[PATCH] Fix segmentation fault when headset disconnects during authorization

[PATCH] Fix segmentation fault when headset disconnects during authorization

[Claudio Takahasi]

[-- Attachment #1: Type: text/plain, Size: 695 bytes --]

Hi guys,

This patch fix a segmentation fault when the headset disconnected
during authorization, see gdb backtrace:
http://pastebin.com/m1529c2dc

Can someone fix avctp now? For this case, answering "yes" in agent
avctp connection will be left open:

bluetoothd[5406]: Headset disconnected during authorization
bluetoothd[5406]: State changed
/org/bluez/5406/hci0/dev_00_15_A0_0F_76_CF: HEADSET_STATE_CONNECTING
-> HEADSET_STATE_DISCONNECTED
bluetoothd[5406]: AVCTP: connected to 00:15:A0:0F:76:CF
bluetoothd[5406]: Can't open input device: No such file or directory (2)
bluetoothd[5406]: AVRCP: failed to init uinput for 00:15:A0:0F:76:CF
bluetoothd[5406]: AVCTP Connected


Regards,
Claudio.

[-- Attachment #2: 0001-Fix-segmentation-fault-when-headset-disconnects-duri.patch --]
[-- Type: application/octet-stream, Size: 936 bytes --]

From 96f640ed18dbf34f0aa739d8fb08c529edfb74ec Mon Sep 17 00:00:00 2001
From: Claudio Takahasi <claudio.takahasi@openbossa.org>
Date: Wed, 10 Feb 2010 12:29:16 -0200
Subject: [PATCH 1/1] Fix segmentation fault when headset disconnects during authorization

Headset authorization callback is not being removed when the headset
disconnects during authorization. Cancel authorization function of
audio devices doesn't iterate the callbacks list properly.
---
 audio/device.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/audio/device.c b/audio/device.c
index b8ea927..76aaddd 100644
--- a/audio/device.c
+++ b/audio/device.c
@@ -781,7 +781,7 @@ int audio_device_cancel_authorization(struct audio_device *dev,
 	GSList *l, *next;
 
 	for (l = priv->auths; l != NULL; l = next) {
-		struct service_auth *auth = priv->auths->data;
+		struct service_auth *auth = l->data;
 
 		next = g_slist_next(l);
 
-- 
1.6.6.1

Re: [PATCH] Fix segmentation fault when headset disconnects during authorization

[Luiz Augusto von Dentz]

Hi,

On Thu, Feb 11, 2010 at 1:10 AM, Claudio Takahasi
<claudio.takahasi@openbossa.org> wrote:
> Hi guys,
>
> This patch fix a segmentation fault when the headset disconnected
> during authorization, see gdb backtrace:
> http://pastebin.com/m1529c2dc
>
> Can someone fix avctp now? For this case, answering "yes" in agent
> avctp connection will be left open:
>
> bluetoothd[5406]: Headset disconnected during authorization
> bluetoothd[5406]: State changed
> /org/bluez/5406/hci0/dev_00_15_A0_0F_76_CF: HEADSET_STATE_CONNECTING
> -> HEADSET_STATE_DISCONNECTED
> bluetoothd[5406]: AVCTP: connected to 00:15:A0:0F:76:CF
> bluetoothd[5406]: Can't open input device: No such file or directory (2)
> bluetoothd[5406]: AVRCP: failed to init uinput for 00:15:A0:0F:76:CF
> bluetoothd[5406]: AVCTP Connected

I thought this was already upstream, well anyway about the AVCTP I
just noticed that we are not dropping it the if uinput failed to load,
I guess we should don't we? Also the AVCTP should be queue in the list
of pending authorizations and then group with AVDTP authorization (if
exists) since both are very common to happen in sequence.

Regards,



-- 
Luiz Augusto von Dentz
Computer Engineer

Re: [PATCH] Fix segmentation fault when headset disconnects during authorization

[Johan Hedberg]

Hi Claudio,

On Wed, Feb 10, 2010, Claudio Takahasi wrote:
> This patch fix a segmentation fault when the headset disconnected
> during authorization, see gdb backtrace:
> http://pastebin.com/m1529c2dc

Thanks. Strange that we didn't notice this earlier. It's been pushed
upstream now though.

> Can someone fix avctp now? For this case, answering "yes" in agent
> avctp connection will be left open:
> 
> bluetoothd[5406]: Headset disconnected during authorization
> bluetoothd[5406]: State changed
> /org/bluez/5406/hci0/dev_00_15_A0_0F_76_CF: HEADSET_STATE_CONNECTING
> -> HEADSET_STATE_DISCONNECTED
> bluetoothd[5406]: AVCTP: connected to 00:15:A0:0F:76:CF
> bluetoothd[5406]: Can't open input device: No such file or directory (2)
> bluetoothd[5406]: AVRCP: failed to init uinput for 00:15:A0:0F:76:CF
> bluetoothd[5406]: AVCTP Connected

I'll be offline for the next 5 days so someone else will need to look at
this one.

Johan