Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20200601213902.389278-1-luiz.dentz@gmail.com> <CALWDO_UDqCm_tgA5aGyeRz=GDQYFnS+UC-AJ3h2NjGfJCSSwLw@mail.gmail.com>
 <CABBYNZJFwv+UTU=h_AvUU5hOy2r3A+iYQ2UwpjcL+ZOEo0gBsQ@mail.gmail.com>
In-Reply-To: <CABBYNZJFwv+UTU=h_AvUU5hOy2r3A+iYQ2UwpjcL+ZOEo0gBsQ@mail.gmail.com>
From:   Alain Michaud <alainmichaud@google.com>
Date:   Tue, 2 Jun 2020 13:07:40 -0400
Message-ID: <CALWDO_VmJuCCQQmRGkbYVbDrpW5LDqh0=R=hXV_sGQAXeTfMkQ@mail.gmail.com>
Subject: Re: [PATCH BlueZ] a2dp: Fix crash on transport_cb
To:     Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc:     BlueZ <linux-bluetooth@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Thanks Luiz!

On Tue, Jun 2, 2020 at 1:01 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi,
>
> On Mon, Jun 1, 2020 at 2:52 PM Alain Michaud <alainmichaud@google.com> wrote:
> >
> > Hi Luiz,
> >
> > On Mon., Jun. 1, 2020, 5:39 p.m. Luiz Augusto von Dentz, <luiz.dentz@gmail.com> wrote:
> >>
> >> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> >>
> >> There have been reports of crashes on transport_cb where the setup
> >> would most likely already have been freed but transport_cb would still
> >> be called, so instead of assuming the setup pointer would be valid try
> >> to lookup the list of active setups and log a warning when it happens.
> >
> >
> > Reviewed-by: Alain Michaud <alainm@chromium.org>
> >>
> >> ---
> >>  profiles/audio/a2dp.c | 8 ++++++++
> >>  1 file changed, 8 insertions(+)
> >>
> >> diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
> >> index 7f14c880a..d88d1fa69 100644
> >> --- a/profiles/audio/a2dp.c
> >> +++ b/profiles/audio/a2dp.c
> >> @@ -2217,6 +2217,14 @@ static void transport_cb(GIOChannel *io, GError *err, gpointer user_data)
> >>  {
> >>         struct a2dp_setup *setup = user_data;
> >>         uint16_t omtu, imtu;
> >> +       GSList *l;
> >> +
> >> +       l = g_slist_find(setups, setup);
> >> +       if (!l) {
> >> +               warn("bt_io_accept: setup %p no longer valid", setup);
> >> +               g_io_channel_shutdown(io, TRUE, NULL);
> >> +               return;
> >> +       }
> >>
> >>         if (err) {
> >>                 error("%s", err->message);
> >> --
> >> 2.25.3
>
> Pushed.
>
> --
> Luiz Augusto von Dentz