[PATCH BlueZ] src/shared: allow passing in stream's own metadata to enable()

[PATCH BlueZ] src/shared: allow passing in stream's own metadata to enable()

[Pauli Virtanen]

If metadata is same, it should not be freed as it may be stream's own.

Fixes:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 8 at 0x7b86a76f5d18 thread T0
    #0 0x000000836745 in util_iov_dup src/shared/util.c:353
    #1 0x0000008ea96b in bap_stream_metadata src/shared/bap.c:1991
    #2 0x0000008ebfbe in bap_ucast_enable src/shared/bap.c:2072
    #3 0x0000009226e7 in bt_bap_stream_enable src/shared/bap.c:6392
    #4 0x00000044037d in transport_bap_resume profiles/audio/transport.c:1981
freed by thread T0 here:
    #0 0x7f66a92e5bcb in free.part.0 (/lib64/libasan.so.8+0xe5bcb)
    #1 0x000000837002 in util_iov_free src/shared/util.c:392
    #2 0x0000008ea94e in bap_stream_metadata src/shared/bap.c:1990
    #3 0x0000008ebfbe in bap_ucast_enable src/shared/bap.c:2072
---
 src/shared/bap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index 8d1c69d47..070f4fc05 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -1986,7 +1986,7 @@ static unsigned int bap_stream_metadata(struct bt_bap_stream *stream,
 	iov[0].iov_base = &meta;
 	iov[0].iov_len = sizeof(meta);
 
-	if (data) {
+	if (data && util_iov_memcmp(stream->meta, data)) {
 		util_iov_free(stream->meta, 1);
 		stream->meta = util_iov_dup(data, 1);
 	}
-- 
2.49.0

Re: [PATCH BlueZ] src/shared: allow passing in stream's own metadata to enable()

[Luiz Augusto von Dentz]

Hi Pauli,

On Thu, Jun 19, 2025 at 2:53 PM Pauli Virtanen <pav@iki.fi> wrote:
>
> If metadata is same, it should not be freed as it may be stream's own.
>
> Fixes:
>
> ERROR: AddressSanitizer: heap-use-after-free
> READ of size 8 at 0x7b86a76f5d18 thread T0
>     #0 0x000000836745 in util_iov_dup src/shared/util.c:353
>     #1 0x0000008ea96b in bap_stream_metadata src/shared/bap.c:1991
>     #2 0x0000008ebfbe in bap_ucast_enable src/shared/bap.c:2072
>     #3 0x0000009226e7 in bt_bap_stream_enable src/shared/bap.c:6392
>     #4 0x00000044037d in transport_bap_resume profiles/audio/transport.c:1981
> freed by thread T0 here:
>     #0 0x7f66a92e5bcb in free.part.0 (/lib64/libasan.so.8+0xe5bcb)
>     #1 0x000000837002 in util_iov_free src/shared/util.c:392
>     #2 0x0000008ea94e in bap_stream_metadata src/shared/bap.c:1990
>     #3 0x0000008ebfbe in bap_ucast_enable src/shared/bap.c:2072
> ---
>  src/shared/bap.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/shared/bap.c b/src/shared/bap.c
> index 8d1c69d47..070f4fc05 100644
> --- a/src/shared/bap.c
> +++ b/src/shared/bap.c
> @@ -1986,7 +1986,7 @@ static unsigned int bap_stream_metadata(struct bt_bap_stream *stream,
>         iov[0].iov_base = &meta;
>         iov[0].iov_len = sizeof(meta);
>
> -       if (data) {
> +       if (data && util_iov_memcmp(stream->meta, data)) {
>                 util_iov_free(stream->meta, 1);
>                 stream->meta = util_iov_dup(data, 1);
>         }

This makes sense but I do wonder if we shouldn't just be checking if
data and stream->meta pointer are the same, or perhaps we shouldn't be
passing it own stream->meta to bap_stream_metadata since that
internally already uses it anyway.

> --
> 2.49.0
>
>


-- 
Luiz Augusto von Dentz

RE: [BlueZ] src/shared: allow passing in stream's own metadata to enable()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1864 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=973966

---Test result---

Test Summary:
CheckPatch                    PENDING   0.32 seconds
GitLint                       PENDING   0.40 seconds
BuildEll                      PASS      20.79 seconds
BluezMake                     PASS      2860.68 seconds
MakeCheck                     PASS      20.10 seconds
MakeDistcheck                 PASS      207.19 seconds
CheckValgrind                 PASS      284.44 seconds
CheckSmatch                   WARNING   314.53 seconds
bluezmakeextell               PASS      133.12 seconds
IncrementalBuild              PENDING   0.35 seconds
ScanBuild                     PASS      951.32 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/bap.c:317:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:317:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:317:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structures
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth