-
Notifications
You must be signed in to change notification settings - Fork 8.7k
Open
Open
Copy link
Labels
area: Bluetootharea: Bluetooth AudiobugThe issue is a bug, or the PR is fixing a bugThe issue is a bug, or the PR is fixing a bugpriority: lowLow impact/importance bugLow impact/importance bug
Description
Describe the bug
write_call_cp looks up the appropriate TBS instance when operations are done on GTBS. In those cases, we correctly take the mutex of GTBS, but we never take the mutex of the TBS being looked up, e.g.
call_index = ccp->accept.call_index;
if (is_gtbs) {
tbs = lookup_inst_by_call_index(call_index);
if (tbs == NULL) {
status = BT_TBS_RESULT_CODE_INVALID_CALL_INDEX;
break;
}
} else {
tbs = inst;
}
status = accept_call(tbs, &ccp->accept);
break;This means that the call may be changed by a different thread while we are handling it here.
Regression
- This is a regression.
Steps to reproduce
N/A
Relevant log output
N/AImpact
Functional Limitation – Some features not working as expected, but system usable.
Environment
Additional Context
Relates to #104655
Reactions are currently unavailable
Metadata
Metadata
Labels
area: Bluetootharea: Bluetooth AudiobugThe issue is a bug, or the PR is fixing a bugThe issue is a bug, or the PR is fixing a bugpriority: lowLow impact/importance bugLow impact/importance bug
Type
Projects
Status
To do