* [PATCH BlueZ v1 1/1] shared/vcp: Fixed the crash observed with VOCS when pairing with LE Audio TWS earbuds
2023-07-24 8:55 [PATCH BlueZ v1 0/1] Fixed the crash observed with VOCS when pairing with LE Audio TWS earbuds Nitin Jadhav
@ 2023-07-24 8:55 ` Nitin Jadhav
2023-07-24 10:23 ` bluez.test.bot
0 siblings, 1 reply; 3+ messages in thread
From: Nitin Jadhav @ 2023-07-24 8:55 UTC (permalink / raw)
To: linux-bluetooth
Cc: devyani.godbole, pav, luiz.dentz, sathish.narasimman,
nitin.jadhav
Root cause
- There are two types of database- Remote and Local (rdb and ldb).
- In client mode currently the code was written to access ldb.
Fix
- Correcting it, to access rdb has resolved the problem in VOCS.
- Same correction is done for VCS.
Reported-by: Pauli Virtanen <pav@iki.fi>
---
src/shared/vcp.c | 52 +++++++++++++++++++++++++++---------------------
1 file changed, 29 insertions(+), 23 deletions(-)
diff --git a/src/shared/vcp.c b/src/shared/vcp.c
index 74bd01729..f30d7a533 100644
--- a/src/shared/vcp.c
+++ b/src/shared/vcp.c
@@ -973,7 +973,7 @@ static void vocs_voaodec_read(struct gatt_db_attribute *attrib,
struct bt_vocs *vocs = user_data;
struct iovec iov;
- iov.iov_base = &vocs->vocs_ao_dec;
+ iov.iov_base = vocs->vocs_ao_dec;
iov.iov_len = strlen(vocs->vocs_ao_dec);
gatt_db_attribute_read_result(attrib, id, 0, iov.iov_base,
@@ -998,10 +998,12 @@ static struct bt_vcs *vcs_new(struct gatt_db *db, struct bt_vcp_db *vdb)
/* Populate DB with VCS attributes */
bt_uuid16_create(&uuid, VCS_UUID);
- vcs->service = gatt_db_add_service(db, &uuid, true, 9);
+
+ vcs->service = gatt_db_add_service(db, &uuid, true, 10);
gatt_db_service_add_included(vcs->service, vdb->vocs->service);
gatt_db_service_set_active(vdb->vocs->service, true);
+
bt_uuid16_create(&uuid, VOL_STATE_CHRC_UUID);
vcs->vs = gatt_db_service_add_characteristic(vcs->service,
&uuid,
@@ -1385,11 +1387,12 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
const uint8_t *value, uint16_t length,
void *user_data)
{
- uint32_t *vocs_audio_loc;
- struct iovec iov = {
- .iov_base = (void *) value,
- .iov_len = length,
- };
+ uint32_t vocs_audio_loc;
+
+ if (!value) {
+ DBG(vcp, "Unable to get VOCS Audio Location");
+ return;
+ }
if (!success) {
DBG(vcp, "Unable to read VOCS Audio Location: error 0x%02x",
@@ -1397,26 +1400,25 @@ static void read_vocs_audio_location(struct bt_vcp *vcp, bool success,
return;
}
- vocs_audio_loc = iov_pull_mem(&iov, sizeof(uint32_t));
- if (!*vocs_audio_loc) {
- DBG(vcp, "Unable to get VOCS Audio Location");
- return;
- }
+ memcpy(&vocs_audio_loc, value, length);
- DBG(vcp, "VOCS Audio Loc:%x", *vocs_audio_loc);
+ DBG(vcp, "VOCS Audio Loc:%x", vocs_audio_loc);
}
-
static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
uint8_t att_ecode,
const uint8_t *value, uint16_t length,
void *user_data)
{
char *vocs_ao_dec_r;
- struct iovec iov = {
- .iov_base = (void *) value,
- .iov_len = length,
- };
+
+ if (!value) {
+ DBG(vcp, "Unable to get VOCS Audio Descriptor");
+ return;
+ }
+
+ vocs_ao_dec_r = malloc(length+1);
+ memset(vocs_ao_dec_r, 0, length+1);
if (!success) {
DBG(vcp, "Unable to read VOCS Audio Descriptor: error 0x%02x",
@@ -1424,13 +1426,17 @@ static void read_vocs_audio_descriptor(struct bt_vcp *vcp, bool success,
return;
}
- vocs_ao_dec_r = iov_pull_mem(&iov, length);
- if (!*vocs_ao_dec_r) {
+ memcpy(vocs_ao_dec_r, value, length);
+
+ if (!vocs_ao_dec_r) {
DBG(vcp, "Unable to get VOCS Audio Descriptor");
return;
}
- DBG(vcp, "VOCS Audio Descriptor:%s", *vocs_ao_dec_r);
+ DBG(vcp, "VOCS Audio Descriptor: %s", vocs_ao_dec_r);
+
+ free(vocs_ao_dec_r);
+ vocs_ao_dec_r = NULL;
}
static void vcp_pending_destroy(void *data)
@@ -1719,10 +1725,10 @@ bool bt_vcp_attach(struct bt_vcp *vcp, struct bt_gatt_client *client)
return false;
bt_uuid16_create(&uuid, VCS_UUID);
- gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vcs_service, vcp);
+ gatt_db_foreach_service(vcp->rdb->db, &uuid, foreach_vcs_service, vcp);
bt_uuid16_create(&uuid, VOL_OFFSET_CS_UUID);
- gatt_db_foreach_service(vcp->ldb->db, &uuid, foreach_vocs_service, vcp);
+ gatt_db_foreach_service(vcp->rdb->db, &uuid, foreach_vocs_service, vcp);
return true;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread