Bug: Seg fault in WPEFramework::PluginHost::Server::Service::ReleaseInterfaces when deactivating RDK services

[npoltorapavlo]

Problem/Opportunity

When deactivating services there's a crash at PluginServer.h:2043 currentIF->Release();

Thread 1 "WPEFramework" received signal SIGSEGV, Segmentation fault.
0xa756da60 in ?? ()
(gdb) bt
#0  0xa756da60 in ?? ()
#1  0x00066bca in WPEFramework::PluginHost::Server::Service::ReleaseInterfaces (this=0xcf3af8)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.h:2043
#2  0x0005f182 in WPEFramework::PluginHost::Server::Service::Deactivate (this=0xcf3af8, why=<optimized out>)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.cpp:593
#3  0x0003e324 in WPEFramework::Plugin::Controller::PutMethod (this=this@entry=0xdf16a8, index=..., request=...)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/Controller.cpp:562
#4  0x0003f40e in WPEFramework::Plugin::Controller::Process (this=0xdf16a8, request=...) at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/Controller.cpp:220
#5  0x00064d20 in WPEFramework::PluginHost::Server::Service::Process (this=0xd77620, request=...)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.h:1430
#6  0x0007140e in WPEFramework::PluginHost::Server::Channel::Job::Process (message=..., this=0xc86d68)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/Proxy.h:541
#7  WPEFramework::PluginHost::Server::Channel::WebRequestJob::Dispatch (this=0xc86d68) at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.h:3684
#8  0x00065c08 in WPEFramework::Core::ThreadPool::Minion::Process (this=this@entry=0xc9fff0) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/ThreadPool.h:452
#9  0x00065d54 in WPEFramework::Core::WorkerPool::Join (this=0xc9ff20) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/WorkerPool.h:380
#10 0x0003a564 in WPEFramework::PluginHost::main (argc=<optimized out>, argv=<optimized out>)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginHost.cpp:718

Module name is "Plugin_DisplaySettings", crash address is in rw-p

(gdb) p currentIF
$18 = (WPEFramework::PluginHost::IPlugin *) 0xa756da68
(gdb) p *currentIF
$19 = {
  <WPEFramework::Core::IUnknown> = {
    <WPEFramework::Core::IReferenceCounted> = {
      _vptr.IReferenceCounted = 0xa75179e0
    }, <No data fields>}, <No data fields>}
(gdb) p $_siginfo._sifields._sigfault.si_addr
$20 = (void *) 0xa756da60
(gdb) info proc mappings
...
	0xa7500000 0xa75ff000    0xff000        0x0  rw-p  
...
	0xaa9f0000 0xaaa50000    0x60000        0x0  r-xp   /usr/lib/wpeframework/plugins/libWPEFrameworkDisplaySettings.so
	0xaaa50000 0xaaa5f000     0xf000    0x60000  ---p   /usr/lib/wpeframework/plugins/libWPEFrameworkDisplaySettings.so
	0xaaa5f000 0xaaa63000     0x4000    0x5f000  r--p   /usr/lib/wpeframework/plugins/libWPEFrameworkDisplaySettings.so
	0xaaa63000 0xaaa64000     0x1000    0x63000  rw-p   /usr/lib/wpeframework/plugins/libWPEFrameworkDisplaySettings.so

log indicates double free

2025-12-30T16:46:14.871Z WPEFramework[12110]:  [SysLog]:[Shutdown]: Deactivated plugin [DisplaySettings]:[org.rdk.DisplaySettings]
2025-12-30T16:46:26.911Z WPEFramework[12110]:  PR4: ====> Unregistering an interface [0x1050, 12110] from a non-existing channel!!!
2025-12-30T16:46:26.950Z WPEFramework[12110]:  [12110] INFO [DisplaySettings.cpp:371] ~DisplaySettings: dtor
2025-12-30T16:46:47.205Z WPEFramework[12110]:  free(): invalid pointer

Steps to reproduce

root@sky-llama-panel:~# cat /opt/stop.sh 
for item in "org.rdk.Bluetooth" "org.rdk.SecManager" "JSPP" "org.rdk.UsbMassStorage" \
  "org.rdk.Wifi" "org.rdk.MediaSettings" "PlayerInfo" "org.rdk.FrontPanel" \
  "org.rdk.AVInput" "DisplayInfo" "org.rdk.Privacy" "org.rdk.FirmwareUpdate" \
  "DeviceInfo" "Monitor" "org.rdk.SystemMode" "OCDM" \
  "org.rdk.SharedStorage" "org.rdk.OCIContainer" "org.rdk.RemoteControl" "org.rdk.MaintenanceManager" \
  "org.rdk.HdmiCecSource" "org.rdk.Analytics" "org.rdk.SystemAudioPlayer" "org.rdk.Xcast" \
  "org.rdk.LinchPinClient" "org.rdk.Cryptography" "org.rdk.IPControl" "org.rdk.TextTrack" \
  "org.rdk.CloudStore" "com.comcast.DeviceProvisioning" "org.rdk.UsbDevice" "org.rdk.VoiceControl" \
  "org.rdk.Telemetry" "org.rdk.AuthService" "org.rdk.System" "org.rdk.TextToSpeech" \
  "org.rdk.HdcpProfile" "org.rdk.UserSettings" "org.rdk.DisplaySettings" "org.rdk.Network"; do
  curl -X PUT http://127.0.0.1:9998/Service/Controller/Deactivate/$item &
done
root@sky-llama-panel:~# 

Expected Behavior

No crash

Actual Behavior

Crash

Notes (Optional)

No response