2022-01-12 23:25:01

by Luiz Augusto von Dentz

Subject: [PATCH BlueZ] media: Fix crash when endpoint replies with an error to SetConfiguration

From: Luiz Augusto von Dentz <[email protected]>

If endpoint responds to SetConfiguration the transport is being
destroyed without removing it from the list leading a crash.

Fixes: https://github.com/bluez/bluez/issues/269
---
profiles/audio/media.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/profiles/audio/media.c b/profiles/audio/media.c
index edefedc90..8162417ce 100644
--- a/profiles/audio/media.c
+++ b/profiles/audio/media.c
@@ -241,6 +241,16 @@ static struct media_adapter *find_adapter(struct btd_device *device)
return NULL;
}

+static void endpoint_remove_transport(struct media_endpoint *endpoint,
+ struct media_transport *transport)
+{
+ if (!endpoint || !transport)
+ return;
+
+ endpoint->transports = g_slist_remove(endpoint->transports, transport);
+ media_transport_destroy(transport);
+}
+
static void clear_configuration(struct media_endpoint *endpoint,
struct media_transport *transport)
{
@@ -260,8 +270,7 @@ static void clear_configuration(struct media_endpoint *endpoint,
DBUS_TYPE_INVALID);
g_dbus_send_message(btd_get_dbus_connection(), msg);
done:
- endpoint->transports = g_slist_remove(endpoint->transports, transport);
- media_transport_destroy(transport);
+ endpoint_remove_transport(endpoint, transport);
}

static void clear_endpoint(struct media_endpoint *endpoint)
@@ -301,12 +310,8 @@ static void endpoint_reply(DBusPendingCall *call, void *user_data)

if (dbus_message_is_method_call(request->msg,
MEDIA_ENDPOINT_INTERFACE,
- "SetConfiguration")) {
- if (request->transport == NULL)
- error("Expected to destroy transport");
- else
- media_transport_destroy(request->transport);
- }
+ "SetConfiguration"))
+ endpoint_remove_transport(endpoint, request->transport);

dbus_error_free(&err);
goto done;
--
2.33.1

2022-01-12 23:36:03

by bluez.test.bot

Subject: RE: [BlueZ] media: Fix crash when endpoint replies with an error to SetConfiguration

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=604907

---Test result---

Test Summary:
CheckPatch PASS 1.44 seconds
GitLint PASS 1.00 seconds
Prep - Setup ELL PASS 40.83 seconds
Build - Prep PASS 0.70 seconds
Build - Configure PASS 8.44 seconds
Build - Make PASS 1376.47 seconds
Make Check PASS 11.17 seconds
Make Check w/Valgrind PASS 431.65 seconds
Make Distcheck PASS 225.72 seconds
Build w/ext ELL - Configure PASS 8.40 seconds
Build w/ext ELL - Make PASS 1364.92 seconds
Incremental Build with patchesPASS 0.00 seconds



---
Regards,
Linux Bluetooth

2022-01-13 21:37:47

by Luiz Augusto von Dentz

Subject: Re: [BlueZ] media: Fix crash when endpoint replies with an error to SetConfiguration

Hi,

On Wed, Jan 12, 2022 at 8:58 AM <[email protected]> wrote:
>
> This is automated email and please do not reply to this email!
>
> Dear submitter,
>
> Thank you for submitting the patches to the linux bluetooth mailing list.
> This is a CI test results with your patch series:
> PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=604907
>
> ---Test result---
>
> Test Summary:
> CheckPatch PASS 1.44 seconds
> GitLint PASS 1.00 seconds
> Prep - Setup ELL PASS 40.83 seconds
> Build - Prep PASS 0.70 seconds
> Build - Configure PASS 8.44 seconds
> Build - Make PASS 1376.47 seconds
> Make Check PASS 11.17 seconds
> Make Check w/Valgrind PASS 431.65 seconds
> Make Distcheck PASS 225.72 seconds
> Build w/ext ELL - Configure PASS 8.40 seconds
> Build w/ext ELL - Make PASS 1364.92 seconds
> Incremental Build with patchesPASS 0.00 seconds
>
>
>
> ---
> Regards,
> Linux Bluetooth

Pushed.

--
Luiz Augusto von Dentz