Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Nitin Jadhav <nitin.jadhav@nxp.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     devyani.godbole@nxp.com, pav@iki.fi, luiz.dentz@gmail.com,
        sathish.narasimman@intel.com, nitin.jadhav@nxp.com
Subject: [PATCH BlueZ v2 1/1] shared/vcp: Fixed the crash observed with VOCS
Date:   Mon, 24 Jul 2023 15:29:08 +0300
Message-Id: <20230724122908.42409-2-nitin.jadhav@nxp.com>
In-Reply-To: <20230724122908.42409-1-nitin.jadhav@nxp.com>
References: <20230724122908.42409-1-nitin.jadhav@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?J0Muxt50/riN3vYWDIUEQ+yPEe3TV83bCtQHrLeCY8W53u0gLOFpoag5FDPL?=
 =?us-ascii?Q?fJeAdJZny9Vc60L4ZnplgutNIPjArpfaLnR22x0h9DYN0MNuAtA3zxry2kmK?=
 =?us-ascii?Q?zvguHJqL+btqAvHDo6RiA9KPMsZzgGOHi4LBLwEd4BOgHV+6U0oV1t3NcheC?=
 =?us-ascii?Q?F0GPt0Plvi27Wh9/3PqfkQ9EnigHvbmsdYuakajrSE6rKmJXrBdn/8O+F2D5?=
 =?us-ascii?Q?h7ZEKFDYStC3xIKyeqgJFTN/v6fBZVJExbvmdPwG3WuKqsR0E4bbOrIL8tSm?=
 =?us-ascii?Q?e2S2goKZpvWMirubRVEIL+4QLJ4da51PiAYmtD5XRrgNP/wYDwHU4OikaS8w?=
 =?us-ascii?Q?Ea1Fo6lnyxkjWbl2uwjkucleGBbJyeaDzqJ/isgm76BooMy/gQiJYujaFaGa?=
 =?us-ascii?Q?/XKrC7iqKi+ZDB3vxByICyb85mJepaP2TX8D5LQ9H6egTXWacxc6OdkaMHDg?=
 =?us-ascii?Q?hoAHPTVVh0tPFiFyJztuHXlDQ3Wr/I+QD/52xnE9lFzBXNyKM0pWG4DkXBcB?=
 =?us-ascii?Q?ueFF4GH8xnJ2MD3JQc8sjXvTYIxMZvVZwSyRi/GnFcVhoIWWtRuwVUbd4fOd?=
 =?us-ascii?Q?97t2dC6fV7rbZzYbzMzgAGngfwlsxRTsAJOeNx3t+kGstyVKfLcvK1O04gzC?=
 =?us-ascii?Q?OCPs2U2vGPCsXaOYdw0J4YnG/Ld2gHv2hBd5raaqikM49dyuDKYgOnWQYT4z?=
 =?us-ascii?Q?zFbJXoXgd71hjonIvQN9EBZWSKNAp5tKoV4s4MRVFmuo+DzJdYpsNYHbXP+6?=
 =?us-ascii?Q?8FZfgVoFUZB3KQQdI5lAPbr07/HOx5zGC7HH8c1ztDk9V2uRtoPPiNKTNFnB?=
 =?us-ascii?Q?KBNAaRLFQZPX3PViK589M7NtkfZz5QPnBFJ3pE/M8ATIH3c2CiRS8Qk6esH2?=
 =?us-ascii?Q?wd433Na+lfsT3cTwxAEAx/CKy5iXVNT1m778DlHQr0Jppi/n5Gu3k6dBFd7o?=
 =?us-ascii?Q?Ea6yoTgIVnSqdr5Y+gDID6aVbm7d/Mt0EElTqneU2hyC1iO+vnvTcdIrKRbC?=
 =?us-ascii?Q?hviTDBpxqxCcnX2RBdze7x/0OVqvPs5XqNpp5ONj1cVztf0I2nmHb8ddyNSd?=
 =?us-ascii?Q?z+BARhbbfCs07zh6dU2UqUp+tcQHj02pYvEqqr9n/dliKTcbM/O+1CorNuyI?=
 =?us-ascii?Q?+b9GvdOuIEhqahUuAshwz9LYQeTJXXVC0Mwr783ngHjjgUOLHzklMt8uHEhj?=
 =?us-ascii?Q?CDOTQ6IFO1RAdI82UuaEqgHmEUVFcBlVdFWk+aSycK+BadBvZ6hGYoO+ORFE?=
 =?us-ascii?Q?3XX8VDDFDTsEbYhgGAVjYeJJQ5oFqD4ddlj/5LAtVNeJ6HrvbZi0QSMtmF5i?=
 =?us-ascii?Q?LHQc/P0D1F7YfiGs5YHy0LZD1UwPkKc5eHVjDcoKYn9QpnymmenzDhIQOKI0?=
 =?us-ascii?Q?duW+v2mc24ZRFzC/TuSebiyBDOgJR0wjv8WS20clY+zTD/BUeoVVx71fmdja?=
 =?us-ascii?Q?UTLSZfHiiUlhDbk/gp1kv6vhD/kgrnt22iO+RLkV1WdvUgwzj3cFsjtEFwZ7?=
 =?us-ascii?Q?JFMkG4Q/GrLvr3VF/oL7y5ddR2QldTMmcGcU0kF8u+rb0hMdyqXolhQ5VUCH?=
 =?us-ascii?Q?ZVY2rUZYlW89PaKz5wWIj3JQNLUGjCusmFGfyi1u?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 87631648-af25-42f5-b13e-08db8c41b104
X-MS-Exchange-CrossTenant-AuthSource: AS8PR04MB9126.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jul 2023 12:29:57.5937
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: oV38LeZqnt0vEAwJujhlidmLRkboZhxgBXbeIUXIAFwmrYEdzwYYzqyiTCLiaOVaB3oYzIlChMM1NRNZ2jhIuQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM8PR04MB8020
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

Root cause
- There are two types of database- Remote and Local (rdb and ldb).
- In client mode currently the code was written to access ldb.

