Skip to content

Commit

Permalink
shared/bap: fix crash unregistering media endpoint while streaming
Browse files Browse the repository at this point in the history
The following ASAN crash is observed when media endpoint is unregistered
(stopping sound server) while streaming from remote BAP client:

ERROR: AddressSanitizer: heap-use-after-free on address 0x60b0000474d8
READ of size 8 at 0x60b0000474d8 thread T0
    #0 0x7a27c6 in stream_set_state src/shared/bap.c:1227
    bluez#1 0x7aff61 in remove_streams src/shared/bap.c:2483
    bluez#2 0x71d2d0 in queue_foreach src/shared/queue.c:207
    bluez#3 0x7b0152 in bt_bap_remove_pac src/shared/bap.c:2501
    bluez#4 0x463cda in media_endpoint_destroy profiles/audio/media.c:179
    ...
0x60b0000474d8 is located 8 bytes inside of 112-byte region
freed by thread T0 here:
    #0 0x7f93b12b9388 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xb9388)
    bluez#1 0x7a0504 in bap_stream_free src/shared/bap.c:972
    bluez#2 0x7a0800 in bap_stream_detach src/shared/bap.c:989
    bluez#3 0x7a26d1 in bap_stream_state_changed src/shared/bap.c:1208
    bluez#4 0x7a2ab4 in stream_set_state src/shared/bap.c:1252
    bluez#5 0x7ab18a in stream_release src/shared/bap.c:1985
    bluez#6 0x7c6919 in bt_bap_stream_release src/shared/bap.c:4572
    bluez#7 0x7aff50 in remove_streams src/shared/bap.c:2482
    ...
previously allocated by thread T0 here:
    #0 0x7f93b12ba6af in __interceptor_malloc (/lib64/libasan.so.8+0xba6af)
    bluez#1 0x71e9ae in util_malloc src/shared/util.c:43
    bluez#2 0x79c2f5 in bap_stream_new src/shared/bap.c:766
    bluez#3 0x7a4863 in ep_config src/shared/bap.c:1446
    bluez#4 0x7a4f22 in ascs_config src/shared/bap.c:1481
    ...

When stream->client is false, bt_bap_stream_release already sets the
stream to idle and frees it.

Fix the crash by not setting the state to idle for the second time,
in this case.
  • Loading branch information
pv committed Feb 5, 2023
1 parent bfb5182 commit 960a418
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion src/shared/bap.c
Original file line number Diff line number Diff line change
Expand Up @@ -2480,8 +2480,11 @@ static void remove_streams(void *data, void *user_data)

stream = queue_remove_if(bap->streams, match_stream_lpac, pac);
if (stream) {
bool client = stream->client;

bt_bap_stream_release(stream, NULL, NULL);
stream_set_state(stream, BT_BAP_STREAM_STATE_IDLE);
if (client)
stream_set_state(stream, BT_BAP_STREAM_STATE_IDLE);
}
}

Expand Down

0 comments on commit 960a418

Please sign in to comment.