[PATCH BlueZ] avrcp: Fix crash on remote player changed

[PATCH BlueZ] avrcp: Fix crash on remote player changed

[Frédéric Danis]

bluetoothd crashes when the remote player changes while bluetoothd
is waiting for avrcp_list_items reply.

profiles/audio/player.c:1597:9: runtime error: member access within null pointer of type 'struct media_folder'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==825871==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x602bb0fffabc bp 0x000000000020 sp 0x7ffef88216d0 T0)
==825871==The signal is caused by a READ memory access.
==825871==Hint: address points to the zero page.
    #0 0x602bb0fffabc in media_folder_find_item profiles/audio/player.c:1597
    #1 0x602bb100cd3b in media_folder_create_item profiles/audio/player.c:1877
    #2 0x602bb100cd3b in media_player_create_item profiles/audio/player.c:1928
    #3 0x602bb107eae6 in parse_media_element profiles/audio/avrcp.c:2605
    #4 0x602bb107eae6 in avrcp_list_items_rsp profiles/audio/avrcp.c:2706
    #5 0x602bb106892f in browsing_response profiles/audio/avctp.c:987
    #6 0x602bb106892f in session_browsing_cb profiles/audio/avctp.c:1028
    #7 0x73de85b1448d  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d48d) (BuildId: 461eff2b4df472ba9c32b2358ae9ba018a59a8c5)
    #8 0x73de85b73716  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc716) (BuildId: 461eff2b4df472ba9c32b2358ae9ba018a59a8c5)
    #9 0x73de85b14f76 in g_main_loop_run (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5df76) (BuildId: 461eff2b4df472ba9c32b2358ae9ba018a59a8c5)
    #10 0x602bb13a22a8 in mainloop_run src/shared/mainloop-glib.c:66
    #11 0x602bb13a2bb6 in mainloop_run_with_signal src/shared/mainloop-notify.c:189
    #12 0x602bb0fd0257 in main src/main.c:1544
    #13 0x73de84e2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #14 0x73de84e2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #15 0x602bb0fd3124 in _start (/home/fdanis/src/bluez/src/bluetoothd+0x5c8124) (BuildId: 367892bd0501d74713dd7341977abfac1b2c5d6a)

This can be reproduced using bluetoothctl and doing "player.list-items"
just before switching music player on the remote device.

This commit discards the item list parsing if the current player has
not created a pending_list_items, i.e. it doesn't start this request.
---
 profiles/audio/avrcp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index 9fe8f55e5..6378b7a6e 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -2661,6 +2661,11 @@ static gboolean avrcp_list_items_rsp(struct avctp *conn, uint8_t *operands,
 	size_t i;
 	int err = 0;
 
+	if (player->p == NULL) {
+		media_player_list_complete(player->user_data, NULL, -EINVAL);
+		return FALSE;
+	}
+
 	if (pdu == NULL) {
 		err = -ETIMEDOUT;
 		goto done;
-- 
2.43.0

RE: [BlueZ] avrcp: Fix crash on remote player changed

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=928111

---Test result---

Test Summary:
CheckPatch                    PENDING   0.25 seconds
GitLint                       PENDING   0.36 seconds
BuildEll                      PASS      20.56 seconds
BluezMake                     PASS      1541.31 seconds
MakeCheck                     PASS      12.69 seconds
MakeDistcheck                 PASS      159.28 seconds
CheckValgrind                 PASS      213.87 seconds
CheckSmatch                   PASS      269.47 seconds
bluezmakeextell               PASS      98.06 seconds
IncrementalBuild              PENDING   0.41 seconds
ScanBuild                     PASS      859.68 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] avrcp: Fix crash on remote player changed

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 24 Jan 2025 12:03:31 +0100 you wrote:
> bluetoothd crashes when the remote player changes while bluetoothd
> is waiting for avrcp_list_items reply.
> 
> profiles/audio/player.c:1597:9: runtime error: member access within null pointer of type 'struct media_folder'
> AddressSanitizer:DEADLYSIGNAL
> =================================================================
> ==825871==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x602bb0fffabc bp 0x000000000020 sp 0x7ffef88216d0 T0)
> ==825871==The signal is caused by a READ memory access.
> ==825871==Hint: address points to the zero page.
>     #0 0x602bb0fffabc in media_folder_find_item profiles/audio/player.c:1597
>     #1 0x602bb100cd3b in media_folder_create_item profiles/audio/player.c:1877
>     #2 0x602bb100cd3b in media_player_create_item profiles/audio/player.c:1928
>     #3 0x602bb107eae6 in parse_media_element profiles/audio/avrcp.c:2605
>     #4 0x602bb107eae6 in avrcp_list_items_rsp profiles/audio/avrcp.c:2706
>     #5 0x602bb106892f in browsing_response profiles/audio/avctp.c:987
>     #6 0x602bb106892f in session_browsing_cb profiles/audio/avctp.c:1028
>     #7 0x73de85b1448d  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d48d) (BuildId: 461eff2b4df472ba9c32b2358ae9ba018a59a8c5)
>     #8 0x73de85b73716  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc716) (BuildId: 461eff2b4df472ba9c32b2358ae9ba018a59a8c5)
>     #9 0x73de85b14f76 in g_main_loop_run (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5df76) (BuildId: 461eff2b4df472ba9c32b2358ae9ba018a59a8c5)
>     #10 0x602bb13a22a8 in mainloop_run src/shared/mainloop-glib.c:66
>     #11 0x602bb13a2bb6 in mainloop_run_with_signal src/shared/mainloop-notify.c:189
>     #12 0x602bb0fd0257 in main src/main.c:1544
>     #13 0x73de84e2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>     #14 0x73de84e2a28a in __libc_start_main_impl ../csu/libc-start.c:360
>     #15 0x602bb0fd3124 in _start (/home/fdanis/src/bluez/src/bluetoothd+0x5c8124) (BuildId: 367892bd0501d74713dd7341977abfac1b2c5d6a)
> 
> [...]

Here is the summary with links:
  - [BlueZ] avrcp: Fix crash on remote player changed
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=fac78ca5dbbd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html