Received: by 2002:a05:7412:8d10:b0:f3:1519:9f41 with SMTP id bj16csp7045815rdb; Fri, 15 Dec 2023 16:36:03 -0800 (PST) X-Google-Smtp-Source: AGHT+IETuosbtD0eYwbCVlEi7JR9qaLgU/MOAhKgprMl7I1XhiI20/ACWUxQSEI1kswA29Nz21bg X-Received: by 2002:a2e:854e:0:b0:2cc:553a:bc28 with SMTP id u14-20020a2e854e000000b002cc553abc28mr536060ljj.25.1702686962995; Fri, 15 Dec 2023 16:36:02 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702686962; cv=none; d=google.com; s=arc-20160816; b=c24RpHS/nJsdxsfXp8Wvrj3RXC5iKYwbSh31FT+A2AC5K3iYHFU0C9q2hOU/lfQ8Mr Gjedf+Qna+kaEm+sm1xQxDxJw8aXI3KdmgxgQZ8kVZ2u8dzLVkOpiQzsg/jtmIFR9ecT vRapBJsmOl7W6BzXe8hPtCNNDTe2d8YSdTK+tN6oX4YLi4CypiG2GMf258yL22AepOqO NOuHQQh3IkivJjCA/+iWkbkf9HrKzbqFs8GL8XpASElZFaYzuK+hsPE/YWyGWkYLiFM8 LZT147SSO8aCCd9Qaoj+GPd6HFOMRroUV6JmAKzbl0FavsuqdJEFf1dlk2ZsUi+qHM9K 1R+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=z1tq4LZQMP2/9wCtMopsRRNH3slzI1TMbtqu4DH2GTQ=; fh=ggqA6g6XBppUQbjJvtR6Zzm4jz0KI8osHm1N4etBQy0=; b=J3ti94uf7n9/QicGDX1V1qVawH1pdQAhOMk2lEyyap1mP0Q/k5IQfnVbnz1ncRrWjH awGHGJsibgWe8P7LfvGnab8wizyCEyYh5fm/jyIt1INEdgACgptqvn9PloAlnJjCwIpD /DzEng9pfYZBByYvNqz0h2EZ3OwBJhD8vT6f4c/OM2xXkeqWRxB9IvEe0MLfuixiO+O+ hHcQdw9IzEebGd9kwjAwX3000l3ZI1rRRRYJzec8ZXECcS5cg5jnaiZ4H042UDri3+JE zNY0oa+6CAitRkO0kXoQyn2sN0Jdoo1bnRbvZL48uHR7XaoLmSHkuz2uJm7w1ryVZW4x WFbA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@rjp.ie header.s=key1 header.b=mn9Y9CoI; spf=pass (google.com: domain of linux-bluetooth+bounces-627-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-bluetooth+bounces-627-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=rjp.ie Return-Path: Received: from am.mirrors.kernel.org (am.mirrors.kernel.org. [2604:1380:4601:e00::3]) by mx.google.com with ESMTPS id c29-20020a50d65d000000b0055228860915si2814148edj.32.2023.12.15.16.36.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Dec 2023 16:36:02 -0800 (PST) Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-627-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3; Authentication-Results: mx.google.com; dkim=pass header.i=@rjp.ie header.s=key1 header.b=mn9Y9CoI; spf=pass (google.com: domain of linux-bluetooth+bounces-627-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) smtp.mailfrom="linux-bluetooth+bounces-627-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=rjp.ie Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id B155E1F20F52 for ; Sat, 16 Dec 2023 00:36:02 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 6867C10A2D; Sat, 16 Dec 2023 00:31:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=rjp.ie header.i=@rjp.ie header.b="mn9Y9CoI" X-Original-To: linux-bluetooth@vger.kernel.org Received: from out-188.mta0.migadu.com (out-188.mta0.migadu.com [91.218.175.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 698AD15E94 for ; Sat, 16 Dec 2023 00:30:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=rjp.ie Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rjp.ie X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rjp.ie; s=key1; t=1702686658; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=z1tq4LZQMP2/9wCtMopsRRNH3slzI1TMbtqu4DH2GTQ=; b=mn9Y9CoI+0bPuqJTcZM/2SKaOmjzdm22l1OVepjgC+s4/41HrOyB16P5AevD4KNv6X5j3D yOzPioyVwdhX60bfZKGiT+38xBEX3ajVrYT5OTb31A5epi3XYGVVlMrX78Us6E9NmSizAg g7SpzllXqDIbxdbkZpziuvohrnj8cMY= From: Ronan Pigott To: silviu.barbulescu@nxp.com Cc: andrei.istodorescu@nxp.com, claudia.rosu@nxp.com, iulia.tanasescu@nxp.com, linux-bluetooth@vger.kernel.org, mihai-octavian.urzica@nxp.com, vlad.pruteanu@nxp.com, Ronan Pigott Subject: Re: [PATCH v3 1/2] transport: Update transport release flow for bcast src Date: Fri, 15 Dec 2023 17:29:15 -0700 Message-ID: <20231216002918.55577-1-ronan@rjp.ie> In-Reply-To: <20231004075646.4277-2-silviu.barbulescu@nxp.com> References: <20231004075646.4277-2-silviu.barbulescu@nxp.com> Precedence: bulk X-Mailing-List: linux-bluetooth@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT Hi Silviu, I encountered a use-after-free in the 5.71 release of Bluez which I bisected to this patch. The backtrace is below: #0 0x000055e93dbc8785 in a2dp_suspend_complete (session=, err=0, user_data=0x55e93e432520) at profiles/audio/transport.c:431 #1 0x000055e93dbb97ea in finalize_suspend (data=data@entry=0x55e93e435880) at profiles/audio/a2dp.c:376 #2 0x000055e93dbb98c0 in suspend_cfm (session=0x55e93e4317b0, sep=, stream=, err=0x0, user_data=0x55e93e41e850) at profiles/audio/a2dp.c:1276 #3 0x000055e93dbbfa4b in avdtp_suspend_resp (data=0x55e93e431823, size=, stream=0x55e93e433e60, session=0x55e93e4317b0) at profiles/audio/avdtp.c:2900 #4 avdtp_parse_resp (transaction=, size=, buf=0x55e93e431823, signal_id=, stream=0x55e93e433e60, session=0x55e93e4317b0) at profiles/audio/avdtp.c:2985 #5 session_cb (chan=, cond=, data=0x55e93e4317b0) at profiles/audio/avdtp.c:2286 #6 0x00007f5e225b9f69 in g_main_dispatch (context=0x55e93e3c6800) at ../glib/glib/gmain.c:3476 [...] Originally reported in [1] [1] https://gitlab.archlinux.org/archlinux/packaging/packages/bluez/-/issues/3 Cheers, Ronan