media: fix ASAN crash in pac_config_cb
authorPauli Virtanen <pav@iki.fi>
Wed, 15 Feb 2023 22:26:02 +0000 (22:26 +0000)
committerAyush Garg <ayush.garg@samsung.com>
Fri, 5 Jan 2024 10:21:48 +0000 (15:51 +0530)
commit2c1781ea4eaef8b91b2a699c1ca78b019e9c94e8
tree3ba09bc8cf86be12e408d82c9cb4f5ca6ee5bc5a
parent1fcdbf371665c7e35fe9dfef7fdb265300374907
media: fix ASAN crash in pac_config_cb

Don't call configuration callback if stream's transport was cleared in
the meantime.  The clear callback is called just before the stream is
freed.

Fixes ASAN crash on disconnect while waiting for SetConfiguration DBus
reply:

ERROR: AddressSanitizer: heap-use-after-free on address 0x60b00002eb90
READ of size 8 at 0x60b00002eb90 thread T0
    #0 0x7a4892 in bap_stream_config_cfm_cb src/shared/bap.c:3201
    #1 0x4688fb in pac_config_cb profiles/audio/media.c:1010
    #2 0x462164 in media_endpoint_cancel profiles/audio/media.c:157
    #3 0x462243 in media_endpoint_cancel_all profiles/audio/media.c:165
    #4 0x46365b in clear_endpoint profiles/audio/media.c:297
    #5 0x463a21 in endpoint_reply profiles/audio/media.c:325
...
freed by thread T0 here:
    #0 0x7eff644b9388 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xb9388)
    #1 0x78d8cc in bap_stream_free src/shared/bap.c:974
    #2 0x78dbc8 in bap_stream_detach src/shared/bap.c:991
    #3 0x78fa43 in bap_stream_state_changed src/shared/bap.c:1210
    #4 0x78fe26 in stream_set_state src/shared/bap.c:1254
    #5 0x7ab5ce in stream_foreach_detach src/shared/bap.c:3820
    #6 0x70ce06 in queue_foreach src/shared/queue.c:207
    #7 0x7ab942 in bt_bap_detach src/shared/bap.c:3836
    #8 0x51da7a in bap_disconnect profiles/audio/bap.c:1342
    #9 0x626e57 in btd_service_disconnect src/service.c:305
profiles/audio/media.c