Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-2964-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Precedence: bulk
MIME-Version: 1.0
References: <20240329154000.6056-1-vlad.pruteanu@nxp.com> <20240329154000.6056-2-vlad.pruteanu@nxp.com>
In-Reply-To: <20240329154000.6056-2-vlad.pruteanu@nxp.com>
From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date: Fri, 29 Mar 2024 11:44:14 -0400
Message-ID: <CABBYNZLrtrU25pKg4yqZPdSkmQGSwYFWptc1+VQRZs-_aD_Z=g@mail.gmail.com>
Subject: Re: [PATCH BlueZ 1/1] bap: Remove entry of deleted device from
 bcast_pa_requests queue
To: Vlad Pruteanu <vlad.pruteanu@nxp.com>
Cc: linux-bluetooth@vger.kernel.org, mihai-octavian.urzica@nxp.com, 
	silviu.barbulescu@nxp.com, iulia.tanasescu@nxp.com, 
	andrei.istodorescu@nxp.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Vlad,

On Fri, Mar 29, 2024 at 11:40=E2=80=AFAM Vlad Pruteanu <vlad.pruteanu@nxp.c=
om> wrote:
>
> Currently if Broadcast Source device is removed it's entry in
> bcast_pa_requests remains active. Thus, if the removal is done before
> short_lived_pa_sync is called, crashes such as the one listed below
> can occur. This patch fixes this by removing the deleted devices
> from the queue mentioned above.

Actually we need to redesign these, the list should be per adapter,
not global as it is currently and we probably should stop doing the
enumeration if the user stop scanning.

> =3D=3D105052=3D=3DERROR: AddressSanitizer: heap-use-after-free on address
> 0x60400001c418 at pc 0x55775caf1846 bp 0x7ffc83d9fb90 sp 0x7ffc83d9fb80
> READ of size 8 at 0x60400001c418 thread T0
> 0 0x55775caf1845 in btd_service_get_device src/service.c:325
> 1 0x55775ca03da2 in short_lived_pa_sync profiles/audio/bap.c:2693
> 2 0x55775ca03da2 in pa_idle_timer profiles/audio/bap.c:1996
> ---
>  profiles/audio/bap.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>
> diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
> index 52a9f5e00..8953e9a57 100644
> --- a/profiles/audio/bap.c
> +++ b/profiles/audio/bap.c
> @@ -2907,12 +2907,23 @@ static int bap_bcast_probe(struct btd_service *se=
rvice)
>         return 0;
>  }
>
> +static bool remove_service(const void *data, const void *match_data)
> +{
> +       struct bap_bcast_pa_req *pa_req =3D (struct bap_bcast_pa_req *)da=
ta;
> +
> +       if (pa_req->type =3D=3D BAP_PA_SHORT_REQ &&
> +               pa_req->data.service =3D=3D match_data)
> +               return true;
> +       return false;
> +}
> +
>  static void bap_bcast_remove(struct btd_service *service)
>  {
>         struct btd_device *device =3D btd_service_get_device(service);
>         struct bap_data *data;
>         char addr[18];
>
> +       queue_remove_if(bcast_pa_requests, remove_service, service);
>         ba2str(device_get_address(device), addr);
>         DBG("%s", addr);
>
> --
> 2.39.2
>


--=20
Luiz Augusto von Dentz