[BlueZ] profiles: Fix segfault when using headset controls

Commit Message

Daniel Šimko Oct. 10, 2020, 10:27 p.m. UTC

This fixes a segmentation fault caused by controls trying to notify an
unregistered player.

When an unregistered player is replaced by another valid player from the
list, the session is not referenced in the sessions list of the player
and when this player is unregistered, its reference is not removed from
the session.
---
 profiles/audio/avrcp.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

Comments

[e-mail] Oct. 10, 2020, 11:33 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=362639

---Test result---

##############################
Test: CheckPatch - PASS

##############################
Test: CheckGitLint - PASS

##############################
Test: CheckBuild - PASS

##############################
Test: MakeCheck - PASS



---
Regards,
Linux Bluetooth

Luiz Augusto von Dentz Oct. 12, 2020, 5:26 p.m. UTC | #2

Hi Daniel,

On Sun, Oct 11, 2020 at 12:32 PM <[e-mail]> wrote:
>
> This is automated email and please do not reply to this email!
>
> Dear submitter,
>
> Thank you for submitting the patches to the linux bluetooth mailing list.
> This is a CI test results with your patch series:
> PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=362639
>
> ---Test result---
>
> ##############################
> Test: CheckPatch - PASS
>
> ##############################
> Test: CheckGitLint - PASS
>
> ##############################
> Test: CheckBuild - PASS
>
> ##############################
> Test: MakeCheck - PASS
>
>
>
> ---
> Regards,
> Linux Bluetooth

Applied, thanks. Note that I did some small cosmetic changes and also
add a call to notify_addressed_player_changed since we are changing
the addressed player in the process.

Patch

diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index ed436de3b..70f52efe8 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -4441,8 +4441,19 @@  void avrcp_unregister_player(struct avrcp_player *player)
 		if (target == NULL)
 			continue;
 
-		if (target->player == player)
-			target->player = g_slist_nth_data(server->players, 0);
+		if (target->player == player) {
+			struct avrcp_player *next_player = g_slist_nth_data(
+								server->players,
+								0);
+
+			target->player = next_player;
+
+			if (next_player) {
+				next_player->sessions = g_slist_append(
+							next_player->sessions,
+							session);
+			}
+		}
 	}
 
 	avrcp_player_event(player,