Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-1573-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
From: Iulia Tanasescu <iulia.tanasescu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: claudia.rosu@nxp.com,
	mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	vlad.pruteanu@nxp.com,
	andrei.istodorescu@nxp.com,
	luiz.dentz@gmail.com,
	Iulia Tanasescu <iulia.tanasescu@nxp.com>
Subject: [PATCH BlueZ 1/3] shared/bap: Properly cleanup bap remote endpoints
Date: Fri,  2 Feb 2024 16:10:34 +0200
Message-Id: <20240202141036.9797-2-iulia.tanasescu@nxp.com>
In-Reply-To: <20240202141036.9797-1-iulia.tanasescu@nxp.com>
References: <20240202141036.9797-1-iulia.tanasescu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?kP2yk8BRzm7C/bWEOIYBN15nVO+TaqS5Skfq//qS7LW4Mcfjw1EA8oeryo+b?=
 =?us-ascii?Q?PWKYeCIYuSrOnkaAUIZ7mlIRe16rDTTbRKXYR3w7K/IxasXV8mUYEU/s/msE?=
 =?us-ascii?Q?5kG4i4q2G5t7KPym/sffhVgS7ZtVmaXp7kZt4yZg0LM1rw9M6uOBubHHq2oS?=
 =?us-ascii?Q?MD0oFRhiicWFUDME/1IekoqWTVPlyGgUIdd8c822IEq+WQ4dg+dHepEJAMZE?=
 =?us-ascii?Q?HZlPpCJZbSodGqKgdUHiHDTc1BeFOupDEs4R/y1KJn/VKs8/3NvJU2zaVLh2?=
 =?us-ascii?Q?+QR+E4wlI5n66kU7lYkWjpRKFVlHa11oQ76/Ut+J5CPprzoPdw9QsSEle4yf?=
 =?us-ascii?Q?ZaSxdSiqoMk/YfCS73qRZCVvhEwFugsGUL93R3Kxw6oamEmaH3fbgPnR+YXl?=
 =?us-ascii?Q?pxaFlXi8Mxup8d60Gga2YjQ5N7oYm1fyE7G1AqE59MDQaULmej0pgA8z+7Ns?=
 =?us-ascii?Q?bdsdIzMo6kodOW55o8WeDhNjrKht+pgxuDExZiXHRChl363RJi/He2m3ll0B?=
 =?us-ascii?Q?87LUNC79YKjsBQXZsm6iAsH1GP8UMh9Le31YGomAt7dKS6vfligIYQSWxlb2?=
 =?us-ascii?Q?wydwA8d68JgOtch6xx2MX1GwT5ZP/ALTfM6snhQ1+gnHtUQWWs6WY50jTQdW?=
 =?us-ascii?Q?8gYuE+Kib59KPfnDIVZ3Z27YNWXU8P32zC8eOnP1EWm3FjDfInSvceZez0Lz?=
 =?us-ascii?Q?7shO7o4rWCIIZyqGb9zkmPYda85yftRrL5QgkSeBEkOLb9I3UfQVljkSnTKq?=
 =?us-ascii?Q?mZh+ZeaPsShKa2uV3F84f5tH7QYcfNXmy15jzqHI6R2SNgIE+WMt+TMjdEZm?=
 =?us-ascii?Q?nvtbkdlXgM6mmi4UjyZ9AddfROvRtdoIHAd4LkYWrw9MgtQ/UzELvzTf8rhS?=
 =?us-ascii?Q?2MXEvxCc9HelQ4BxakGEB/ws6OVlmSJVcJrVPtjF3Z+rtvx3Ymtal9pDuByK?=
 =?us-ascii?Q?KgYSK0G+DLnR8GrWn9IFZEq2CJK847xyzcXY42g+ByI/aoer5jTW9Z+CdbVW?=
 =?us-ascii?Q?S6/PaUDw24+xkBpL+WDz1myFoeU5JVwdk3uEtiPb/MxBx53E8Dkl1qJ6KZgL?=
 =?us-ascii?Q?SnApCqbrIYi0Lvl8fLDJ0GLHLKBP0R2dF/CWjlOjnu6ACVvBV6V/hpSbYooQ?=
 =?us-ascii?Q?5RTVv/QOgYlII/MuI2XZY7j3s7XCTYNFs39zl+7Bjq0ROxxoRX75PkGCg1uc?=
 =?us-ascii?Q?q4tp0XwkaDnf4eQXbeS4cyhLQ8g+5g5Ms91nTU471LURu7N6GcDYj3dKiGsL?=
 =?us-ascii?Q?sZi/BBcLhtVncJiLwi48PMQBd3BVcWPTP9ktD1lcOtR9dhDF6LswgcYf7VC3?=
 =?us-ascii?Q?YQRinekQsSWaWBuPwsAtypd44FxXKraXRkvpXg5PnQrQ018a9qcqtJNr6AMq?=
 =?us-ascii?Q?s+c0cULsJM7Rkm7u7KXG6/Q99d+g10xJcz9wR7tzWL/wB54yJZrN4myUSnAX?=
 =?us-ascii?Q?5GXLkH1aKYwnQXRMtTr4IDVAjaM/+kxNnPk3ilJDvT4LU+c2/q1ZSP2ulR70?=
 =?us-ascii?Q?ajWRE6w5/kq3V3gF0S8+JcxY++RnNy4i9OZAmfod7qbPR63EowqeZBt0L4ki?=
 =?us-ascii?Q?QFaG6Qf+gWTVd+U4xmgJ9LWrWhuoQ+H2ZF/wg5GM28+dxLhLDtglKUyc/wFm?=
 =?us-ascii?Q?DQ=3D=3D?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 61d5af30-be27-40ca-51e3-08dc23f8bffc
X-MS-Exchange-CrossTenant-AuthSource: AS8PR04MB8898.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Feb 2024 14:10:46.0724
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 1Ql+xvC4c4epyeCHlVf1mjmla/aVMiRlF+54C3aXbXKmwxNjNmiov3lICAWVhq/UQ1vVLuGK3iE04ai9YGnvFw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4PR04MB7999

When freeing a remote bap endpoint, the endpoint reference inside the
stream should be set to NULL, to avoid later use after free errors.
---
 src/shared/bap.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index 851d6a5fa..60fb826c3 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -2979,6 +2979,16 @@ static void bap_state_free(void *data)
 	free(state);
 }
 
+static void bap_ep_free(void *data)
+{
+	struct bt_bap_endpoint *ep = data;
+
+	if (ep && ep->stream)
+		ep->stream->ep = NULL;
+
+	free(ep);
+}
+
 static void bap_detached(void *data, void *user_data)
 {
 	struct bt_bap_cb *cb = data;
@@ -3001,7 +3011,7 @@ static void bap_free(void *data)
 	queue_destroy(bap->ready_cbs, bap_ready_free);
 	queue_destroy(bap->state_cbs, bap_state_free);
 	queue_destroy(bap->local_eps, free);
-	queue_destroy(bap->remote_eps, free);
+	queue_destroy(bap->remote_eps, bap_ep_free);
 
 	queue_destroy(bap->reqs, bap_req_free);
 	queue_destroy(bap->notify, NULL);
-- 
2.39.2