[PATCH BlueZ] avrcp: Fix not ending loop during item listing

[PATCH BlueZ] avrcp: Fix not ending loop during item listing

[Frédéric Danis]

When a remote applications return item with UUID set to 0, which is
against the specs (see 6.10.3 UIDs in AVRCP_v1.6.2.pdf), bluetoothd may
try to retrieve the same item in no ending loop.

  bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() WDR2 Rheinland type audio uid 0
  bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() /org/bluez/hci0/dev_58_66_6D_84_ED_21/player0/NowPlaying/item0
  bluetoothd[2]: profiles/audio/player.c:media_player_set_metadata() Title: WDR 2 Rheinland
  bluetoothd[2]: profiles/audio/avrcp.c:avrcp_list_items_rsp() start 0 end 9 items 1 total 10
  bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() WDR 2 Rheinland type audio uid 0
  bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() D-Bus failed to register org.bluez.MediaItem1 on /org/bluez/hci0/dev_58_66_6D_84_ED_21/player0/NowPlaying/item0 path
  bluetoothd[2]: profiles/audio/avrcp.c:avrcp_list_items_rsp() start 0 end 9 items 0 total 10
  bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() WDR 2 Rheinland type audio uid 0
  bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() D-Bus failed to register org.bluez.MediaItem1 on /org/bluez/hci0/dev_58_66_6D_84_ED_21/player0/NowPlaying/item0 path
  bluetoothd[2]: profiles/audio/avrcp.c:avrcp_list_items_rsp() start 0 end 9 items 0 total 10
---
 profiles/audio/avrcp.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index 95f3f032a..21bc80bbd 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -2661,6 +2661,7 @@ static gboolean avrcp_list_items_rsp(struct avctp *conn, uint8_t *operands,
 	struct pending_list_items *p = player->p;
 	uint16_t count;
 	uint64_t items;
+	uint64_t new_items = 0;
 	size_t i;
 	int err = 0;
 
@@ -2715,8 +2716,10 @@ static gboolean avrcp_list_items_rsp(struct avctp *conn, uint8_t *operands,
 		else
 			item = parse_media_folder(session, &operands[i], len);
 
-		if (item)
+		if (item) {
 			p->items = g_slist_append(p->items, item);
+			new_items++;
+		}
 
 		i += len;
 	}
@@ -2726,7 +2729,7 @@ static gboolean avrcp_list_items_rsp(struct avctp *conn, uint8_t *operands,
 	DBG("start %u end %u items %" PRIu64 " total %" PRIu64 "", p->start,
 						p->end, items, p->total);
 
-	if (items < p->total) {
+	if (new_items > 0 && items < p->total) {
 		avrcp_list_items(session, p->start + items, p->end);
 		return FALSE;
 	}
-- 
2.43.0

RE: [BlueZ] avrcp: Fix not ending loop during item listing

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1261 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=995585

---Test result---

Test Summary:
CheckPatch                    PENDING   0.42 seconds
GitLint                       PENDING   0.47 seconds
BuildEll                      PASS      20.04 seconds
BluezMake                     PASS      2576.95 seconds
MakeCheck                     PASS      20.47 seconds
MakeDistcheck                 PASS      184.14 seconds
CheckValgrind                 PASS      237.67 seconds
CheckSmatch                   PASS      309.59 seconds
bluezmakeextell               PASS      128.66 seconds
IncrementalBuild              PENDING   0.41 seconds
ScanBuild                     PASS      916.68 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] avrcp: Fix not ending loop during item listing

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 26 Aug 2025 11:02:54 +0200 you wrote:
> When a remote applications return item with UUID set to 0, which is
> against the specs (see 6.10.3 UIDs in AVRCP_v1.6.2.pdf), bluetoothd may
> try to retrieve the same item in no ending loop.
> 
>   bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() WDR2 Rheinland type audio uid 0
>   bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() /org/bluez/hci0/dev_58_66_6D_84_ED_21/player0/NowPlaying/item0
>   bluetoothd[2]: profiles/audio/player.c:media_player_set_metadata() Title: WDR 2 Rheinland
>   bluetoothd[2]: profiles/audio/avrcp.c:avrcp_list_items_rsp() start 0 end 9 items 1 total 10
>   bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() WDR 2 Rheinland type audio uid 0
>   bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() D-Bus failed to register org.bluez.MediaItem1 on /org/bluez/hci0/dev_58_66_6D_84_ED_21/player0/NowPlaying/item0 path
>   bluetoothd[2]: profiles/audio/avrcp.c:avrcp_list_items_rsp() start 0 end 9 items 0 total 10
>   bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() WDR 2 Rheinland type audio uid 0
>   bluetoothd[2]: profiles/audio/player.c:media_folder_create_item() D-Bus failed to register org.bluez.MediaItem1 on /org/bluez/hci0/dev_58_66_6D_84_ED_21/player0/NowPlaying/item0 path
>   bluetoothd[2]: profiles/audio/avrcp.c:avrcp_list_items_rsp() start 0 end 9 items 0 total 10
> 
> [...]

Here is the summary with links:
  - [BlueZ] avrcp: Fix not ending loop during item listing
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=ca209e3f8fac

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html