Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-1545-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: linux-bluetooth@vger.kernel.org
Subject: [PATCH BlueZ v2 7/8] transport: Fix crash when disable bcast stream
Date: Thu,  1 Feb 2024 14:10:15 -0500
Message-ID: <20240201191016.1122194-7-luiz.dentz@gmail.com>
In-Reply-To: <20240201191016.1122194-1-luiz.dentz@gmail.com>
References: <20240201191016.1122194-1-luiz.dentz@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

bt_bap_stream_disable does cause the stream to go to releasing state
removing the owner in the process so calling bap_disable_complete
passing the existing owner would likely cause a crash.
---
 profiles/audio/transport.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/profiles/audio/transport.c b/profiles/audio/transport.c
index 796017a4c6de..bd8960ef74fd 100644
--- a/profiles/audio/transport.c
+++ b/profiles/audio/transport.c
@@ -1532,7 +1532,8 @@ static guint transport_bap_suspend(struct media_transport *transport,
 	id = bt_bap_stream_disable(bap->stream, bap->linked, func, owner);
 
 	if (bt_bap_stream_get_type(bap->stream) == BT_BAP_STREAM_TYPE_BCAST) {
-		bap_disable_complete(bap->stream, 0x00, 0x00, owner);
+		if (transport->owner == owner)
+			bap_disable_complete(bap->stream, 0x00, 0x00, owner);
 		return 0;
 	}
 
-- 
2.43.0