From b8a882a488d8369c0fd3d558e7b9e256ead64efb Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Mon, 14 Oct 2013 15:46:03 +0300 Subject: [PATCH] audio/AVCTP: Fix sending requests with same transaction id If a request is outstanding in the processed list its transaction shall not be reused as it can cause the wrong callback to be called. This can be reproduced in very rare occasions where e.g. a notification using the same transaction of the current request arrives before the response itself. --- profiles/audio/avctp.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/profiles/audio/avctp.c b/profiles/audio/avctp.c index 845027f99..dac7a66c5 100644 --- a/profiles/audio/avctp.c +++ b/profiles/audio/avctp.c @@ -1480,7 +1480,28 @@ static struct avctp_pending_req *pending_create(struct avctp_channel *chan, GDestroyNotify destroy) { struct avctp_pending_req *p; + GSList *l, *tmp; + if (!chan->processed) + goto done; + + tmp = g_slist_copy(chan->processed); + + /* Find first unused transaction id */ + for (l = tmp; l; l = l->next) { + struct avctp_pending_req *req = l->data; + + if (req->transaction == chan->transaction) { + chan->transaction++; + chan->transaction %= 16; + tmp = g_slist_delete_link(tmp, l); + l = tmp; + } + } + + g_slist_free(tmp); + +done: p = g_new0(struct avctp_pending_req, 1); p->chan = chan; p->transaction = chan->transaction; -- 2.47.3