Attachment 114666 Details for Bug 89672 – PATCH v1: Prevent calling pa_rtpoll_free() for a NULL rtpoll

[patch] PATCH v1: Prevent calling pa_rtpoll_free() for a NULL rtpoll

0001-Fix-Prevent-calling-pa_rtpoll_free-for-a-NULL-rtpoll.patch (text/plain), 5.31 KB, created by Sagar Nm on 2015-03-27 10:35:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sagar Nm

Created: 2015-03-27 10:35:34 UTC

Size: 5.31 KB

patch

obsolete

>From 77ba6b19854ba8730c795057b3647c9c35074cec Mon Sep 17 00:00:00 2001
>From: Sagar Nageshmurthy <s.nageshmurt@samsung.com>
>Date: Tue, 24 Mar 2015 17:17:03 +0530
>Subject: [PATCH v1 1/1] Fix: Prevent calling pa_rtpoll_free() for a NULL
> rtpoll
>
>Flushing the asyncmsgq can cause arbitrarily callbacks to run, potentially
>causing recursion into pa_thread_mq_done again. Because of this; rtpoll which
>is cleared in the second iteration is tried to free once again by the first
>iteration leading to PA crash.
>
>I/PULSEAUDIO(  365): [pulseaudio] bluez5-util.c: dbus: path=/MediaEndpoint/A2DPSource_aptx, interface=org.bluez.MediaEndpoint1, member=ClearConfiguration
>I/PULSEAUDIO(  365): [pulseaudio] bluez5-util.c: Clearing transport /org/bluez/hci0/dev_BC_47_60_F5_88_89/fd1 profile a2dp_sink
>I/PULSEAUDIO(  365): [pulseaudio] bluez5-util.c: Transport /org/bluez/hci0/dev_BC_47_60_F5_88_89/fd1 state changed from playing to disconnected
>D/PULSEAUDIO(  365): [pulseaudio] module-policy.c: ========= sink [bluez_sink.BC_47_60_F5_88_89][3], bt_off_idx was [-1], now set to [3]
>I/PULSEAUDIO(  365): [pulseaudio] module-policy.c: stream[1], policy[(null)]. stream move sink[bluez_sink.BC_47_60_F5_88_89] =====> sink[null]
>D/PULSEAUDIO(  365): [pulseaudio] module-policy.c: ------- sink-input [1] was sink [bluez_sink.BC_47_60_F5_88_89][3] : Trying to mute!!!
>I/PULSEAUDIO(  365): [pulseaudio] module-policy.c: set_mute stream_idx:1 type:-1 direction:2 mute:1
>E/PULSEAUDIO(  365): [bluetooth] module-bluez5-device.c: Failed to write data to socket: Transport endpoint is not connected
>I/PULSEAUDIO(  365): [bluetooth] module-bluez5-device.c: IO thread failed
>D/PULSEAUDIO(  365): [bluetooth] sink.c: Requesting rewind due to started move
>I/PULSEAUDIO(  365): [pulseaudio] sink.c: SINK[bluez_sink.BC_47_60_F5_88_89] state changed (PA_SINK_RUNNING) => (PA_SINK_IDLE)
>D/PULSEAUDIO(  365): [null-sink] sink.c: Requesting rewind due to finished move
>D/PULSEAUDIO(  365): [pulseaudio] sink-input.c: Successfully moved sink input 1 to null.
>I/PULSEAUDIO(  365): [pulseaudio] sink.c: SINK[null] state changed (PA_SINK_SUSPENDED) => (PA_SINK_RUNNING)
>D/PULSEAUDIO(  365): [pulseaudio] module-policy.c: ------- sink-input [1], sink [null][1], bt_off_idx [3] : skip un-mute...
>D/PULSEAUDIO(  365): [pulseaudio] module-policy.c: unload sink in dependencies
>D/PULSEAUDIO(  365): [pulseaudio] module-rescue-streams.c: No sink inputs to move away.
>I/PULSEAUDIO(  365): [pulseaudio] sink.c: SINK[bluez_sink.BC_47_60_F5_88_89] state changed (PA_SINK_IDLE) => (PA_SINK_UNLINKED)
