[PATCH BlueZ] audio/avrcp: fix crash when NowPlaying changes while list_items is in progress

[PATCH BlueZ] audio/avrcp: fix crash when NowPlaying changes while list_items is in progress

[Frédéric Danis]

From: George Kiagiadakis <george.kiagiadakis@collabora.com>

The media_item objects are owned by the player and while we keep
temporary pointers to them in pending_list_items, clearing the player's
playlist destroys them and we will end up crashing in the next call to
avrcp_list_items_rsp(). The crash is racy and can only be observed
when skipping tracks very quickly in an Apple Music station (where the
playlist changes on every next song)
---
 profiles/audio/avrcp.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index 8d1e03b93..7296ac164 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -3879,6 +3879,14 @@ static void avrcp_now_playing_changed(struct avrcp *session,
 
 	DBG("NowPlaying changed");
 
+	/* reset the list_items operation, if it is in progress
+	or else we will crash because _clear_playlist() frees the items */
+	if (player->p) {
+		g_slist_free(player->p->items);
+		g_free(player->p);
+		player->p = NULL;
+	}
+
 	media_player_clear_playlist(mp);
 }
 
-- 
2.43.0

RE: [BlueZ] audio/avrcp: fix crash when NowPlaying changes while list_items is in progress

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1261 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=965442

---Test result---

Test Summary:
CheckPatch                    PENDING   0.27 seconds
GitLint                       PENDING   0.22 seconds
BuildEll                      PASS      20.10 seconds
BluezMake                     PASS      2671.72 seconds
MakeCheck                     PASS      20.95 seconds
MakeDistcheck                 PASS      200.06 seconds
CheckValgrind                 PASS      280.13 seconds
CheckSmatch                   PASS      306.72 seconds
bluezmakeextell               PASS      130.21 seconds
IncrementalBuild              PENDING   0.23 seconds
ScanBuild                     PASS      927.03 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth