Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-4009-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Vlad Pruteanu <vlad.pruteanu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: claudia.rosu@nxp.com,
	mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	iulia.tanasescu@nxp.com,
	andrei.istodorescu@nxp.com,
	luiz.dentz@gmail.com,
	Vlad Pruteanu <vlad.pruteanu@nxp.com>
Subject: [PATCH BlueZ v2 4/4] bap: Remove deleted devices from pa_req queue
Date: Wed, 24 Apr 2024 17:07:41 +0300
Message-Id: <20240424140741.73899-5-vlad.pruteanu@nxp.com>
In-Reply-To: <20240424140741.73899-1-vlad.pruteanu@nxp.com>
References: <20240424140741.73899-1-vlad.pruteanu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?AB9oavMXoUUBJNxX0tqh75WzwFcEME3hmnnY0a3ih+8xq1UpTS9PIGq34/79?=
 =?us-ascii?Q?v+0JmPmrwLo2mTAp2q+0tfIqzmLB2u4Bk9ifmUJP1J2WbOIMndVi9Io0Chfr?=
 =?us-ascii?Q?2xRLKdb61UXpM4mvpgL0QGp1K4Tt9mIqhxmXQe2l4r/K7x/2f37Z9CMfcSA/?=
 =?us-ascii?Q?5OLldY+9iSPNotafjmwVSJj2HGlwc7ZDbBAhp7xK/0mz7JkIkMwpUTpJhCBF?=
 =?us-ascii?Q?wLO5SrcAq89Hnu+syjFmDSV142j8QpoDcZZFT+5VYws/NFTCOXotXsAoEWg0?=
 =?us-ascii?Q?jJ7Smq90RDLmOiPlU+aIPfpIjDKKDWZhhJk92G92NeyxU6vIfZRWbBkFBIFD?=
 =?us-ascii?Q?gIIe1VoWhHIhmwhA6TRo17l2GKxO7JTGLO0jkaI/NZAW3xu95AdjO2gF4oLX?=
 =?us-ascii?Q?vfwvWu6FdsHdIZP2n3ss3uJIvsaQUMhHfGdiigKWDFeRVc8i/7DWhCiBiqqY?=
 =?us-ascii?Q?DDF8IAAnhjPVr7VtYedqFs0NklmYJtbOm6XPVgdiX6Q2tMStzETwRDk6IN1g?=
 =?us-ascii?Q?Re6mYBbhn+M/tq78vdRQ4rSkBZuluw72ELUxgelL7sarV3wvp+PKMHR2F/WK?=
 =?us-ascii?Q?3KVGAgeeSGVDXrIQhfyUY+DLVFUkXvM80cj/9MEeRv/YbSREkIhlvHFKH1g2?=
 =?us-ascii?Q?hu8A+l2SAQH3ixOO9BzAgR+sv1G/wPlpFimMv6iyXKSmp5s/BAS16F1pSDJM?=
 =?us-ascii?Q?SW4pAHaU1mCenjSRH0sIP0Cut53GDPTZRkK0Mds3jldfVo45Y29f7X8M053D?=
 =?us-ascii?Q?mP8HjlYftkDeeEUHAhHbq/eUK75g01c1NWJcSPbgEY9qHuxa7g/Bgj2qHxqp?=
 =?us-ascii?Q?g+2qwxUryRZu+lV8l3LxVR7NONsqbwzul+K/VjpidXQNir4+gYT3l9GA6NI0?=
 =?us-ascii?Q?xUMFef8r9rPpoJBRF1wxoEzYF3SXwuyMjoE2x58NQjpFOfdr4BZobsHkBY8b?=
 =?us-ascii?Q?yE90C4cliC3Mykr5+I3CLK0c/vlGnITmXIfER7OuejYP8opggbCezcAgT+3e?=
 =?us-ascii?Q?UAft54Q2ht2GBMqzg2PNgPZX7ftk7PrM8My4NQZGc4Yh4lxURhP3mt4LL9o5?=
 =?us-ascii?Q?yYgwyw7U9KTtCevBztHWSTLfQpeeKqXa5NyaORkm+1fvbZ3Yg/RTSVE0oAkU?=
 =?us-ascii?Q?AoJ0lT7vaEP6MRylKdv+Y0pPSAlBzs7UlmKAmgkfaHFrXy/rr1mbPEZqajso?=
 =?us-ascii?Q?VRt0dRBIQHVMNhtqwBhF51heoBkdktpewNmPkfZlZO2If1nCLogb2ofZFSS2?=
 =?us-ascii?Q?vNKF4r091awM1jdTgy1/VjuHtWw3M8KekvkqEhTLo8dadjSDl4VrE/8svnJ3?=
 =?us-ascii?Q?RzVaOeW/aC487WHyMXDKVjtnRp8eQrfB9kb/Lhs0RXzF6pt/AdiS6lUNlQOT?=
 =?us-ascii?Q?mz9iTgupgOwmSrmUtP6TmZ2SdNf8+4m8rELKG5v1VB3TMF0PnFR17ffqIja2?=
 =?us-ascii?Q?Z/M2Az2LhFB67v7YBu4ddfbJQkReovv0XEdURRjMAsn63sI0ns57zaChG6ZS?=
 =?us-ascii?Q?s9YZW7T5cXMwbXEbbzBAgCTC5hgABQSDDP+Tmt8wlhCMcwKK1Zrw726QUWKi?=
 =?us-ascii?Q?waDEEN5TsWsJRHvi1vi7+k3mux7y16AdSdlJlEvk?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 53041280-a41e-47b3-dfea-08dc6467fe16
X-MS-Exchange-CrossTenant-AuthSource: AM6PR04MB5384.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Apr 2024 14:08:18.8473
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: +SQ4FrFGypDAoB0t0IS130gv4gkKJaKXcEe2IXZvKfOsKuvK0EIYEoEG7McU3ocTJvtpneV12+4/9/rxU1CKqg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU2PR04MB8582

