Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69fbad85 authored by Łukasz Rymanowski's avatar Łukasz Rymanowski
Browse files

leaudio: Fix crash when data path is removed while ACL is disconnected 

Fixes race condition.

Bug: 253034131
Test: atest BluetoothInstrumentationTests
Test: manual - initiate disconnection of one earbud
Tag: #feature
Change-Id: I49709207790104ffa03e419205e7bda9c7802241
parent 18038abf

system/bta/le_audio/client.cc

+17 −0
Original line number Diff line number Diff line
@@ -3692,6 +3692,12 @@ class LeAudioClientImpl : public LeAudioClient { 
                             uint8_t cig_id) {

    LeAudioDevice* leAudioDevice =

        leAudioDevices_.FindByCisConnHdl(cig_id, conn_handle);

    /* In case device has been disconnected before data path was setup */

    if (!leAudioDevice) {

      LOG_WARN("Device for CIG %d and using cis_handle 0x%04x is disconnected.",

               cig_id, conn_handle);

      return;

    }

    LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);



    instance->groupStateMachine_->ProcessHciNotifSetupIsoDataPath(
@@ -3702,6 +3708,17 @@ class LeAudioClientImpl : public LeAudioClient { 
                              uint8_t cig_id) {

    LeAudioDevice* leAudioDevice =

        leAudioDevices_.FindByCisConnHdl(cig_id, conn_handle);



    /* If CIS has been disconnected just before ACL being disconnected by the

     * remote device, leAudioDevice might be already cleared i.e. has no

     * information about conn_handle, when the data path remove compete arrives.

     */

    if (!leAudioDevice) {

      LOG_WARN("Device for CIG %d and using cis_handle 0x%04x is disconnected.",

               cig_id, conn_handle);

      return;

    }



    LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);



    instance->groupStateMachine_->ProcessHciNotifRemoveIsoDataPath(