| Message ID | 20220112153529.338208-1-luiz.dentz@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [BlueZ] media: Fix crash when endpoint replies with an error to SetConfiguration | expand |
This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=604907 ---Test result--- Test Summary: CheckPatch PASS 1.44 seconds GitLint PASS 1.00 seconds Prep - Setup ELL PASS 40.83 seconds Build - Prep PASS 0.70 seconds Build - Configure PASS 8.44 seconds Build - Make PASS 1376.47 seconds Make Check PASS 11.17 seconds Make Check w/Valgrind PASS 431.65 seconds Make Distcheck PASS 225.72 seconds Build w/ext ELL - Configure PASS 8.40 seconds Build w/ext ELL - Make PASS 1364.92 seconds Incremental Build with patchesPASS 0.00 seconds --- Regards, Linux Bluetooth
Hi, On Wed, Jan 12, 2022 at 8:58 AM <bluez.test.bot@gmail.com> wrote: > > This is automated email and please do not reply to this email! > > Dear submitter, > > Thank you for submitting the patches to the linux bluetooth mailing list. > This is a CI test results with your patch series: > PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=604907 > > ---Test result--- > > Test Summary: > CheckPatch PASS 1.44 seconds > GitLint PASS 1.00 seconds > Prep - Setup ELL PASS 40.83 seconds > Build - Prep PASS 0.70 seconds > Build - Configure PASS 8.44 seconds > Build - Make PASS 1376.47 seconds > Make Check PASS 11.17 seconds > Make Check w/Valgrind PASS 431.65 seconds > Make Distcheck PASS 225.72 seconds > Build w/ext ELL - Configure PASS 8.40 seconds > Build w/ext ELL - Make PASS 1364.92 seconds > Incremental Build with patchesPASS 0.00 seconds > > > > --- > Regards, > Linux Bluetooth Pushed.
diff --git a/profiles/audio/media.c b/profiles/audio/media.c index edefedc90..8162417ce 100644 --- a/profiles/audio/media.c +++ b/profiles/audio/media.c @@ -241,6 +241,16 @@ static struct media_adapter *find_adapter(struct btd_device *device) return NULL; } +static void endpoint_remove_transport(struct media_endpoint *endpoint, + struct media_transport *transport) +{ + if (!endpoint || !transport) + return; + + endpoint->transports = g_slist_remove(endpoint->transports, transport); + media_transport_destroy(transport); +} + static void clear_configuration(struct media_endpoint *endpoint, struct media_transport *transport) { @@ -260,8 +270,7 @@ static void clear_configuration(struct media_endpoint *endpoint, DBUS_TYPE_INVALID); g_dbus_send_message(btd_get_dbus_connection(), msg); done: - endpoint->transports = g_slist_remove(endpoint->transports, transport); - media_transport_destroy(transport); + endpoint_remove_transport(endpoint, transport); } static void clear_endpoint(struct media_endpoint *endpoint) @@ -301,12 +310,8 @@ static void endpoint_reply(DBusPendingCall *call, void *user_data) if (dbus_message_is_method_call(request->msg, MEDIA_ENDPOINT_INTERFACE, - "SetConfiguration")) { - if (request->transport == NULL) - error("Expected to destroy transport"); - else - media_transport_destroy(request->transport); - } + "SetConfiguration")) + endpoint_remove_transport(endpoint, request->transport); dbus_error_free(&err); goto done;
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> If endpoint responds to SetConfiguration the transport is being destroyed without removing it from the list leading a crash. Fixes: https://github.com/bluez/bluez/issues/269 --- profiles/audio/media.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)