[BlueZ,1/3] shared/bap: Properly cleanup bap remote endpoints

Commit Message

Iulia Tanasescu Feb. 2, 2024, 2:10 p.m. UTC

When freeing a remote bap endpoint, the endpoint reference inside the
stream should be set to NULL, to avoid later use after free errors.
---
 src/shared/bap.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

Comments

[e-mail] Feb. 2, 2024, 3:54 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=822537

---Test result---

Test Summary:
CheckPatch                    PASS      1.36 seconds
GitLint                       PASS      0.97 seconds
BuildEll                      PASS      24.14 seconds
BluezMake                     PASS      735.14 seconds
MakeCheck                     PASS      11.36 seconds
MakeDistcheck                 PASS      162.88 seconds
CheckValgrind                 PASS      226.40 seconds
CheckSmatch                   PASS      327.49 seconds
bluezmakeextell               PASS      107.14 seconds
IncrementalBuild              PASS      2114.75 seconds
ScanBuild                     PASS      936.54 seconds



---
Regards,
Linux Bluetooth

Patch

diff --git a/src/shared/bap.c b/src/shared/bap.c
index 851d6a5fa..60fb826c3 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -2979,6 +2979,16 @@  static void bap_state_free(void *data)
 	free(state);
 }
 
+static void bap_ep_free(void *data)
+{
+	struct bt_bap_endpoint *ep = data;
+
+	if (ep && ep->stream)
+		ep->stream->ep = NULL;
+
+	free(ep);
+}
+
 static void bap_detached(void *data, void *user_data)
 {
 	struct bt_bap_cb *cb = data;
@@ -3001,7 +3011,7 @@  static void bap_free(void *data)
 	queue_destroy(bap->ready_cbs, bap_ready_free);
 	queue_destroy(bap->state_cbs, bap_state_free);
 	queue_destroy(bap->local_eps, free);
-	queue_destroy(bap->remote_eps, free);
+	queue_destroy(bap->remote_eps, bap_ep_free);
 
 	queue_destroy(bap->reqs, bap_req_free);
 	queue_destroy(bap->notify, NULL);