Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-3680-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Vlad Pruteanu <vlad.pruteanu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: claudia.rosu@nxp.com,
	mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	iulia.tanasescu@nxp.com,
	andrei.istodorescu@nxp.com,
	luiz.dentz@gmail.com,
	Vlad Pruteanu <vlad.pruteanu@nxp.com>
Subject: [PATCH BlueZ 0/1] bap: Replace global bcast_pa_requests with a queue for each adapter
Date: Wed, 17 Apr 2024 17:25:36 +0300
Message-Id: <20240417142537.6523-1-vlad.pruteanu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?1+70i307ho4M4zCm57B7bGv8j9hBIBh3W66uCxLib12K+q5itDQ1pSlVP61t?=
 =?us-ascii?Q?BfJi4wTMcpLNJ3S4YNIta1gy7/e1rM0Xg4h7o0YEcfUgFpSYvZYIqcWgYOhr?=
 =?us-ascii?Q?f5ooEM56+RSKbFVyPKN9z4h+2AZxEqJiDtcfSr0KtVG0/HDOmXO/9FyS7+aR?=
 =?us-ascii?Q?NUrzJcEmzmf7DHBzEIPtEXx48rxzA0io5LhIiU7/JolDVvQ5FRr2eH7DFO5O?=
 =?us-ascii?Q?9xTpTGUGDcICJKZN+MkNV6xaBL+UWFVetg8be+Hr1iNptJX1Futu4ZHI0oVa?=
 =?us-ascii?Q?hn8cK/0d78dELZLQeghFzo09TG0uE5GooJfN+qWT6wkGO1LkB4jD7k1pEkwj?=
 =?us-ascii?Q?xOih556bkdwD4jAY2yc5OTr+7VPHDyhiRR3I1Z9DxehFkKpDJxCPJ4jAjHAz?=
 =?us-ascii?Q?pHImfW8/N2gHgNfUd8g/P+nWAA9+by7n69rxzlsq11gGl9R0C0f1hR8lkg3m?=
 =?us-ascii?Q?4FhBy+jUwIx1A5MtonyVuqJUYgLyKiW3AsvQwK9CbSA8jyba6dQvPQmQEX6d?=
 =?us-ascii?Q?uS1t7eFDgArLPq3QJAdVVt75JCa8zF2ru45YPEVDAehRjACic60oPgloBzVK?=
 =?us-ascii?Q?H3jAnSxkNFOudp3ffJdYCZ5no+EuS9JmfHCvh3Q2sdkq+LY+MjDJXk49TzlZ?=
 =?us-ascii?Q?nmlRNfVxKkr2KYbeeyHFTqDS+3XK23ajB+tqTTgj73CJNOcX/4nxxzOASjJC?=
 =?us-ascii?Q?J4E3BjbOXNJuot5jUIH2cI4mPr9egK5QZNwvywD+tas0qfwFY+K/pIMikTbw?=
 =?us-ascii?Q?F4of0iZWOn3i8iaJz+pjWb1siIi4Iz7IGbbKHnBf+BlOnXSz53JFTG5VPEGl?=
 =?us-ascii?Q?35mD1be+OCwHApIfCiNDtx2pJ/MEragR3TYtwd1joQkuvlev1l60ktc7aCJE?=
 =?us-ascii?Q?pb8Vo6GzQOdjALWWAUdEK40ojx727k9oKYWpT5plOkY6Ta1WBJHOmEfOsoGz?=
 =?us-ascii?Q?Qylu4NFAmxBbxivQZB+nfXtLAf9cVCZJtG2stkwMvy96JeyGy/qhK19k8BKh?=
 =?us-ascii?Q?QGpV4iDu3FRCaBr+0ybYk0yAHxJB81sRaa07vNK1QSW7zQu3nOR3LkS/A5UQ?=
 =?us-ascii?Q?Al1gfhBgfR+c4bxIjj+3T7aR+B297er5k7TV8jAtvwkOOM+WEb4cFf3M7hxj?=
 =?us-ascii?Q?SZDG3978I+1/xMcRZDGzcphyfu1gPZHnRktR5RtJ+VH7pi11JOGiybEv5Sm3?=
 =?us-ascii?Q?RZlN6IDOldPuMJF5Qdd43slnuw8prPEEp1kyamahq2x4FbXwpedn3emvxKW/?=
 =?us-ascii?Q?CmN2+Fgr6VfTX+fmGNm/qONjPlw+Ua8+eQF27Lpp4AOXa1uoRAhbhB0PRWck?=
 =?us-ascii?Q?17smnXoVUK9D6b69DN+B7Ie9QKnlhbhSk+j871Hpxhyi0HSknThn7yJI7Wud?=
 =?us-ascii?Q?blZUV2lRNBwXLmL12lSbSY7PvT6v/g1hW7I8CN7aNUC4fsDxe48YNfLl5O3K?=
 =?us-ascii?Q?Rjx7B9L8Rb0RKOtR1wb1AjMb743n9JR3Kr8BWXrz2cEB3my6HVmwANecOMSV?=
 =?us-ascii?Q?YBItvpw/YTlecRIodMjP2ZMoOmBHw/6IklkV+FRaMhLM9q1h8G4qAeerjNf+?=
 =?us-ascii?Q?E2PEZXvAmgbMzObfqh3z8RIynVkMHN3KImowbbSR?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 056bb638-d9a7-4f24-9016-08dc5eea4a68
X-MS-Exchange-CrossTenant-AuthSource: VI1PR04MB5389.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Apr 2024 14:25:54.5377
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: mjmpWfVI0BfmgXdHnGDPA+bsXbWTJ8XTkKRd70AYNLiwmHdrdWfwfW8TIHfm/SHyusEyITLSPxGu6YthqEedBA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4PR04MB7504

This patch replaces the current implementation that uses a global
bcast_pa_requests queue and instead creates a queue and a timer for
each adapter.

The queue for a specific adapter, the timer's id and the adapter's id
form a new struct called pa_timer_data. For each adapter a new instance
of this struct is created and inserted into the global queue, pa_timers.

Operations on the old bcast_pa_requests queue have been modified such
that:
1) based on the adapter_id, the correct entry in the pa_timers queue is
retrieved
2) the operation can be called on the bcast_pa_requests queue from the
resulting pa_timer_data instance

The timers are created and stopped on a per adapter basis. A timer is
stopped if the adapter's pa_req queue is empty. A pa_timer_id equal
to 0 means that the timer is stopped.

The bap_bcast_remove function has been updated to remove from the
pa_req queue entries of devices that were freed. pa_req that are already
in progress are treated by the bap_data_free function.

This patch also fixes a crash that occurs when a device is freed before
the pa_idle_timer handles it's entry in the pa_req queue. The following
log was obtained while running an Unicast setup:

==105052==ERROR: AddressSanitizer: heap-use-after-free on address
0x60400001c418 at pc 0x55775caf1846 bp 0x7ffc83d9fb90 sp 0x7ffc83d9fb80
READ of size 8 at 0x60400001c418 thread T0
0 0x55775caf1845 in btd_service_get_device src/service.c:325
1 0x55775ca03da2 in short_lived_pa_sync profiles/audio/bap.c:2693
2 0x55775ca03da2 in pa_idle_timer profiles/audio/bap.c:1996

Vlad Pruteanu (1):
  bap: Replace global bcast_pa_requests with a queue for each adapter

 profiles/audio/bap.c | 115 ++++++++++++++++++++++++++++++++++++-------
 1 file changed, 97 insertions(+), 18 deletions(-)

-- 
2.40.1