From 5ebdaad1fefef9c6c36a23bfc0398befe3fdcf8c Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Mon, 24 Apr 2023 16:05:06 -0700 Subject: [PATCH] shared/bap: Fix crash detaching streams If a stream is being detached but bt_bap reference is already 0 don't attempt to detach the stream as they would be freed anyway: Invalid read of size 8 at 0x19A360: bap_free (bap.c:2576) by 0x19A360: bt_bap_unref (bap.c:2735) by 0x19A360: bt_bap_unref (bap.c:2727) by 0x160E9A: test_teardown (test-bap.c:412) by 0x1A8BCA: teardown_callback (tester.c:434) Address 0x55e05e0 is 16 bytes inside a block of size 160 free'd at 0x48480E4: free (vg_replace_malloc.c:872) by 0x1AD5F6: queue_foreach (queue.c:207) by 0x19A1C5: bt_bap_detach (bap.c:3879) by 0x19A1C5: bt_bap_detach (bap.c:3855) by 0x19A33F: bap_free (bap.c:2574) --- src/shared/bap.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/src/shared/bap.c b/src/shared/bap.c index 5a12a64..bc6177a 100644 --- a/src/shared/bap.c +++ b/src/shared/bap.c @@ -1168,6 +1168,14 @@ static void bap_stream_set_io(void *data, void *user_data) } } +static struct bt_bap *bt_bap_ref_safe(struct bt_bap *bap) +{ + if (!bap || !bap->ref_count) + return NULL; + + return bt_bap_ref(bap); +} + static void bap_stream_state_changed(struct bt_bap_stream *stream) { struct bt_bap *bap = stream->bap; @@ -1178,7 +1186,14 @@ static void bap_stream_state_changed(struct bt_bap_stream *stream) bt_bap_stream_statestr(stream->ep->old_state), bt_bap_stream_statestr(stream->ep->state)); - bt_bap_ref(bap); + /* Check if ref_count is already 0 which means detaching is in + * progress. + */ + bap = bt_bap_ref_safe(bap); + if (!bap) { + bap_stream_detach(stream); + return; + } /* Pre notification updates */ switch (stream->ep->state) { @@ -2730,14 +2745,6 @@ struct bt_bap *bt_bap_ref(struct bt_bap *bap) return bap; } -static struct bt_bap *bt_bap_ref_safe(struct bt_bap *bap) -{ - if (!bap || !bap->ref_count) - return NULL; - - return bt_bap_ref(bap); -} - void bt_bap_unref(struct bt_bap *bap) { if (!bap) -- 2.7.4