From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Tue, 29 Nov 2022 01:08:27 +0000 (-0800)
Subject: media: Fix crash when transport configuration changes
X-Git-Tag: accepted/tizen/unified/20240117.163238~417
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e3ff63eb68ac5aff616705abff40bf60c7aafcc2;p=platform%2Fupstream%2Fbluez.git

media: Fix crash when transport configuration changes

In case of BAP the same transport may be reconfigured multiple times
which means it would appears multiple times on endpoint->transports
leading to a crash when disconnecting as the code would attempt to
destroy the same object multiple times.
---

diff --git a/profiles/audio/media.c b/profiles/audio/media.c
index 655833b..e2752cc 100644
--- a/profiles/audio/media.c
+++ b/profiles/audio/media.c
@@ -1268,6 +1268,8 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
 
 		path = media_transport_get_path(transport);
 		bt_bap_stream_set_user_data(stream, (void *)path);
+		endpoint->transports = g_slist_append(endpoint->transports,
+								transport);
 	}
 
 	msg = dbus_message_new_method_call(endpoint->sender, endpoint->path,
@@ -1275,7 +1277,7 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
 						"SetConfiguration");
 	if (msg == NULL) {
 		error("Couldn't allocate D-Bus message");
-		media_transport_destroy(transport);
+		endpoint_remove_transport(endpoint, transport);
 		return FALSE;
 	}
 
@@ -1284,8 +1286,6 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
 	data->cb = cb;
 	data->user_data = user_data;
 
-	endpoint->transports = g_slist_append(endpoint->transports, transport);
-
 	dbus_message_iter_init_append(msg, &iter);
 
 	path = media_transport_get_path(transport);