From 70477556f7cf4957a6dc15b55447e678054dde41 Mon Sep 17 00:00:00 2001 From: Yun-Hao Chung Date: Tue, 8 Mar 2022 17:43:48 +0800 Subject: [PATCH] audio: Fix crash in a2dp_discover Sample stack trace: 0x0000567c394e4c6b (bluetoothd - a2dp.c: 270) setup_cb_free 0x0000567c394e4a94 (bluetoothd - a2dp.c: 2884) a2dp_discover 0x0000567c394e3c03 (bluetoothd - sink.c: 275) sink_setup_stream 0x0000567c394e3d4f (bluetoothd - sink.c: 299) sink_connect 0x0000567c39535183 (bluetoothd - service.c: 294) btd_service_connect 0x0000567c39539f68 (bluetoothd - device.c: 2006) connect_next 0x0000567c3954086d (bluetoothd - device.c: 2060) service_state_changed 0x0000567c39534efb (bluetoothd - service.c: 111) change_state 0x0000567c3953559c (bluetoothd - service.c: 0) btd_service_connecting_complete 0x0000567c39534a5c (bluetoothd - profile.c: 1641) record_cb 0x0000567c395197cd (bluetoothd - sdp-client.c: 298) connect_watch 0x00007b14bc8034f6 (libglib-2.0.so.0 - gmain.c: 3337) g_main_context_dispatch 0x00007b14bc803801 (libglib-2.0.so.0 - gmain.c: 4131) g_main_context_iterate 0x00007b14bc803a7d (libglib-2.0.so.0 - gmain.c: 4329) g_main_loop_run 0x0000567c39566af1 (bluetoothd - mainloop-glib.c: 79) mainloop_run 0x0000567c39566ddb (bluetoothd - mainloop-notify.c: 201) mainloop_run_with_signal 0x0000567c3954bf4c (bluetoothd - main.c: 1222) main 0x00007b14bc579797 (libc.so.6 - libc-start.c: 332) __libc_start_main 0x0000567c394df449 (bluetoothd) _start 0x00007ffd70145737 This could be triggered from a2dp_discover -> avdtp_discover -> send_request -> send_req -> l2cap_connect (return error) -> avdtp_set_state (to disconnect state)-> channel_remove -> channel_free -> finalize_setup_errno (discover cb is freed) -> error handling all the way back to a2dp_discover -> a2dp_discover (discover cb is freed again, crashed!). The fix is to attach cb with setup after avdtp_discover success. Suggested-by: luiz.dentz@gmail.com Reviewed-by: Archie Pusaka Signed-off-by: Manika Shrivastava Signed-off-by: Ayush Garg --- profiles/audio/a2dp.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c index 6cc28a0..10f2cd7 100644 --- a/profiles/audio/a2dp.c +++ b/profiles/audio/a2dp.c @@ -252,6 +252,15 @@ static struct a2dp_setup_cb *setup_cb_new(struct a2dp_setup *setup) cb->setup = setup; cb->id = ++cb_id; + return cb; +} + +static struct a2dp_setup_cb *setup_cb_add(struct a2dp_setup *setup) +{ + struct a2dp_setup_cb *cb; + + cb = setup_cb_new(setup); + setup->cb = g_slist_append(setup->cb, cb); return cb; } @@ -1943,7 +1952,7 @@ static int a2dp_reconfig(struct a2dp_channel *chan, const char *sender, if (!setup) return -ENOMEM; - cb_data = setup_cb_new(setup); + cb_data = setup_cb_add(setup); cb_data->config_cb = reconfig_cb; cb_data->user_data = user_data; @@ -3079,12 +3088,17 @@ unsigned int a2dp_discover(struct avdtp *session, a2dp_discover_cb_t cb, if (!setup) return 0; + /* Don't add cb since avdtp_discover can end up disconnecting the + * session causing the cb to be freed. + */ cb_data = setup_cb_new(setup); cb_data->discover_cb = cb; cb_data->user_data = user_data; - if (avdtp_discover(session, discover_cb, setup) == 0) + if (avdtp_discover(session, discover_cb, setup) == 0) { + setup->cb = g_slist_append(setup->cb, cb_data); return cb_data->id; + } setup_cb_free(cb_data); return 0; @@ -3112,7 +3126,7 @@ unsigned int a2dp_select_capabilities(struct avdtp *session, if (!setup) return 0; - cb_data = setup_cb_new(setup); + cb_data = setup_cb_add(setup); cb_data->select_cb = cb; cb_data->user_data = user_data; @@ -3185,7 +3199,7 @@ unsigned int a2dp_config(struct avdtp *session, struct a2dp_sep *sep, if (!setup) return 0; - cb_data = setup_cb_new(setup); + cb_data = setup_cb_add(setup); cb_data->config_cb = cb; cb_data->user_data = user_data; @@ -3276,7 +3290,7 @@ unsigned int a2dp_resume(struct avdtp *session, struct a2dp_sep *sep, if (!setup) return 0; - cb_data = setup_cb_new(setup); + cb_data = setup_cb_add(setup); cb_data->resume_cb = cb; cb_data->user_data = user_data; @@ -3334,7 +3348,7 @@ unsigned int a2dp_suspend(struct avdtp *session, struct a2dp_sep *sep, if (!setup) return 0; - cb_data = setup_cb_new(setup); + cb_data = setup_cb_add(setup); cb_data->suspend_cb = cb; cb_data->user_data = user_data; -- 2.7.4