Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Nitin Jadhav <nitin.jadhav@nxp.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     devyani.godbole@nxp.com, pav@iki.fi, luiz.dentz@gmail.com,
        sathish.narasimman@intel.com, nitin.jadhav@nxp.com
Subject: [PATCH BlueZ v1 1/1] shared/vcp: Fixed the crash observed with VOCS when pairing with LE Audio TWS earbuds
Date:   Mon, 24 Jul 2023 11:55:30 +0300
Message-Id: <20230724085530.5555-2-nitin.jadhav@nxp.com>
In-Reply-To: <20230724085530.5555-1-nitin.jadhav@nxp.com>
References: <20230724085530.5555-1-nitin.jadhav@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?v7Jf15vf/yNYhM86ToZY50ye0YEEBr+3i7S/5eX01J5E6eK+6jwF2Gw2jIUS?=
 =?us-ascii?Q?RaGpc6dRjU9vikC127QvXHlMCegD2IsG3nOe4DkI7h/ARvvQCSJa2VQG6kYk?=
 =?us-ascii?Q?BJuAVUwqA89e4zllMN+KdtZxK0uxLni3cEei7yTCc9Y5mkviLNOVten/dnO4?=
 =?us-ascii?Q?HIy7XDBJBiOV1J9QwNHPMukXboFmbkhAdOn4qyM7HJ5ybLVr+LvdMa8+eOKQ?=
 =?us-ascii?Q?pJSIzZrZSRJ3xEQBTYj4mLjcPXcX2k+HXXQDu/5d54mRkau3znNESdG/6aWx?=
 =?us-ascii?Q?dKrQxRCwqJTjOrY1uz6Qv5JHuJzT8UP/jtcBMgKBeE8LUIQ+b7GCtiPihdCP?=
 =?us-ascii?Q?ZiG86j5Kidj0QIR9jM/CVnNVNN3tMqrJ80vHyvb70G+/E+9ZZXgep4aI/fpe?=
 =?us-ascii?Q?eTRm7Bcs4QQTZpmT1exYrT03cWThaOobR3N2WfAPtU10wqwUwaDi2BimeotP?=
 =?us-ascii?Q?AopIPovhR2GWPS/eH/MUS1CgGgJFAREyyL5qXJldbTjAJ7rJQsZ6Bbud8tHg?=
 =?us-ascii?Q?ysqlg/KB2MFQlGCZyzC0/2FTkxmpM/daGmZzMIl3n5ChgraThqf72G+Ky0k0?=
 =?us-ascii?Q?mM42RsvYsnXs4rsG0ezuT1yNr0PSKFAk8R1ZigkKUaInxJ/eFMuYC66a/C3o?=
 =?us-ascii?Q?iG9OoGva9eOQzbEMIzE4AtTWHABDX8kTvXs8XeYMX/x90Ed3DvAdCtKrqGjH?=
 =?us-ascii?Q?TEvlTM9tzXC+TkQ2asIeSQ2Qpimlpg0ZUcBGsmm2gv3cR6qXiha3aofhcjk8?=
 =?us-ascii?Q?+s760RqSyAwafEC7nuH9gHL6DoUDp91Ude81S9KlHTrBxbC4b1TSNMH/VAEf?=
 =?us-ascii?Q?a1HwRvmSv8Anysv55vtDtkX3USmZz0ZU+in9J1kuDviBVhxY4gcxCgMU15vi?=
 =?us-ascii?Q?wSR+/AYEQ5mR63+PZlAh4rOeQCMq52q3Ab+pIM6p7jJw1dyxuxdfsP832Irz?=
 =?us-ascii?Q?dnk+5NgWNUdCK8dK7lnvcU8YfgGzxYuBGMFrP34FjUBrq38a1cHyT6wU2J+T?=
 =?us-ascii?Q?dvyKU20Dn8ocxvLZfTX+HNnjwovUkGsUqSahNBMBN/tecqA5kGD8hAXNZK18?=
 =?us-ascii?Q?YmU3J/7xMVFdwKcRfwSbEUxKDHgNF8WhRp4KctortWmUYiPcUWVGUsXdcpO1?=
 =?us-ascii?Q?n3fNOlfiC1rNz6+pnZ3lOJFnmKxW8osn9BZoo4jDK2THNuqmduRIGg0VQi8M?=
 =?us-ascii?Q?cjrej1fyl5BWjLdBZOpfD+pVGd1qgteliwfKI4CLyoFyZViZX2Ez1x1z94TH?=
 =?us-ascii?Q?ccbB1DQ6zp/nlIYSuj6+22goaijafXQtOc0VOUobDGalzd9ACcQZfsxmr1u7?=
 =?us-ascii?Q?VWt7PkLdBaOOjZmBtsmdzO5X25UlnoM+JBAI3uEYVsIOv9GXE3O3LGDkqotC?=
 =?us-ascii?Q?LSjlwDBFSxXf/Suo3PYKkTU8GfZD0SIcbgRNgXef0/iE6fwj1UnVDE28yUbC?=
 =?us-ascii?Q?TTRMx1eW+EZJUPvT2F8Yo1zZbyX1FcXpfc/su7sjcmW2xqaFMagMnsss7Jwy?=
 =?us-ascii?Q?B2EYrkhCLg6ILaN9jnJ/BnDdIOFRBGSUsoSLoZd4MVeK4Hw4uR9yecdtUZmH?=
 =?us-ascii?Q?pcIU31D8AuACqf6MrhYObTWRB7r4i6JD8OJISxFE?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 90c59792-0e06-4e4a-10af-08db8c23d371
X-MS-Exchange-CrossTenant-AuthSource: AS8PR04MB9126.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jul 2023 08:56:10.5018
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 7SYKUShL5s3LynAFaJ4pPyATmPO7+5i4Uv3+LPtO8F6WffbNaLhxZ/bXyDuGsiHk2DR7miJVvaSgeEkbq+CpZg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR04MB8537
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

Root cause
- There are two types of database- Remote and Local (rdb and ldb).
- In client mode currently the code was written to access ldb.

