Hello Maintainers
This series of patch handles the fix for the crash observed with VOCS when trying to pair with LE Audio TWS earbuds and few other issues.
A crash was reported for the following patch by Pauli Virtanen <[email protected]>.
Patch Link: https://patchwork.kernel.org/project/bluetooth/patch/[email protected]/
Root cause:
- There are two types of database- Remote and Local (rdb and ldb)
- In client mode currently the code was written to access ldb
Fix:
- Correcting it to access rdb has resolved the problem in VOCS
- Same correction is done for VCS.
Later to fixing the above crash few more issues were observed, these are fixed in subsequent patches.
Thanks,
Warm Regards,
Nitin Jadhav
Nitin Jadhav (3):
shared/vcp: Fix the crash observed with VOCS
shared/vcp: Fix issues of audio location and descriptor
shared/vcp: Reserve one more handle in VCS for VOCS
src/shared/vcp.c | 47 +++++++++++++++++++++++++----------------------
1 file changed, 25 insertions(+), 22 deletions(-)
--
2.34.1
Root cause
- There are two types of database- Remote and Local (rdb and ldb).
- In client mode currently the code was written to access ldb.
Fix
- Correcting it, to access rdb has resolved the problem in VOCS.
- Same correction is done for VCS.
Reported-by: Pauli Virtanen <[email protected]>
---
src/shared/vcp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 74bd01729..314618664 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -1719,10 +1719,10 @@ bool bt_vcp_attach(struct bt_vcp *vcp, struct bt_gatt_client *client)
return false;
bt_uuid16_create(&uuid, VCS_UUID);
- gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vcs_service, vcp);
+ gatt_db_foreach_service(vcp->rdb->db, &uuid, foreach_vcs_service, vcp);
bt_uuid16_create(&uuid, VOL_OFFSET_CS_UUID);
- gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vocs_service, vcp);
+ gatt_db_foreach_service(vcp->rdb->db, &uuid, foreach_vocs_service, vcp);
return true;
}
--
2.34.1
Fix: As per specs, VOCS is a secondary service;
hence it should be included under a primary service VCS.
The current number of handles is increased to accommodate the
included service
---
src/shared/vcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 0408531b2..263da4c30 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -998,7 +998,7 @@ static struct bt_vcs *vcs_new(struct gatt_db *db, struct bt_vcp_db *vdb)
/* Populate DB with VCS attributes */
bt_uuid16_create(&uuid, VCS_UUID);
- vcs->service = gatt_db_add_service(db, &uuid, true, 9);
+ vcs->service = gatt_db_add_service(db, &uuid, true, 10);
gatt_db_service_add_included(vcs->service, vdb->vocs->service);
gatt_db_service_set_active(vdb->vocs->service, true);
--
2.34.1
Issues
- Audio output descriptor & location read functions requires code
correction.
- During reading audio location descriptor value was checked
instead of the pointer. DBG statement wrongly accessed value
to print the log that caused the crash.
Fix
- Corrected audio output descriptor read variable
- Corrected the audio location debug printing function
- Allocated the memory as a char pointer to the audio descriptor variable.
- Corrected the audio descriptor pointer checking condition
---
src/shared/vcp.c | 41 ++++++++++++++++++++++-------------------
1 file changed, 22 insertions(+), 19 deletions(-)
diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 314618664..0408531b2 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -973,7 +973,7 @@ static void vocs_voaodec_read(struct gatt_db_attribute *attrib,
struct bt_vocs *vocs = user_data;
struct iovec iov;
- iov.iov_base = &vocs->vocs_ao_dec;
+ iov.iov_base = vocs->vocs_ao_dec;
iov.iov_len = strlen(vocs->vocs_ao_dec);
gatt_db_attribute_read_result(attrib, id, 0, iov.iov_base,
@@ -1385,11 +1385,12 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
const uint8_t *value, uint16_t length,
void *user_data)
{
- uint32_t *vocs_audio_loc;
- struct iovec iov = {
- .iov_base = (void *) value,
- .iov_len = length,
- };
+ uint32_t vocs_audio_loc;
+
+ if (!value) {
+ DBG(vcp, "Unable to get VOCS Audio Location");
+ return;
+ }
if (!success) {
DBG(vcp, "Unable to read VOCS Audio Location: error 0x%02x",
@@ -1397,13 +1398,9 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
return;
}
- vocs_audio_loc = iov_pull_mem(&iov, sizeof(uint32_t));
- if (!*vocs_audio_loc) {
- DBG(vcp, "Unable to get VOCS Audio Location");
- return;
- }
+ memcpy(&vocs_audio_loc, value, length);
- DBG(vcp, "VOCS Audio Loc:%x", *vocs_audio_loc);
+ DBG(vcp, "VOCS Audio Loc: %x", vocs_audio_loc);
}
@@ -1413,10 +1410,11 @@ static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
void *user_data)
{
char *vocs_ao_dec_r;
- struct iovec iov = {
- .iov_base = (void *) value,
- .iov_len = length,
- };
+
+ if (!value) {
+ DBG(vcp, "Unable to get VOCS Audio Location");
+ return;
+ }
if (!success) {
DBG(vcp, "Unable to read VOCS Audio Descriptor: error 0x%02x",
@@ -1424,13 +1422,18 @@ static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
return;
}
- vocs_ao_dec_r = iov_pull_mem(&iov, length);
- if (!*vocs_ao_dec_r) {
+ vocs_ao_dec_r = malloc(length+1);
+ memset(vocs_ao_dec_r, 0, length+1);
+ memcpy(vocs_ao_dec_r, value, length);
+
+ if (!vocs_ao_dec_r) {
DBG(vcp, "Unable to get VOCS Audio Descriptor");
return;
}
- DBG(vcp, "VOCS Audio Descriptor:%s", *vocs_ao_dec_r);
+ DBG(vcp, "VOCS Audio Descriptor: %s", vocs_ao_dec_r);
+ free(vocs_ao_dec_r);
+ vocs_ao_dec_r = NULL;
}
static void vcp_pending_destroy(void *data)
--
2.34.1
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=769321
---Test result---
Test Summary:
CheckPatch PASS 1.20 seconds
GitLint PASS 0.76 seconds
BuildEll PASS 35.83 seconds
BluezMake PASS 1251.83 seconds
MakeCheck PASS 13.06 seconds
MakeDistcheck PASS 212.03 seconds
CheckValgrind PASS 334.16 seconds
CheckSmatch PASS 465.97 seconds
bluezmakeextell PASS 138.70 seconds
IncrementalBuild PASS 3262.86 seconds
ScanBuild PASS 1483.32 seconds
---
Regards,
Linux Bluetooth
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <[email protected]>:
On Tue, 25 Jul 2023 16:47:39 +0300 you wrote:
> Hello Maintainers
>
> This series of patch handles the fix for the crash observed with VOCS when trying to pair with LE Audio TWS earbuds and few other issues.
>
> A crash was reported for the following patch by Pauli Virtanen <[email protected]>.
> Patch Link: https://patchwork.kernel.org/project/bluetooth/patch/[email protected]/
>
> [...]
Here is the summary with links:
- [BlueZ,v4,1/3] shared/vcp: Fix the crash observed with VOCS
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=06ec4f61000a
- [BlueZ,v4,2/3] shared/vcp: Fix issues of audio location and descriptor
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=2a0e392b40fa
- [BlueZ,v4,3/3] shared/vcp: Reserve one more handle in VCS for VOCS
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=4d714becb7df
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html