Skip to content

bluetooth: Fix crash in setup_stream()

setup_stream() crashes when calling set_nonblock() with an invalid stream_fd.

On a new call, the ofono backend gets notified of a new connection. The ofono backend sets the transport state to playing, and that triggers a profile change, which sets up the stream for the first time. Then module-bluetooth-policy sets up the loopbacks. The loopbacks get fully initialized before the crash.

After module-bluetooth-policy has done its things, the execution continues in the transport state change hook. The next hook user is module-bluez5-device, whose handle_transport_state_change() function gets called. It will then set up the stream again even though it's already set up. I'm not sure if that's a some kind of a bug. setup_stream() can handle the case where it's unnecessarily called, though, so this second setup is not a big problem.

The crash happens, because the connection died due to POLLHUP in the IO thread before the second setup_stream() call.

Merge request reports