mbox series

[BlueZ,0/1] Fix crash when unregistering bcast source endpoint

Message ID 20240223141609.27181-1-silviu.barbulescu@nxp.com
Headers show
Series Fix crash when unregistering bcast source endpoint | expand

Message

Silviu Florian Barbulescu Feb. 23, 2024, 2:16 p.m. UTC 
In bt_bap_stream_release stream is accessed after free
ERROR: AddressSanitizer: heap-use-after-free on address
READ of size 8 at 0x60d0000001e0 thread T0
    #0 0x556602a14ce0 in bt_bap_stream_release src/shared/bap.c:5423
    #1 0x556602981292 in queue_foreach src/shared/queue.c:207
    #2 0x556602a0712a in bt_bap_remove_pac src/shared/bap.c:3572
    #3 0x5566026ca846 in media_endpoint_destroy profiles/audio/media.c:180
    #4 0x5566026cdef9 in unregister_endpoint profiles/audio/media.c:1708


Silviu Florian Barbulescu (1):
  shared/bap: Fix crash unreg bcast src endpoint

 src/shared/bap.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)


base-commit: a16c2ccf9c256285188f4549b7b767cf31b100eb

Comments

patchwork-bot+bluetooth@kernel.org Feb. 23, 2024, 2:49 p.m. UTC | #1 
Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 23 Feb 2024 16:16:08 +0200 you wrote:
> In bt_bap_stream_release stream is accessed after free
> ERROR: AddressSanitizer: heap-use-after-free on address
> READ of size 8 at 0x60d0000001e0 thread T0
>     #0 0x556602a14ce0 in bt_bap_stream_release src/shared/bap.c:5423
>     #1 0x556602981292 in queue_foreach src/shared/queue.c:207
>     #2 0x556602a0712a in bt_bap_remove_pac src/shared/bap.c:3572
>     #3 0x5566026ca846 in media_endpoint_destroy profiles/audio/media.c:180
>     #4 0x5566026cdef9 in unregister_endpoint profiles/audio/media.c:1708
> 
> [...]

Here is the summary with links:
  - [BlueZ,1/1] shared/bap: Fix crash unreg bcast src endpoint
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=8f262a27bdf2

You are awesome, thank you!