[PATCH BlueZ 1/3] audio/avctp: Match opcode when parsing responses

[PATCH BlueZ 1/3] audio/avctp: Match opcode when parsing responses

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The transaction may not be unique given the fact that notifications can
take all the outstanding transaction which may cause transactions to be
reused as explained in the errata:

https://www.bluetooth.org/errata/errata_view.cfm?errata_id=3812
---
 profiles/audio/avctp.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/profiles/audio/avctp.c b/profiles/audio/avctp.c
index 2a43d32..0807be1 100644
--- a/profiles/audio/avctp.c
+++ b/profiles/audio/avctp.c
@@ -808,6 +808,10 @@ static void control_response(struct avctp_channel *control,
 	GSList *l;
 
 	if (p && p->transaction == avctp->transaction) {
+		req = p->data;
+		if (req->op != avc->opcode)
+			goto done;
+
 		control->processed = g_slist_prepend(control->processed, p);
 
 		if (p->timeout > 0) {
@@ -822,6 +826,7 @@ static void control_response(struct avctp_channel *control,
 								control);
 	}
 
+done:
 	for (l = control->processed; l; l = l->next) {
 		p = l->data;
 		req = p->data;
@@ -829,6 +834,9 @@ static void control_response(struct avctp_channel *control,
 		if (p->transaction != avctp->transaction)
 			continue;
 
+		if (req->op != avc->opcode)
+			continue;
+
 		if (req->func && req->func(control->session, avc->code,
 					avc->subunit_type, p->transaction,
 					operands, operand_count,
-- 
2.9.3

[PATCH BlueZ 2/3] audio/avdtp: Fix calling abort confirmation

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Abort confirmation shall only be called in case an abort has been sent
and the setup has to be unref asynchronously.
---
 profiles/audio/avdtp.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
index 4ec9cca..4a21e03 100644
--- a/profiles/audio/avdtp.c
+++ b/profiles/audio/avdtp.c
@@ -2442,10 +2442,9 @@ static int cancel_request(struct avdtp *session, int err)
 	else
 		stream = NULL;
 
-	if (stream) {
-		stream->abort_int = TRUE;
+	if (stream)
 		lsep = stream->lsep;
-	} else
+	else
 		lsep = NULL;
 
 	switch (req->signal_id) {
@@ -2515,6 +2514,8 @@ static int cancel_request(struct avdtp *session, int err)
 		goto failed;
 	}
 
+	stream->abort_int = TRUE;
+
 	goto done;
 
 failed:
-- 
2.9.3

[PATCH BlueZ 3/3] audio/avdtp: Fix not aborting SetConfiguration

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

If for some reason SetConfiguration is cancelled an Abort shall be
generated since it there could be a stream pending.
---
 profiles/audio/avdtp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
index 4a21e03..51ead68 100644
--- a/profiles/audio/avdtp.c
+++ b/profiles/audio/avdtp.c
@@ -2489,7 +2489,7 @@ static int cancel_request(struct avdtp *session, int err)
 		if (lsep && lsep->cfm && lsep->cfm->set_configuration)
 			lsep->cfm->set_configuration(session, lsep, stream,
 							&averr, lsep->user_data);
-		goto failed;
+		break;
 	case AVDTP_DISCOVER:
 		error("Discover: %s (%d)", strerror(err), err);
 		goto failed;
-- 
2.9.3

Re: [PATCH BlueZ 1/3] audio/avctp: Match opcode when parsing responses

[Luiz Augusto von Dentz]

Hi,

On Fri, Jan 20, 2017 at 3:43 PM, Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> The transaction may not be unique given the fact that notifications can
> take all the outstanding transaction which may cause transactions to be
> reused as explained in the errata:
>
> https://www.bluetooth.org/errata/errata_view.cfm?errata_id=3812
> ---
>  profiles/audio/avctp.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/profiles/audio/avctp.c b/profiles/audio/avctp.c
> index 2a43d32..0807be1 100644
> --- a/profiles/audio/avctp.c
> +++ b/profiles/audio/avctp.c
> @@ -808,6 +808,10 @@ static void control_response(struct avctp_channel *control,
>         GSList *l;
>
>         if (p && p->transaction == avctp->transaction) {
> +               req = p->data;
> +               if (req->op != avc->opcode)
> +                       goto done;
> +
>                 control->processed = g_slist_prepend(control->processed, p);
>
>                 if (p->timeout > 0) {
> @@ -822,6 +826,7 @@ static void control_response(struct avctp_channel *control,
>                                                                 control);
>         }
>
> +done:
>         for (l = control->processed; l; l = l->next) {
>                 p = l->data;
>                 req = p->data;
> @@ -829,6 +834,9 @@ static void control_response(struct avctp_channel *control,
>                 if (p->transaction != avctp->transaction)
>                         continue;
>
> +               if (req->op != avc->opcode)
> +                       continue;
> +
>                 if (req->func && req->func(control->session, avc->code,
>                                         avc->subunit_type, p->transaction,
>                                         operands, operand_count,
> --
> 2.9.3

Applied.


-- 
Luiz Augusto von Dentz