Fix
- Correcting it, to access rdb has resolved the problem in VOCS.
- Same correction is done for VCS.

Reported-by: Pauli Virtanen <pav@iki.fi>
---
 src/shared/vcp.c | 52 +++++++++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 23 deletions(-)

diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 74bd01729..f30d7a533 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -973,7 +973,7 @@ static void vocs_voaodec_read(struct gatt_db_attribute *attrib,
 	struct bt_vocs *vocs = user_data;
 	struct iovec iov;
 
-	iov.iov_base = &vocs->vocs_ao_dec;
+	iov.iov_base = vocs->vocs_ao_dec;
 	iov.iov_len = strlen(vocs->vocs_ao_dec);
 
 	gatt_db_attribute_read_result(attrib, id, 0, iov.iov_base,
@@ -998,10 +998,12 @@ static struct bt_vcs *vcs_new(struct gatt_db *db, struct bt_vcp_db *vdb)
 
 	/* Populate DB with VCS attributes */
 	bt_uuid16_create(&uuid, VCS_UUID);
-	vcs->service = gatt_db_add_service(db, &uuid, true, 9);
+
+	vcs->service = gatt_db_add_service(db, &uuid, true, 10);
 	gatt_db_service_add_included(vcs->service, vdb->vocs->service);
 	gatt_db_service_set_active(vdb->vocs->service, true);
 
+
 	bt_uuid16_create(&uuid, VOL_STATE_CHRC_UUID);
 	vcs->vs = gatt_db_service_add_characteristic(vcs->service,
 					&uuid,
@@ -1385,11 +1387,12 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
 				     const uint8_t *value, uint16_t length,
 				     void *user_data)
 {
-	uint32_t *vocs_audio_loc;
-	struct iovec iov = {
-		.iov_base = (void *) value,
-		.iov_len = length,
-	};
+	uint32_t vocs_audio_loc;
+
+	if (!value) {
+		DBG(vcp, "Unable to get VOCS Audio Location");
+		return;
+	}
 
 	if (!success) {
 		DBG(vcp, "Unable to read VOCS Audio Location: error 0x%02x",
@@ -1397,26 +1400,25 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
 		return;
 	}
 
-	vocs_audio_loc = iov_pull_mem(&iov, sizeof(uint32_t));
-	if (!*vocs_audio_loc) {
-		DBG(vcp, "Unable to get VOCS Audio Location");
-		return;
-	}
+	memcpy(&vocs_audio_loc, value, length);
 
-	DBG(vcp, "VOCS Audio Loc:%x", *vocs_audio_loc);
+	DBG(vcp, "VOCS Audio Loc:%x", vocs_audio_loc);
 }
 
-
 static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
 				       uint8_t att_ecode,
 				       const uint8_t *value, uint16_t length,
 				       void *user_data)
 {
 	char *vocs_ao_dec_r;
-	struct iovec iov = {
-		.iov_base = (void *) value,
-		.iov_len = length,
-	};
+
+	if (!value) {
+		DBG(vcp, "Unable to get VOCS Audio Descriptor");
+		return;
+	}
+
+	vocs_ao_dec_r = malloc(length+1);
+	memset(vocs_ao_dec_r, 0, length+1);
 
 	if (!success) {
 		DBG(vcp, "Unable to read VOCS Audio Descriptor: error 0x%02x",
@@ -1424,13 +1426,17 @@ static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
 		return;
 	}
 
-	vocs_ao_dec_r = iov_pull_mem(&iov, length);
-	if (!*vocs_ao_dec_r) {
+	memcpy(vocs_ao_dec_r, value, length);
+
+	if (!vocs_ao_dec_r) {
 		DBG(vcp, "Unable to get VOCS Audio Descriptor");
 		return;
 	}
 
-	DBG(vcp, "VOCS Audio Descriptor:%s", *vocs_ao_dec_r);
+	DBG(vcp, "VOCS Audio Descriptor: %s", vocs_ao_dec_r);
+
+	free(vocs_ao_dec_r);
+	vocs_ao_dec_r = NULL;
 }
 
 static void vcp_pending_destroy(void *data)
@@ -1719,10 +1725,10 @@ bool bt_vcp_attach(struct bt_vcp *vcp, struct bt_gatt_client *client)
 		return false;
 
 	bt_uuid16_create(&uuid, VCS_UUID);
-	gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vcs_service, vcp);
+	gatt_db_foreach_service(vcp->rdb->db, &uuid, foreach_vcs_service, vcp);
 
 	bt_uuid16_create(&uuid, VOL_OFFSET_CS_UUID);
-	gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vocs_service, vcp);
+	gatt_db_foreach_service(vcp->rdb->db, &uuid, foreach_vocs_service, vcp);
 
 	return true;
 }
-- 
2.34.1