Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <5ea9d716.1c69fb81.92030.0ba2@mx.google.com> <20200503110629.11068-1-pali@kernel.org>
In-Reply-To: <20200503110629.11068-1-pali@kernel.org>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Mon, 4 May 2020 16:39:22 -0700
Message-ID: <CABBYNZ+5JsazyZUZHqS0B9LF3Mjs3Ly1kbEDFMQ2m-Y9d6eHLA@mail.gmail.com>
Subject: Re: [PATCH v2] a2dp: Check for valid SEP in a2dp_reconfigure
To:     =?UTF-8?Q?Pali_Roh=C3=A1r?= <pali@kernel.org>
Cc:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi Pali,

On Sun, May 3, 2020 at 4:06 AM Pali Roh=C3=A1r <pali@kernel.org> wrote:
>
> a2dp_reconfigure() is called as callback when local and remote SEP does n=
ot
> have to be valid anymore, sep->lsep can be NULL.
>
> This change fixes bluetoothd daemon crash (dereferencing NULL sep->lsep)
> when audio agent disconnect in the middle of the reconfigure call.
> ---
>  profiles/audio/a2dp.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
> index c31aaf187..a2ce3204d 100644
> --- a/profiles/audio/a2dp.c
> +++ b/profiles/audio/a2dp.c
> @@ -1178,6 +1178,12 @@ static gboolean a2dp_reconfigure(gpointer data)
>         struct avdtp_media_codec_capability *rsep_codec;
>         struct avdtp_service_capability *cap;
>
> +       if (!sep->lsep) {
> +               error("no valid local SEP");
> +               posix_err =3D -EINVAL;
> +               goto failed;
> +       }
> +
>         if (setup->rsep) {
>                 cap =3D avdtp_get_codec(setup->rsep->sep);
>                 rsep_codec =3D (struct avdtp_media_codec_capability *) ca=
p->data;
> @@ -1186,6 +1192,12 @@ static gboolean a2dp_reconfigure(gpointer data)
>         if (!setup->rsep || sep->codec !=3D rsep_codec->media_codec_type)
>                 setup->rsep =3D find_remote_sep(setup->chan, sep);
>
> +       if (!setup->rsep) {
> +               error("unable to find remote SEP");
> +               posix_err =3D -EINVAL;
> +               goto failed;
> +       }
> +
>         posix_err =3D avdtp_set_configuration(setup->session, setup->rsep=
->sep,
>                                                 sep->lsep,
>                                                 setup->caps,
> --
> 2.20.1

Applied, thanks.

--=20
Luiz Augusto von Dentz