diff mbox series

[BlueZ,v2,5/8] media: Fix crash when transport configuration changes

Message ID 20221202005051.2401504-5-luiz.dentz@gmail.com
State New
Headers show
Series [BlueZ,v2,1/8] shared/bap: Fix not reading all instances of PAC Sinks/Sources | expand

Commit Message

Luiz Augusto von Dentz Dec. 2, 2022, 12:50 a.m. UTC 
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

In case of BAP the same transport may be reconfigured multiple times
which means it would appears multiple times on endpoint->transports
leading to a crash when disconnecting as the code would attempt to
destroy the same object multiple times.
---
 profiles/audio/media.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/profiles/audio/media.c b/profiles/audio/media.c
index c9328ab9bd6e..6947cf96392e 100644
--- a/profiles/audio/media.c
+++ b/profiles/audio/media.c
@@ -1057,6 +1057,8 @@  static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
 
 		path = media_transport_get_path(transport);
 		bt_bap_stream_set_user_data(stream, (void *)path);
+		endpoint->transports = g_slist_append(endpoint->transports,
+								transport);
 	}
 
 	msg = dbus_message_new_method_call(endpoint->sender, endpoint->path,
@@ -1064,7 +1066,7 @@  static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
 						"SetConfiguration");
 	if (msg == NULL) {
 		error("Couldn't allocate D-Bus message");
-		media_transport_destroy(transport);
+		endpoint_remove_transport(endpoint, transport);
 		return FALSE;
 	}
 
@@ -1073,8 +1075,6 @@  static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
 	data->cb = cb;
 	data->user_data = user_data;
 
-	endpoint->transports = g_slist_append(endpoint->transports, transport);
-
 	dbus_message_iter_init_append(msg, &iter);
 
 	path = media_transport_get_path(transport);