Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-2963-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Vlad Pruteanu <vlad.pruteanu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	iulia.tanasescu@nxp.com,
	andrei.istodorescu@nxp.com,
	luiz.dentz@gmail.com,
	Vlad Pruteanu <vlad.pruteanu@nxp.com>
Subject: [PATCH BlueZ 1/1] bap: Remove entry of deleted device from bcast_pa_requests queue
Date: Fri, 29 Mar 2024 17:40:00 +0200
Message-Id: <20240329154000.6056-2-vlad.pruteanu@nxp.com>
In-Reply-To: <20240329154000.6056-1-vlad.pruteanu@nxp.com>
References: <20240329154000.6056-1-vlad.pruteanu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?OTKa1/O6gds4MfegUlcEZUY6zZXRuaHsHbUtnKXTL/cxA/egXcbcxUz2aDj/?=
 =?us-ascii?Q?Gk+5wJYzXEmlaa7GY3g7j+4iGPd1P7+qLRFwHpTQm82wqju+31zA/WWZd10b?=
 =?us-ascii?Q?cO4/Q237w5/hfrarfL+chgay/0XGAZ1fRe+QDQPAOW14ihc0tkm5D6Iuf3TJ?=
 =?us-ascii?Q?Cy/m3mFOqz/SdErBb5ylbaSticG8YJhQPruKtDhLOSBHbiIha11/V4UAf8f4?=
 =?us-ascii?Q?/vHfBhQDlct5rueUHf+RHHn7688t6o9n9Uoofopi1fknHepqyAOzvEU3SSE9?=
 =?us-ascii?Q?/TWq+fxbruCwx4TUMYTiznilnEDLoT/flc0QIq/9udymKXLhyggPvGyFyIf7?=
 =?us-ascii?Q?o5TsnaeqVAwF3UYXqn2xWmQAP2XIJj0X7vY0fuCohlcUq3pbNsH0LoZohiXX?=
 =?us-ascii?Q?QmUnXil0fTo6wZL2jbkG7bjb5Gr5YsCDXuKZPgoivOOynkbUenWfD9KNKZ1p?=
 =?us-ascii?Q?dzwYDCSE9cGmR1td6ZJ2braIbPCzJG6xBdLAjlv+tmhalIHLYLwOlLIrVGzg?=
 =?us-ascii?Q?y2s6tel9UQtvapOlV3NRTOjKNg9/HqaCqfMhavJky9kC+/zEQyiBTjDZdjqI?=
 =?us-ascii?Q?2G1eK1ZOOI+jIj+gxZz6QwX5Rk/QnNkpowbHjffjEEvx7kifVwkKXK1/n37e?=
 =?us-ascii?Q?jK2+UaRj9+ZcVarEqG7yBX0hy7xav0hK88v4Q98WV/7usrlcaVTSw2EF0Sci?=
 =?us-ascii?Q?547llF/FCccnJTC2KfLHtAfzHdUJQCf0vq125dFN6pQZ5cLekFsKrCToCKFC?=
 =?us-ascii?Q?CLE2MmOt2hOq3NpCyz24Fc2ODnviRwmafV0W2bMBtVhwwDaG6JWg7rJHkl1J?=
 =?us-ascii?Q?yNd8KTwf4jcQstiq8NLIubmA47Blx5AilPi5Eq2j20ydvEgDxB5mCMS39exD?=
 =?us-ascii?Q?FQCG743HXRaliWOwnk3JlqFpgOrPomB/jhbaf5cQlXn+l8Fe0XdJNsE8T86p?=
 =?us-ascii?Q?8BRgV71kL3SOEx4rRCVi80mDLd6BTzIYtjTjsNbRJnX+cUXM1d+DTAtKA4rW?=
 =?us-ascii?Q?iF1NEPBCIUp0R0EtX7eMMwhymwAX2H7K+wYoQnnlf5QABNOOBRL5IR1JXAyi?=
 =?us-ascii?Q?XwvXN6eIYia7LDhG8iBB+FWaXCLc3srvZLqP+cqveZvNPwCeZmPZYOlyYwgA?=
 =?us-ascii?Q?6brdpiN5Fuc+htcA6rdYaldFnPBrFQC3dl+sxn0y2VxOpRGZYhgTd4YCJ1GW?=
 =?us-ascii?Q?HUbsHlNepqs7PMkVt53Z7VTJ2mxS8hs4GUbizu83lrbHObkcb/GE3tzaDn3p?=
 =?us-ascii?Q?DECr5ozoFdHJdv81YQ6elgDOgX6ieD+2tDfMykLiixaCJ/KZNEGui+iEfq1o?=
 =?us-ascii?Q?Vaage1YCECE2Zccf0+adNU6pGOnsFv8nwOGUsmYwAZEBNOsY7K1CKhW3cGpn?=
 =?us-ascii?Q?ZOjZ1NbnUZWypI2r2YkHZuEcBXmG3r4NiQ6vyL6OZV+lWq5+CePNz3Z22MG1?=
 =?us-ascii?Q?nUr+PLqiApvmlI2jKm87/KNEDhhcSCD+DBlkERScYIDksHy2DLCCC0wyZ8B9?=
 =?us-ascii?Q?Fb2XYr9nvoi49q+L6k6ImKAfo4lEqSUGUMGopmuhE1e9nt+Kau5i3t910Vd3?=
 =?us-ascii?Q?HAjJbwi65KubYYl8GqMdSuh7rIjUqpLRxL3W/qMz?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 15fda8b3-69ee-4abd-1c4f-08dc50068c87
X-MS-Exchange-CrossTenant-AuthSource: VI1PR04MB5389.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Mar 2024 15:40:23.8780
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 5Jpusf42qAsEtoeBlHT0AeqtbnLAOFaa7aBnjdhj65vXqUebVLSj1rW9RQIq2gvCqLrtVgD5GJJgQ4IzWSYriw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI2PR04MB10222

Currently if Broadcast Source device is removed it's entry in
bcast_pa_requests remains active. Thus, if the removal is done before
short_lived_pa_sync is called, crashes such as the one listed below
can occur. This patch fixes this by removing the deleted devices
from the queue mentioned above.

==105052==ERROR: AddressSanitizer: heap-use-after-free on address
0x60400001c418 at pc 0x55775caf1846 bp 0x7ffc83d9fb90 sp 0x7ffc83d9fb80
READ of size 8 at 0x60400001c418 thread T0
0 0x55775caf1845 in btd_service_get_device src/service.c:325
1 0x55775ca03da2 in short_lived_pa_sync profiles/audio/bap.c:2693
2 0x55775ca03da2 in pa_idle_timer profiles/audio/bap.c:1996
---
 profiles/audio/bap.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index 52a9f5e00..8953e9a57 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -2907,12 +2907,23 @@ static int bap_bcast_probe(struct btd_service *service)
 	return 0;
 }
 
+static bool remove_service(const void *data, const void *match_data)
+{
+	struct bap_bcast_pa_req *pa_req = (struct bap_bcast_pa_req *)data;
+
+	if (pa_req->type == BAP_PA_SHORT_REQ &&
+		pa_req->data.service == match_data)
+		return true;
+	return false;
+}
+
 static void bap_bcast_remove(struct btd_service *service)
 {
 	struct btd_device *device = btd_service_get_device(service);
 	struct bap_data *data;
 	char addr[18];
 
+	queue_remove_if(bcast_pa_requests, remove_service, service);
 	ba2str(device_get_address(device), addr);
 	DBG("%s", addr);
 
-- 
2.39.2