Linux bluetooth development
 help / color / mirror / Atom feed
* [PATCH BlueZ] a2dp: Fix crash on NULL stream in transport_cb
@ 2026-09-19 18:44 Iaroslav Voitovych
  2026-09-19 22:10 ` [BlueZ] " bluez.test.bot
  0 siblings, 1 reply; 2+ messages in thread
From: Iaroslav Voitovych @ 2026-09-19 18:44 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Iaroslav Voitovych

transport_cb() runs from bt_io_accept() and begins by confirming that
the a2dp_setup it was handed still exists:

	if (!g_slist_find(setups, setup)) {
		warn("bt_io_accept: setup %p no longer valid", setup);
		...
	}

That establishes the lifetime of the setup, not of the stream it
points at. Several paths in a2dp.c clear setup->stream while leaving
the setup itself on the list, so by the time the accept completes the
setup can be valid and its stream NULL. confirm_cb() already refuses
to start the accept when setup->stream is NULL; nothing re-checks it
when the accept completes, and it is then passed on unchecked:

	if (!avdtp_stream_set_transport(setup->stream,
					g_io_channel_unix_get_fd(io),
					imtu, omtu))

and avdtp_stream_set_transport() dereferences it immediately:

	gboolean avdtp_stream_set_transport(struct avdtp_stream *stream, ...)
	{
		GIOChannel *io = g_io_channel_unix_new(fd);

		if (stream != stream->session->pending_open) {

Observed as a crash on a QCA9377 (13d3:3503) whose controller stops
answering HCI during audio use. From the retained core, %r13 held NULL
and the faulting instruction was the first field load off it:

  bluetoothd[398112]: segfault at 10 ip 0000635d944b47e5 sp 00007ffefcba28d0 \
      error 4 in bluetoothd[367e5,635d944a3000+f3000]

  r13  0x0
  => 0x635d944b47e5:  mov 0x10(%r13),%rdi

With the check in place and the daemon logging before it bails, the
guard fired four times in 19 days of ordinary use on the same machine
(once on 2026-08-26, three times on 2026-09-02, across two daemon
lifetimes and three distinct setup pointers). Each of those is an
accept that completed after the stream had been cleared; unpatched,
each is the dereference above.

Check the stream immediately before it is used, so every existing path
keeps its current behaviour up to the point that was previously
unsafe. In particular a bt_io_accept() error or a bt_io_get() failure
still reports the real I/O error rather than this secondary lifecycle
condition.

commit 125a2e237e7c ("a2dp: Fix possible crash when accepting stream
transport") previously hardened this same asynchronous accept window
against the whole setup disappearing while the accept was pending.
This covers the remaining case where the setup survives and its stream
does not.

commit 90a600895d80 ("avdtp: Handle case where remote send L2CAP
connect ahead of Open") also changed avdtp_stream_set_transport()
itself, to handle a transport arriving before Open. The function still
dereferences stream before reaching that handling, so it does not
cover a NULL argument from transport_cb().
---
Context, not part of the change: the crash was recorded on a QCA9377
(13d3:3503) laptop under Ubuntu 24.04 / bluez 5.72-0ubuntu5.5 and the
site was resolved from the stripped distro binary, then checked against
a retained core. The record, including the four logged firings of this
guard and the crash-site method, is public:
https://github.com/ivoitovych/qca9377-bt-hang  (patches/bluez/README.md)

 profiles/audio/a2dp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
--- a/profiles/audio/a2dp.c
+++ b/profiles/audio/a2dp.c
@@ -2672,6 +2672,11 @@
 		goto drop;
 	}

+	if (!setup->stream) {
+		error("bt_io_accept: setup %p has no stream", setup);
+		goto drop;
+	}
+
 	if (!avdtp_stream_set_transport(setup->stream,
 					g_io_channel_unix_get_fd(io),
 					imtu, omtu))
--
2.43.0

^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-19 22:10 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-19 18:44 [PATCH BlueZ] a2dp: Fix crash on NULL stream in transport_cb Iaroslav Voitovych
2026-09-19 22:10 ` [BlueZ] " bluez.test.bot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox