* [PATCH BlueZ 1/3] shared/bap: Properly cleanup bap remote endpoints
2024-02-02 14:10 [PATCH BlueZ 0/3] BAP fixes Iulia Tanasescu
@ 2024-02-02 14:10 ` Iulia Tanasescu
2024-02-02 15:54 ` BAP fixes bluez.test.bot
2024-02-02 14:10 ` [PATCH BlueZ 2/3] bap: Fix incorrect parsing of caps and meta in parse_base Iulia Tanasescu
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Iulia Tanasescu @ 2024-02-02 14:10 UTC (permalink / raw)
To: linux-bluetooth
Cc: claudia.rosu, mihai-octavian.urzica, silviu.barbulescu,
vlad.pruteanu, andrei.istodorescu, luiz.dentz, Iulia Tanasescu
When freeing a remote bap endpoint, the endpoint reference inside the
stream should be set to NULL, to avoid later use after free errors.
---
src/shared/bap.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/src/shared/bap.c b/src/shared/bap.c
index 851d6a5fa..60fb826c3 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -2979,6 +2979,16 @@ static void bap_state_free(void *data)
free(state);
}
+static void bap_ep_free(void *data)
+{
+ struct bt_bap_endpoint *ep = data;
+
+ if (ep && ep->stream)
+ ep->stream->ep = NULL;
+
+ free(ep);
+}
+
static void bap_detached(void *data, void *user_data)
{
struct bt_bap_cb *cb = data;
@@ -3001,7 +3011,7 @@ static void bap_free(void *data)
queue_destroy(bap->ready_cbs, bap_ready_free);
queue_destroy(bap->state_cbs, bap_state_free);
queue_destroy(bap->local_eps, free);
- queue_destroy(bap->remote_eps, free);
+ queue_destroy(bap->remote_eps, bap_ep_free);
queue_destroy(bap->reqs, bap_req_free);
queue_destroy(bap->notify, NULL);
--
2.39.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH BlueZ 2/3] bap: Fix incorrect parsing of caps and meta in parse_base
2024-02-02 14:10 [PATCH BlueZ 0/3] BAP fixes Iulia Tanasescu
2024-02-02 14:10 ` [PATCH BlueZ 1/3] shared/bap: Properly cleanup bap remote endpoints Iulia Tanasescu
@ 2024-02-02 14:10 ` Iulia Tanasescu
2024-02-02 14:10 ` [PATCH BlueZ 3/3] bap: Remove incorrect assignment of listen io Iulia Tanasescu
2024-02-02 15:20 ` [PATCH BlueZ 0/3] BAP fixes patchwork-bot+bluetooth
3 siblings, 0 replies; 6+ messages in thread
From: Iulia Tanasescu @ 2024-02-02 14:10 UTC (permalink / raw)
To: linux-bluetooth
Cc: claudia.rosu, mihai-octavian.urzica, silviu.barbulescu,
vlad.pruteanu, andrei.istodorescu, luiz.dentz, Iulia Tanasescu
This adds a fix to properly parse the stream capabilities and
metadata in parse base.
---
profiles/audio/bap.c | 40 +++++++++++++++++++++++++---------------
1 file changed, 25 insertions(+), 15 deletions(-)
diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index 7faa6be7f..909d57121 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -433,7 +433,8 @@ static bool parse_base(void *data, size_t len, util_debug_func_t func,
};
uint8_t capsLen, metaLen;
- uint8_t *hexstream;
+ struct iovec cc;
+ struct iovec metadata;
if (presDelay) {
if (!util_iov_pull_le24(&iov, presDelay))
@@ -467,15 +468,21 @@ static bool parse_base(void *data, size_t len, util_debug_func_t func,
if (!capsLen)
return false;
+
+ cc.iov_len = capsLen;
+ cc.iov_base = util_iov_pull_mem(&iov, capsLen);
+ if (!cc.iov_base)
+ return false;
+
if (caps) {
- if (!(*caps))
- *caps = new0(struct iovec, 1);
- (*caps)->iov_len = capsLen;
- (*caps)->iov_base = iov.iov_base;
+ if (*caps)
+ util_iov_free(*caps, 1);
+
+ *caps = util_iov_dup(&cc, 1);
}
for (int i = 0; capsLen > 1; i++) {
- struct bt_ltv *ltv = util_iov_pull_mem(&iov, sizeof(*ltv));
+ struct bt_ltv *ltv = util_iov_pull_mem(&cc, sizeof(*ltv));
uint8_t *caps;
if (!ltv) {
@@ -487,7 +494,7 @@ static bool parse_base(void *data, size_t len, util_debug_func_t func,
util_debug(func, NULL, "%s #%u: len %u type %u",
"CC", i, ltv->len, ltv->type);
- caps = util_iov_pull_mem(&iov, ltv->len - 1);
+ caps = util_iov_pull_mem(&cc, ltv->len - 1);
if (!caps) {
util_debug(func, NULL, "Unable to parse %s",
"CC");
@@ -504,17 +511,20 @@ static bool parse_base(void *data, size_t len, util_debug_func_t func,
if (!metaLen)
return false;
+
+ metadata.iov_len = metaLen;
+ metadata.iov_base = util_iov_pull_mem(&iov, metaLen);
+ if (!metadata.iov_base)
+ return false;
+
if (meta) {
- if (!(*meta))
- *meta = new0(struct iovec, 1);
- (*meta)->iov_len = metaLen;
- (*meta)->iov_base = iov.iov_base;
+ if (*meta)
+ util_iov_free(*meta, 1);
+
+ *meta = util_iov_dup(&metadata, 1);
}
- hexstream = util_iov_pull_mem(&iov, metaLen);
- if (!hexstream)
- return false;
- util_hexdump(' ', hexstream, metaLen, func, NULL);
+ util_hexdump(' ', metadata.iov_base, metaLen, func, NULL);
return true;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH BlueZ 3/3] bap: Remove incorrect assignment of listen io
2024-02-02 14:10 [PATCH BlueZ 0/3] BAP fixes Iulia Tanasescu
2024-02-02 14:10 ` [PATCH BlueZ 1/3] shared/bap: Properly cleanup bap remote endpoints Iulia Tanasescu
2024-02-02 14:10 ` [PATCH BlueZ 2/3] bap: Fix incorrect parsing of caps and meta in parse_base Iulia Tanasescu
@ 2024-02-02 14:10 ` Iulia Tanasescu
2024-02-02 15:20 ` [PATCH BlueZ 0/3] BAP fixes patchwork-bot+bluetooth
3 siblings, 0 replies; 6+ messages in thread
From: Iulia Tanasescu @ 2024-02-02 14:10 UTC (permalink / raw)
To: linux-bluetooth
Cc: claudia.rosu, mihai-octavian.urzica, silviu.barbulescu,
vlad.pruteanu, andrei.istodorescu, luiz.dentz, Iulia Tanasescu
For a broadacst sink, the io that is notified in iso_bcast_confirm_cb
is the stream io, so the listen io should not be updated.
---
profiles/audio/bap.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index 909d57121..94c1de1c6 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -1061,7 +1061,6 @@ static void iso_bcast_confirm_cb(GIOChannel *io, GError *err, void *user_data)
setup->metadata);
setup->id = bt_bap_stream_config(setup->stream, &setup->qos,
setup->caps, NULL, NULL);
- data->listen_io = io;
bt_bap_stream_set_user_data(setup->stream, ep->path);
--
2.39.2
^ permalink raw reply related [flat|nested] 6+ messages in thread