>D/PULSEAUDIO(  365): [pulseaudio] module-rescue-streams.c: No source outputs to move away.
>I/PULSEAUDIO(  365): [pulseaudio] module-suspend-on-idle.c: source [0x408e3d08][3] is unlinked, now update pm
>I/PULSEAUDIO(  365): [pulseaudio] module-suspend-on-idle.c: [PM] suspend [source:3] ret[-1] list[0x408de028] before:[sink:1][sink:3] after:[sink:1][sink:3]
>D/PULSEAUDIO(  365): [pulseaudio] module-policy.c: ========= sink [bluez_sink.BC_47_60_F5_88_89][3]
>D/PULSEAUDIO(  365): [pulseaudio] module-policy.c: bt_off_idx is cleared to [-1]
>I/PULSEAUDIO(  365): [pulseaudio] module-suspend-on-idle.c: sink [0x408e4680][3] is unlinked, now update pm
>I/PULSEAUDIO(  365): [pulseaudio] module-suspend-on-idle.c: [PM] suspend [sink:3] ret[-1] list[0x408de028] before:[sink:1][sink:3] after:[sink:1]
>I/PULSEAUDIO(  365): [bluetooth] module-bluez5-device.c: IO thread shutting down
>I/PULSEAUDIO(  365): [pulseaudio] module-bluez5-device.c: Switching the profile to off due to IO thread failure.
>I/PULSEAUDIO(  365): [pulseaudio] module-bluez5-device.c: Releasing transport /org/bluez/hci0/dev_BC_47_60_F5_88_89/fd1
>I/PULSEAUDIO(  365): [pulseaudio] bluez5-util.c: Transport /org/bluez/hci0/dev_BC_47_60_F5_88_89/fd1 auto-released by BlueZ or already released
>I/PULSEAUDIO(  365): [pulseaudio] bluez5-util.c: Allow Release!
>E/PULSEAUDIO(  365): [pulseaudio] bluez5-util.c: Failed to release transport /org/bluez/hci0/dev_BC_47_60_F5_88_89/fd1: Method "Release" with signature "" on interface "org.bluez.MediaTransport1" doesn't exist
>I/PULSEAUDIO(  365): [pulseaudio] module-bluez5-device.c: Wait for sync with bluez's dbus signal
>I/PULSEAUDIO(  365): [pulseaudio] module-bluez5-device.c: Audio stream torn down
>I/PULSEAUDIO(  365): [pulseaudio] sink.c: Freeing sink 3 "bluez_sink.BC_47_60_F5_88_89"
>I/PULSEAUDIO(  365): [pulseaudio] source.c: Freeing source 3 "bluez_sink.BC_47_60_F5_88_89.monitor"
>I/PULSEAUDIO(  365): [pulseaudio] card.c: Changed profile of card 1 "bluez_card.BC_47_60_F5_88_89" to off
>E/PULSEAUDIO(  365): [pulseaudio] rtpoll.c: Assertion 'p' failed at pulsecore/rtpoll.c:168, function pa_rtpoll_free(). Aborting.
>---
> src/modules/bluetooth/module-bluez5-device.c |    6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
>diff --git a/src/modules/bluetooth/module-bluez5-device.c b/src/modules/bluetooth/module-bluez5-device.c
>index 7238e6f..3426e1a 100644
>--- a/src/modules/bluetooth/module-bluez5-device.c
>+++ b/src/modules/bluetooth/module-bluez5-device.c
>@@ -1574,8 +1574,12 @@ static void stop_thread(struct userdata *u) {
>         u->rtpoll_item = NULL;
>     }
> 
>-    if (u->rtpoll) {
>+    if (u->rtpoll)
>         pa_thread_mq_done(&u->thread_mq);
>+
>+    /* pa_thread_mq_done might recurse into stop_thread again, hence this
>+       extra "if (u->rtpoll)" check */
>+    if (u->rtpoll) {
>         pa_rtpoll_free(u->rtpoll);
>         u->rtpoll = NULL;
>     }
>-- 
>1.7.9.5
>

Actions: View | Splinter Review

Attachments on bug 89672: 114464 | 114468 | 114469 | 114486 | 114580 | 114666

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.