[PATCH BlueZ] bap: remove setup from bcast_snks when freed

[PATCH BlueZ] bap: remove setup from bcast_snks when freed

[Pauli Virtanen]

create_stream_for_bis() adds setups to data->bcast_snks, but they are
not removed from there in setup_free() which may cause double free in
bap_data_free().

Fix by removing setups from data->bcast_snks when freed.
---
 profiles/audio/bap.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index cda10a643..b6eb91ab3 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -174,6 +174,8 @@ static void setup_free(void *data);
 
 static void bap_data_free(struct bap_data *data)
 {
+	struct queue *bcast_snks = data->bcast_snks;
+
 	if (data->listen_io) {
 		g_io_channel_shutdown(data->listen_io, TRUE, NULL);
 		g_io_channel_unref(data->listen_io);
@@ -189,7 +191,9 @@ static void bap_data_free(struct bap_data *data)
 	queue_destroy(data->srcs, ep_unregister);
 	queue_destroy(data->bcast, ep_unregister);
 	queue_destroy(data->server_streams, NULL);
-	queue_destroy(data->bcast_snks, setup_free);
+	data->bcast_snks = NULL;
+	queue_destroy(bcast_snks, setup_free);
+
 	bt_bap_ready_unregister(data->bap, data->ready_id);
 	bt_bap_state_unregister(data->bap, data->state_id);
 	bt_bap_pac_unregister(data->bap, data->pac_id);
@@ -1104,6 +1108,9 @@ static void setup_free(void *data)
 	if (setup->ep)
 		queue_remove(setup->ep->setups, setup);
 
+	if (setup->data)
+		queue_remove(setup->data->bcast_snks, setup);
+
 	setup_io_close(setup, NULL);
 
 	util_iov_free(setup->caps, 1);
-- 
2.52.0

RE: [BlueZ] bap: remove setup from bcast_snks when freed

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1262 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1037326

---Test result---

Test Summary:
CheckPatch                    PENDING   0.25 seconds
GitLint                       PENDING   0.29 seconds
BuildEll                      PASS      20.13 seconds
BluezMake                     PASS      646.71 seconds
MakeCheck                     PASS      21.69 seconds
MakeDistcheck                 PASS      242.45 seconds
CheckValgrind                 PASS      303.18 seconds
CheckSmatch                   PASS      351.13 seconds
bluezmakeextell               PASS      182.51 seconds
IncrementalBuild              PENDING   0.29 seconds
ScanBuild                     PASS      1028.12 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] bap: remove setup from bcast_snks when freed

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 30 Dec 2025 13:06:09 +0200 you wrote:
> create_stream_for_bis() adds setups to data->bcast_snks, but they are
> not removed from there in setup_free() which may cause double free in
> bap_data_free().
> 
> Fix by removing setups from data->bcast_snks when freed.
> ---
>  profiles/audio/bap.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)

Here is the summary with links:
  - [BlueZ] bap: remove setup from bcast_snks when freed
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=c8fb53f49cc6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html