_id " << client->GetListeningForIncomingConnectionsServiceId(); diff --git a/connections/implementation/offline_service_controller_test.cc b/connections/implementation/offline_service_controller_test.cc index d82d1893..59fb79cb 100644 --- a/connections/implementation/offline_service_controller_test.cc +++ b/connections/implementation/offline_service_controller_test.cc @@ -567,6 +567,33 @@ TEST_P(OfflineServiceControllerTest, ShutdownBwuManagerExecutors) { env_.Stop(); } +TEST_P(OfflineServiceControllerTest, TestNoStartListeningAfterStop) { + env_.Start(); + OfflineSimulationUser user_a(kDeviceA, GetParam()); + v3::ConnectionListener listener; + v3::ConnectionListeningOptions options; + + user_a.Stop(); + + auto result = user_a.StartListeningForIncomingConnections( + std::string(kServiceId), listener, options); + EXPECT_EQ(result.first.value, Status::kOutOfOrderApiCall); + + env_.Stop(); +} + +TEST_P(OfflineServiceControllerTest, TestNoStopListeningAfterStop) { + env_.Start(); + OfflineSimulationUser user_a(kDeviceA, GetParam()); + + user_a.Stop(); + + // Verify that calling StopListening after Stop does not crash. + user_a.StopListeningForIncomingConnections(); + + env_.Stop(); +} + INSTANTIATE_TEST_SUITE_P(ParametrisedOfflineServiceControllerTest, OfflineServiceControllerTest, ::testing::ValuesIn(kTestCases)); diff --git a/connections/implementation/pcp_manager.cc b/connections/implementation/pcp_manager.cc index eb35652a..b99dec20 100644 --- a/connections/implementation/pcp_manager.cc +++ b/connections/implementation/pcp_manager.cc @@ -122,6 +122,7 @@ PcpManager::StartListeningForIncomingConnections( ClientProxy* client, absl::string_view service_id, v3::ConnectionListener listener, const v3::ConnectionListeningOptions& options) { + if (shutdown_) return {{Status::kOutOfOrderApiCall}, {}}; if (!SetCurrentPcpHandler(options.strategy)) { return {{Status::kError}, {}}; }