diff options
| author | Pauli Virtanen <pav@iki.fi> | 2023-02-15 22:26:02 +0000 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2023-02-15 16:36:55 -0800 |
| commit | 5d347b54714e0f2d750253be09b68b0c3119dd0a (patch) | |
| tree | 5105fb6cd182c2dfa404835e08872f64ff0be119 /profiles | |
| parent | e9163b09a3dff9d33362ebccfe9eb031e8f8cdda (diff) | |
| download | bluez-5d347b54714e0f2d750253be09b68b0c3119dd0a.tar.gz | |
media: fix ASAN crash in pac_config_cb
Don't call configuration callback if stream's transport was cleared in
the meantime. The clear callback is called just before the stream is
freed.
Fixes ASAN crash on disconnect while waiting for SetConfiguration DBus
reply:
ERROR: AddressSanitizer: heap-use-after-free on address 0x60b00002eb90
READ of size 8 at 0x60b00002eb90 thread T0
#0 0x7a4892 in bap_stream_config_cfm_cb src/shared/bap.c:3201
#1 0x4688fb in pac_config_cb profiles/audio/media.c:1010
#2 0x462164 in media_endpoint_cancel profiles/audio/media.c:157
#3 0x462243 in media_endpoint_cancel_all profiles/audio/media.c:165
#4 0x46365b in clear_endpoint profiles/audio/media.c:297
#5 0x463a21 in endpoint_reply profiles/audio/media.c:325
...
freed by thread T0 here:
#0 0x7eff644b9388 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xb9388)
#1 0x78d8cc in bap_stream_free src/shared/bap.c:974
#2 0x78dbc8 in bap_stream_detach src/shared/bap.c:991
#3 0x78fa43 in bap_stream_state_changed src/shared/bap.c:1210
#4 0x78fe26 in stream_set_state src/shared/bap.c:1254
#5 0x7ab5ce in stream_foreach_detach src/shared/bap.c:3820
#6 0x70ce06 in queue_foreach src/shared/queue.c:207
#7 0x7ab942 in bt_bap_detach src/shared/bap.c:3836
#8 0x51da7a in bap_disconnect profiles/audio/bap.c:1342
#9 0x626e57 in btd_service_disconnect src/service.c:305
Diffstat (limited to 'profiles')
| -rw-r--r-- | profiles/audio/media.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/profiles/audio/media.c b/profiles/audio/media.c index b722278ba..326e50a09 100644 --- a/profiles/audio/media.c +++ b/profiles/audio/media.c @@ -1003,6 +1003,12 @@ static void pac_config_cb(struct media_endpoint *endpoint, void *ret, int size, { struct pac_config_data *data = user_data; gboolean *ret_value = ret; + struct media_transport *transport; + + /* If transport was cleared, configuration was cancelled */ + transport = find_transport(endpoint, data->stream); + if (!transport) + return; data->cb(data->stream, ret_value ? 0 : -EINVAL); } |