[PATCH] Fix crash when unregistering a2dp driver before media driver

[PATCH] Fix crash when unregistering a2dp driver before media driver

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>

Since media driver uses a2dp to register its sep and store a pointer,
this pointer may be invalid/freed when media driver is unregistered.

To fix this now a2dp will also release any sep registered using media
API.

It also protect from future changes on the order of drivers removal by
checking if pointers (sep or endpoint) are still available in the list
before removing them.
---
 audio/a2dp.c  |    7 +++++++
 audio/media.c |    3 +++
 2 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/audio/a2dp.c b/audio/a2dp.c
index ea4805c..8595350 100644
--- a/audio/a2dp.c
+++ b/audio/a2dp.c
@@ -1517,6 +1517,9 @@ proceed:
 
 static void a2dp_unregister_sep(struct a2dp_sep *sep)
 {
+	if (sep->endpoint)
+		media_endpoint_release(sep->endpoint);
+
 	avdtp_unregister_sep(sep->lsep);
 	g_free(sep);
 }
@@ -1648,12 +1651,16 @@ void a2dp_remove_sep(struct a2dp_sep *sep)
 	struct a2dp_server *server = sep->server;
 
 	if (sep->type == AVDTP_SEP_TYPE_SOURCE) {
+		if (g_slist_find(server->sources, sep) == NULL)
+			return;
 		server->sources = g_slist_remove(server->sources, sep);
 		if (server->sources == NULL && server->source_record_id) {
 			remove_record_from_server(server->source_record_id);
 			server->source_record_id = 0;
 		}
 	} else {
+		if (g_slist_find(server->sinks, sep) == NULL)
+			return;
 		server->sinks = g_slist_remove(server->sinks, sep);
 		if (server->sinks == NULL && server->sink_record_id) {
 			remove_record_from_server(server->sink_record_id);
diff --git a/audio/media.c b/audio/media.c
index d5fb29c..4b389c6 100644
--- a/audio/media.c
+++ b/audio/media.c
@@ -108,6 +108,9 @@ static void media_endpoint_remove(struct media_endpoint *endpoint)
 {
 	struct media_adapter *adapter = endpoint->adapter;
 
+	if (g_slist_find(adapter->endpoints, endpoint) == NULL)
+		return;
+
 	info("Endpoint unregistered: sender=%s path=%s", endpoint->sender,
 			endpoint->path);
 
-- 
1.7.1

Re: [PATCH] Fix crash when unregistering a2dp driver before media driver

[Johan Hedberg]

Hi Luiz,

On Mon, Mar 21, 2011, Luiz Augusto von Dentz wrote:
> Since media driver uses a2dp to register its sep and store a pointer,
> this pointer may be invalid/freed when media driver is unregistered.
> 
> To fix this now a2dp will also release any sep registered using media
> API.
> 
> It also protect from future changes on the order of drivers removal by
> checking if pointers (sep or endpoint) are still available in the list
> before removing them.
> ---
>  audio/a2dp.c  |    7 +++++++
>  audio/media.c |    3 +++
>  2 files changed, 10 insertions(+), 0 deletions(-)

Pushed upstream. Thanks.

Johan