From: "Pali Rohár" <pali@kernel.org>
To: linux-bluetooth@vger.kernel.org
Cc: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Subject: [PATCH v2] a2dp: Check for valid SEP in a2dp_reconfigure
Date: Sun, 3 May 2020 13:06:29 +0200 [thread overview]
Message-ID: <20200503110629.11068-1-pali@kernel.org> (raw)
In-Reply-To: <5ea9d716.1c69fb81.92030.0ba2@mx.google.com>
a2dp_reconfigure() is called as callback when local and remote SEP does not
have to be valid anymore, sep->lsep can be NULL.
This change fixes bluetoothd daemon crash (dereferencing NULL sep->lsep)
when audio agent disconnect in the middle of the reconfigure call.
---
profiles/audio/a2dp.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
index c31aaf187..a2ce3204d 100644
--- a/profiles/audio/a2dp.c
+++ b/profiles/audio/a2dp.c
@@ -1178,6 +1178,12 @@ static gboolean a2dp_reconfigure(gpointer data)
struct avdtp_media_codec_capability *rsep_codec;
struct avdtp_service_capability *cap;
+ if (!sep->lsep) {
+ error("no valid local SEP");
+ posix_err = -EINVAL;
+ goto failed;
+ }
+
if (setup->rsep) {
cap = avdtp_get_codec(setup->rsep->sep);
rsep_codec = (struct avdtp_media_codec_capability *) cap->data;
@@ -1186,6 +1192,12 @@ static gboolean a2dp_reconfigure(gpointer data)
if (!setup->rsep || sep->codec != rsep_codec->media_codec_type)
setup->rsep = find_remote_sep(setup->chan, sep);
+ if (!setup->rsep) {
+ error("unable to find remote SEP");
+ posix_err = -EINVAL;
+ goto failed;
+ }
+
posix_err = avdtp_set_configuration(setup->session, setup->rsep->sep,
sep->lsep,
setup->caps,
--
2.20.1
next prev parent reply other threads:[~2020-05-03 11:06 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-26 15:04 bluetoothd crashes when tryting to change A2DP codec via DBus Pali Rohár
2020-04-26 15:15 ` Pali Rohár
2020-04-29 19:26 ` [PATCH] a2dp: Check for valid SEP in a2dp_reconfigure Pali Rohár
2020-04-29 19:35 ` bluez.test.bot
2020-05-03 11:06 ` Pali Rohár [this message]
2020-05-04 23:39 ` [PATCH v2] " Luiz Augusto von Dentz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200503110629.11068-1-pali@kernel.org \
--to=pali@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.