Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To:     linux-bluetooth@vger.kernel.org
Subject: [PATCH BlueZ] transport: Fix crash on Transport.Acquire
Date:   Fri, 30 Jun 2023 12:26:42 -0700
Message-Id: <20230630192642.3591626-1-luiz.dentz@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This fixes crash introduced by 3030883 which caused requests not be
initialized properly for A2DP.

Fixes: https://github.com/bluez/bluez/issues/542
---
 profiles/audio/transport.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/profiles/audio/transport.c b/profiles/audio/transport.c
index 48a40858b873..77216e10b3b3 100644
--- a/profiles/audio/transport.c
+++ b/profiles/audio/transport.c
@@ -539,7 +539,7 @@ static DBusMessage *acquire(DBusConnection *conn, DBusMessage *msg,
 {
 	struct media_transport *transport = data;
 	struct media_owner *owner;
-	struct media_request *req;
+	struct media_request *req = NULL;
 	guint id;
 
 	if (transport->owner != NULL)
@@ -549,20 +549,21 @@ static DBusMessage *acquire(DBusConnection *conn, DBusMessage *msg,
 		return btd_error_not_authorized(msg);
 
 	owner = media_owner_create(msg);
-	if (bt_bap_stream_get_type(get_stream_bap(transport)) ==
-				BT_BAP_STREAM_TYPE_BCAST) {
+
+	if (!strcmp(media_endpoint_get_uuid(transport->endpoint),
+						BAA_SERVICE_UUID)) {
 		req = media_request_create(msg, 0x00);
 		media_owner_add(owner, req);
 		media_transport_set_owner(transport, owner);
 	}
+
 	id = transport->resume(transport, owner);
 	if (id == 0) {
 		media_owner_free(owner);
 		return btd_error_not_authorized(msg);
 	}
 
-	if (bt_bap_stream_get_type(get_stream_bap(transport)) ==
-				BT_BAP_STREAM_TYPE_UCAST) {
+	if (!req) {
 		req = media_request_create(msg, id);
 		media_owner_add(owner, req);
 		media_transport_set_owner(transport, owner);
-- 
2.40.1