Fix
- Correcting it, to access rdb has resolved the problem in VOCS.
- Same correction is done for VCS.

Reported-by: Pauli Virtanen <pav@iki.fi>
---
v2: Fixed GitLint and ScanBuild warnings
---
 src/shared/vcp.c | 52 +++++++++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 23 deletions(-)

diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 74bd01729..80d4dfcd4 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -973,7 +973,7 @@ static void vocs_voaodec_read(struct gatt_db_attribute *attrib,
 	struct bt_vocs *vocs = user_data;
 	struct iovec iov;
 
-	iov.iov_base = &vocs->vocs_ao_dec;
+	iov.iov_base = vocs->vocs_ao_dec;
 	iov.iov_len = strlen(vocs->vocs_ao_dec);
 
 	gatt_db_attribute_read_result(attrib, id, 0, iov.iov_base,
@@ -998,10 +998,12 @@ static struct bt_vcs *vcs_new(struct gatt_db *db, struct bt_vcp_db *vdb)
 
 	/* Populate DB with VCS attributes */
 	bt_uuid16_create(&uuid, VCS_UUID);
-	vcs->service = gatt_db_add_service(db, &uuid, true, 9);
+
+	vcs->service = gatt_db_add_service(db, &uuid, true, 10);
 	gatt_db_service_add_included(vcs->service, vdb->vocs->service);
 	gatt_db_service_set_active(vdb->vocs->service, true);
 
+
 	bt_uuid16_create(&uuid, VOL_STATE_CHRC_UUID);
 	vcs->vs = gatt_db_service_add_characteristic(vcs->service,
 					&uuid,
@@ -1385,11 +1387,12 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
 				     const uint8_t *value, uint16_t length,
 				     void *user_data)
 {
-	uint32_t *vocs_audio_loc;
-	struct iovec iov = {
-		.iov_base = (void *) value,
-		.iov_len = length,
-	};
+	uint32_t vocs_audio_loc;
+
+	if (!value) {
+		DBG(vcp, "Unable to get VOCS Audio Location");
+		return;
+	}
 
 	if (!success) {
 		DBG(vcp, "Unable to read VOCS Audio Location: error 0x%02x",
@@ -1397,26 +1400,22 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
 		return;
 	}
 
-	vocs_audio_loc = iov_pull_mem(&iov, sizeof(uint32_t));
-	if (!*vocs_audio_loc) {
-		DBG(vcp, "Unable to get VOCS Audio Location");
-		return;
-	}
+	memcpy(&vocs_audio_loc, value, length);
 
-	DBG(vcp, "VOCS Audio Loc:%x", *vocs_audio_loc);
+	DBG(vcp, "VOCS Audio Loc:%x", vocs_audio_loc);
 }
 
-
 static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
 				       uint8_t att_ecode,
 				       const uint8_t *value, uint16_t length,
 				       void *user_data)
 {
 	char *vocs_ao_dec_r;
-	struct iovec iov = {
-		.iov_base = (void *) value,
-		.iov_len = length,
-	};
+
+	if (!value) {
+		DBG(vcp, "Unable to get VOCS Audio Descriptor");
+		return;
+	}
 
 	if (!success) {
 		DBG(vcp, "Unable to read VOCS Audio Descriptor: error 0x%02x",
@@ -1424,13 +1423,20 @@ static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
 		return;
 	}
 
-	vocs_ao_dec_r = iov_pull_mem(&iov, length);
-	if (!*vocs_ao_dec_r) {
+	vocs_ao_dec_r = malloc(length+1);
+	memset(vocs_ao_dec_r, 0, length+1);
+
+	memcpy(vocs_ao_dec_r, value, length);
+
+	if (!vocs_ao_dec_r) {
 		DBG(vcp, "Unable to get VOCS Audio Descriptor");
 		return;
 	}
 
-	DBG(vcp, "VOCS Audio Descriptor:%s", *vocs_ao_dec_r);
+	DBG(vcp, "VOCS Audio Descriptor: %s", vocs_ao_dec_r);
+
+	free(vocs_ao_dec_r);
+	vocs_ao_dec_r = NULL;
 }
 
 static void vcp_pending_destroy(void *data)
@@ -1719,10 +1725,10 @@ bool bt_vcp_attach(struct bt_vcp *vcp, struct bt_gatt_client *client)
 		return false;
 
 	bt_uuid16_create(&uuid, VCS_UUID);
-	gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vcs_service, vcp);
+	gatt_db_foreach_service(vcp->rdb->db, &uuid, foreach_vcs_service, vcp);
 
 	bt_uuid16_create(&uuid, VOL_OFFSET_CS_UUID);
-	gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vocs_service, vcp);
+	gatt_db_foreach_service(vcp->rdb->db, &uuid, foreach_vocs_service, vcp);
 
 	return true;
 }
-- 
2.34.1