Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220325092706.17135-1-frederic.danis@collabora.com> <CABBYNZJJAN7GeNRm8_UyyE4pBDKn+YWLiqHBxecKcKUJhzDbTQ@mail.gmail.com>
In-Reply-To: <CABBYNZJJAN7GeNRm8_UyyE4pBDKn+YWLiqHBxecKcKUJhzDbTQ@mail.gmail.com>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Mon, 28 Mar 2022 11:16:43 -0700
Message-ID: <CABBYNZ+7nup69rsTsaAhZAFxS3Mc_bMLBZr3vVjbW4D5sG8o7w@mail.gmail.com>
Subject: Re: [PATCH] a2dp: Fix crash when SEP codec has not been initialized
To:     =?UTF-8?B?RnLDqWTDqXJpYyBEYW5pcw==?= <frederic.danis@collabora.com>
Cc:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Fr=C3=A9d=C3=A9ric,

On Fri, Mar 25, 2022 at 1:06 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Fr=C3=A9d=C3=A9ric,
>
> On Fri, Mar 25, 2022 at 12:53 PM Fr=C3=A9d=C3=A9ric Danis
> <frederic.danis@collabora.com> wrote:
> >
> > If SEP has not been properly discovered avdtp_get_codec may return NULL
> > thus causing crashes such as when running AVRCP/TG/VLH/BI-01-C after
> > AVRCP/TG/RCR/BV-04-C
> > ---
> >  profiles/audio/a2dp.c | 17 ++++++++++++++---
> >  1 file changed, 14 insertions(+), 3 deletions(-)
> >
> > diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
> > index f761dbe54..7da008071 100644
> > --- a/profiles/audio/a2dp.c
> > +++ b/profiles/audio/a2dp.c
> > @@ -1995,7 +1995,12 @@ static gboolean get_codec(const GDBusPropertyTab=
le *property,
> >  {
> >         struct a2dp_remote_sep *sep =3D data;
> >         struct avdtp_service_capability *cap =3D avdtp_get_codec(sep->s=
ep);
> > -       struct avdtp_media_codec_capability *codec =3D (void *) cap->da=
ta;
> > +       struct avdtp_media_codec_capability *codec;
> > +
> > +       if (!cap)
> > +               return FALSE;
> > +
> > +       codec =3D (void *) cap->data;
> >
> >         dbus_message_iter_append_basic(iter, DBUS_TYPE_BYTE,
> >                                                 &codec->media_codec_typ=
e);
> > @@ -2008,10 +2013,16 @@ static gboolean get_capabilities(const GDBusPro=
pertyTable *property,
> >  {
> >         struct a2dp_remote_sep *sep =3D data;
> >         struct avdtp_service_capability *service =3D avdtp_get_codec(se=
p->sep);
> > -       struct avdtp_media_codec_capability *codec =3D (void *) service=
->data;
> > -       uint8_t *caps =3D codec->data;
> > +       struct avdtp_media_codec_capability *codec;
> > +       uint8_t *caps;
> >         DBusMessageIter array;
> >
> > +       if (!service)
> > +               return FALSE;
> > +
> > +       codec =3D (void *) service->data;
> > +       caps =3D codec->data;
> > +
> >         dbus_message_iter_open_container(iter, DBUS_TYPE_ARRAY,
> >                                         DBUS_TYPE_BYTE_AS_STRING, &arra=
y);
> >
> > --
> > 2.25.1
>
> We should either have a .exist callback or not have the endpoint
> registered if its codec is not available, I'm leaning toward the
> latter given that it is useless to have the endpoint if it cannot be
> used without the codec information.

In case you missed my response on slack, here is the suggestion change:

diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
index c3ac432a7..28654924b 100644
--- a/profiles/audio/a2dp.c
+++ b/profiles/audio/a2dp.c
@@ -2074,6 +2074,11 @@ static struct a2dp_remote_sep
*register_remote_sep(void *data, void *user_data)
        if (sep)
                return sep;

+       if (avdtp_get_codec(rsep)) {
+               error("Unable to get remote sep codec");
+               return NULL;
+       }
+
        sep =3D new0(struct a2dp_remote_sep, 1);
        sep->chan =3D chan;
        sep->sep =3D rsep;


>
>
>
> --
> Luiz Augusto von Dentz


--=20
Luiz Augusto von Dentz