Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-2103-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Silviu Florian Barbulescu <silviu.barbulescu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	vlad.pruteanu@nxp.com,
	andrei.istodorescu@nxp.com,
	luiz.dentz@gmail.com,
	iulia.tanasescu@nxp.com
Subject: [PATCH BlueZ 1/1] shared/bap: Fix crash unreg bcast src endpoint
Date: Fri, 23 Feb 2024 16:16:09 +0200
Message-Id: <20240223141609.27181-2-silviu.barbulescu@nxp.com>
In-Reply-To: <20240223141609.27181-1-silviu.barbulescu@nxp.com>
References: <20240223141609.27181-1-silviu.barbulescu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?KhVhQw0wpCfAcKUJ7/w5/GdwaPltVhXxpsWMQe3FRV8rPhC8OGCwwS0731ZR?=
 =?us-ascii?Q?ebzxMEk3oaKcsAUzhIAaNmuoDPQWRUPm2bmpxPXNunwUD5CJTWxy9JXJJoWZ?=
 =?us-ascii?Q?0kDygeVp7KS+YlGOMvMHj4oMAuKGF2MmRIXMvoKIN48jd5MsSc2muYZ2RzW3?=
 =?us-ascii?Q?pj9YQ9yi0TC8wyfQ7iAuhr6fZBSzz+pO8zOWEgYQLXNwLnubcQXJn9GjpIva?=
 =?us-ascii?Q?rofBw1+1JhcmpBZhH+OTbgMXNpThI2kIXO4SHeo8tWEiBXDF3zvt9DjyPTlg?=
 =?us-ascii?Q?L3YtpKS7L8dZTnV1wpyFmAiK5vdpAOURcyk/LOT3C26BHDYn6oducqxphCCi?=
 =?us-ascii?Q?YXDh59r1sSyPAKEShllUDgvuk/JLsHnOkU4cjqG4QrGJOcpme+a4/lw97IcA?=
 =?us-ascii?Q?kdayd1KvE38sx0GfXAeTdoutL4iV+hK/8FerHWCiz13fhNUCjpNgUw3NWlB0?=
 =?us-ascii?Q?/QpzV2qfwvvt3sRadazAS+Y4izwzCvbfGY41STJ7oo/vVJMyrgcP/O+mwioc?=
 =?us-ascii?Q?CIxbiVlhstwETtfn+7OiA3m1DnSMvGjjNDbo2qHDcbp/IqTYnq0s0J6WX7CP?=
 =?us-ascii?Q?kAerH6D1oej9+8q8k+s2dEG68AsQC+KyzCqCDqZk7PWy1oY82Ms0muQs1UUf?=
 =?us-ascii?Q?ftCVkRXKHsZxZHf0YSlHwWw33giM5cTWr1LSuRoPoSuGnWrjnJUe6lKZd+NL?=
 =?us-ascii?Q?K5sTbvA9IPhcrn2xCWH+sJOKjMyioE0SgEK44DZozHWphkolWHh8wQS5OjHN?=
 =?us-ascii?Q?zXl0R+ccaO6nQ7E4n7CCe3o3n57qyYElEShZ/3ovUi2rCG3jSZ4JCYLPkBKy?=
 =?us-ascii?Q?+tHLomxJkzi3B4NS+G5FUE78iNNouc54btOAkqBE8N8j45GTnv/jTcC4neCm?=
 =?us-ascii?Q?yssSLUS71dfAOk1lMHNEwK7PfmDbDn0/IeUrWqXA2ipL4SMCGFGgRvWuTeni?=
 =?us-ascii?Q?bUib5FoAdxYIZxXQ0JYHk64lyiOwfIdvoO885NzacGIJ0/wj3LOJ7P5osEov?=
 =?us-ascii?Q?MK7ERi64oC/V7sLoM+V0TqVJIOrtdC7ieJcTX8nowHrcYCs54HeMx3HxwbE2?=
 =?us-ascii?Q?ZXWj8HYeXlY4TvKvU97P4FL2/3U+2/wVkyqyEemCoki9ykCjxfMMzLvWvu8o?=
 =?us-ascii?Q?dcjZ1HyNl2JL0plokrbLlxAFkYv0Q2jkZWTvU80s7PRjAcx2UvJnPjXiHAhe?=
 =?us-ascii?Q?ypJD7O84CZpg/7cgEYL5bUPM2qfT29VRBcnKexHSIc//+XBiJ4pZrDEdbXp8?=
 =?us-ascii?Q?rTy1mG2v0/e0NptVpqBk4wopoenF/UR1hF56ZosEjjxxKykJd2LzeNlR7lmj?=
 =?us-ascii?Q?d749aw3QXrORhNJqsIJN2sopWalf6CyGh+rWdkHYJS2IQrJNGghIhmzlZSVA?=
 =?us-ascii?Q?ng3srE03qzzTYiMoeHAK5tGO9Jy3uRfvWQFk6ieceTDRYxOtW6m7HTqeaohP?=
 =?us-ascii?Q?DuCaW64Yvh4mpULkv2JKhtV7cUiSyFz5P589SCZCCUtSKje3e8dkfoytpH3W?=
 =?us-ascii?Q?FAdZoLU34+g4G6x4nsRwtHbBTPz65ceHZtBjtieeG5sc/JtIOuuBm2tss6YM?=
 =?us-ascii?Q?buVkaBnEndQEnntno0OmSIh5i5D8fzyb/+UhdGB+bj3LlvCW7ELxJxDDGO3G?=
 =?us-ascii?Q?4w=3D=3D?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9d1d1f0c-a67b-4836-c967-08dc3479fef0
X-MS-Exchange-CrossTenant-AuthSource: VI1PR04MB10073.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Feb 2024 14:16:15.3589
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: iTtE1aFVmwAc2Zfjf3MXW8JtrzJG6zJsMGTZsJpGM56/npSmv7vyziiTlgJHaGgBKz0B0334yvMZwVfKC+IASSjocUgptEi5DWF0nex1F1g=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS5PR04MB9731

In bt_bap_stream_release stream is accessed after free

---
 src/shared/bap.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index f5fc14027..626e8f127 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -5411,16 +5411,17 @@ unsigned int bt_bap_stream_release(struct bt_bap_stream *stream,
 					void *user_data)
 {
 	unsigned int id;
+	struct bt_bap *bap = stream->bap;
 
 	if (!stream || !stream->ops || !stream->ops->release)
 		return 0;
 
-	if (!bt_bap_ref_safe(stream->bap))
+	if (!bt_bap_ref_safe(bap))
 		return 0;
 
 	id = stream->ops->release(stream, func, user_data);
 
-	bt_bap_unref(stream->bap);
+	bt_bap_unref(bap);
 
 	return id;
 }
-- 
2.39.2