diff mbox series

[BlueZ,1/1] shared/bap: Fix crash unreg bcast src endpoint

Message ID 20240223141609.27181-2-silviu.barbulescu@nxp.com (mailing list archive)
State Accepted
Commit 8f262a27bdf233f142a7bb22bf3f8c6db53debee
Headers show
Series Fix crash when unregistering bcast source endpoint | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/CheckPatch success CheckPatch PASS
tedd_an/GitLint success Gitlint PASS
tedd_an/BuildEll success Build ELL PASS
tedd_an/BluezMake success Bluez Make PASS
tedd_an/MakeCheck success Bluez Make Check PASS
tedd_an/MakeDistcheck success Make Distcheck PASS
tedd_an/CheckValgrind success Check Valgrind PASS
tedd_an/CheckSmatch success CheckSparse PASS
tedd_an/bluezmakeextell success Make External ELL PASS
tedd_an/IncrementalBuild success Incremental Build PASS
tedd_an/ScanBuild warning ScanBuild: src/shared/bap.c:1145:2: warning: Use of memory after it is freed DBG(stream->bap, "stream %p", stream); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/bap.c:40:2: note: expanded from macro 'DBG' bap_debug(_bap, "%s:%s() " fmt, __FILE__, __func__, ## arg) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/bap.c:1698:3: warning: Use of memory after it is freed stream_set_state(stream, BT_BAP_STREAM_STATE_CONFIG); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated.

Commit Message

Silviu Florian Barbulescu Feb. 23, 2024, 2:16 p.m. UTC 
In bt_bap_stream_release stream is accessed after free

---
 src/shared/bap.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

bluez.test.bot@gmail.com Feb. 23, 2024, 3:30 p.m. UTC | #1 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=829116

---Test result---

Test Summary:
CheckPatch                    PASS      0.46 seconds
GitLint                       PASS      0.32 seconds
BuildEll                      PASS      23.94 seconds
BluezMake                     PASS      720.27 seconds
MakeCheck                     PASS      12.00 seconds
MakeDistcheck                 PASS      163.14 seconds
CheckValgrind                 PASS      225.71 seconds
CheckSmatch                   PASS      330.14 seconds
bluezmakeextell               PASS      109.14 seconds
IncrementalBuild              PASS      681.46 seconds
ScanBuild                     WARNING   956.79 seconds

Details
##############################
Test: ScanBuild - WARNING
Desc: Run Scan Build
Output:
src/shared/bap.c:1145:2: warning: Use of memory after it is freed
        DBG(stream->bap, "stream %p", stream);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:40:2: note: expanded from macro 'DBG'
        bap_debug(_bap, "%s:%s() " fmt, __FILE__, __func__, ## arg)
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:1698:3: warning: Use of memory after it is freed
                stream_set_state(stream, BT_BAP_STREAM_STATE_CONFIG);
                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.



---
Regards,
Linux Bluetooth
diff mbox series

Patch

diff --git a/src/shared/bap.c b/src/shared/bap.c
index f5fc14027..626e8f127 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -5411,16 +5411,17 @@  unsigned int bt_bap_stream_release(struct bt_bap_stream *stream,
 					void *user_data)
 {
 	unsigned int id;
+	struct bt_bap *bap = stream->bap;
 
 	if (!stream || !stream->ops || !stream->ops->release)
 		return 0;
 
-	if (!bt_bap_ref_safe(stream->bap))
+	if (!bt_bap_ref_safe(bap))
 		return 0;
 
 	id = stream->ops->release(stream, func, user_data);
 
-	bt_bap_unref(stream->bap);
+	bt_bap_unref(bap);
 
 	return id;
 }