Commit: 165e57e744e6bc3d879f4b9870f58284b6d38cf6
Parent: 280c9523a490e8ed6d609b8b0d8bfde51013e48b
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Committer: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2025-07-29 19:07:45
Tree: cc3754a2207d453e2618254b9892d1fdaf16cdfe

bap: Fix crash when Broadcast endpoint exit The following crash can be observed when a Broadcast endpoint exit when a bap_setup exists: Invalid read of size 8 at 0x4075B30: set_configuration_ready (bap.c:1120) by 0x40766C3: setup_ready (bap.c:748) by 0x407809C: setup_free (bap.c:998) by 0x4078301: bap_state_bcast_src (bap.c:3012) by 0x41319DF: bap_bcast_set_state (bap.c:2392) by 0x412CFFC: stream_set_state (bap.c:1537) by 0x4131AA3: bap_bcast_set_state (bap.c:2404) by 0x412CFFC: stream_set_state (bap.c:1537) by 0x412D0E6: bap_bcast_release (bap.c:2543) by 0x41314EF: bt_bap_stream_release (bap.c:6518) by 0x4131607: remove_lpac_streams (bap.c:4348) by 0x4108444: queue_foreach (queue.c:207) Address 0x56f7758 is 8 bytes inside a block of size 16 free'd at 0x4B85E43: free (vg_replace_malloc.c:989) by 0x407472D: setup_config (bap.c:1778) by 0x407A869: set_configuration (bap.c:1175) by 0x4102A8F: process_message (object.c:293)

Diffstat

M profiles/audio/bap.c | 4 ++++

1 files changed, 4 insertions(+), 0 deletions(-)

View Full Diff | Patch