The bap_bcast_remove function has been updated to remove from the
pa_req queue entries of devices that were freed. pa_req that are already
in progress are treated by the bap_data_free function.

The lookup in bap_bcast_remove was necessary. The entry corresponding to
the calling service must be removed from the pa_req queue. There is no
other way to get a refference to this entry other than to search in the
queue.

This patch fixes a crash that occurs when a device is freed before the
pa_idle_timer handles it's entry in the pa_req queue. The following log
was obtained while running an Unicast setup:

==105052==ERROR: AddressSanitizer: heap-use-after-free on address
0x60400001c418 at pc 0x55775caf1846 bp 0x7ffc83d9fb90 sp 0x7ffc83d9fb80
READ of size 8 at 0x60400001c418 thread T0
0 0x55775caf1845 in btd_service_get_device src/service.c:325
1 0x55775ca03da2 in short_lived_pa_sync profiles/audio/bap.c:2693
2 0x55775ca03da2 in pa_idle_timer profiles/audio/bap.c:1996
---
 profiles/audio/bap.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index ab0b96222..2b1ed501b 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -2981,10 +2981,20 @@ static int bap_bcast_probe(struct btd_service *service)
 	return 0;
 }
 
+static bool match_service(const void *data, const void *match_data)
+{
+	struct bap_bcast_pa_req *pa_req = (struct bap_bcast_pa_req *)data;
+
+	if (pa_req->data.service == match_data)
+		return true;
+	return false;
+}
+
 static void bap_bcast_remove(struct btd_service *service)
 {
 	struct btd_device *device = btd_service_get_device(service);
 	struct bap_data *data;
+	struct bap_bcast_pa_req *pa_req;
 	char addr[18];
 
 	ba2str(device_get_address(device), addr);
@@ -2995,6 +3005,14 @@ static void bap_bcast_remove(struct btd_service *service)
 		error("BAP service not handled by profile");
 		return;
 	}
+	/* Remove the corresponding entry from the pa_req queue. Any pa_req that
+	 * are in progress will be stopped by bap_data_remove which calls
+	 * bap_data_free.
+	 */
+	pa_req = queue_remove_if(data->bap_adapter->bcast_pa_requests,
+						match_service, service);
+	if (pa_req)
+		free(pa_req);
 
 	bap_data_remove(data);
 }
-- 
2.40.1