From 0fd46d057ea901918e846105571c210a9025ba52 Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Thu, 30 Apr 2020 16:13:50 +0200
Subject: [PATCH] remote: free io area after we set the new area

First set the new area, then destroy the old one. Otherwise the
data thread might still be using the old area and crash.
---
 pipewire-jack/src/pipewire-jack.c            | 20 ++++++++++----------
 src/modules/module-client-node/remote-node.c | 20 +++++++++++---------
 2 files changed, 21 insertions(+), 19 deletions(-)

diff --git a/pipewire-jack/src/pipewire-jack.c b/pipewire-jack/src/pipewire-jack.c
index c7688a4ad..0c92edcfd 100644
--- a/pipewire-jack/src/pipewire-jack.c
+++ b/pipewire-jack/src/pipewire-jack.c
@@ -1287,26 +1287,24 @@ static int client_node_set_io(void *object,
 			uint32_t size)
 {
 	struct client *c = (struct client *) object;
-        struct pw_memmap *mm;
-        void *ptr;
+	struct pw_memmap *old, *mm;
+	void *ptr;
 	uint32_t tag[5] = { c->node_id, id, };
 
-	if ((mm = pw_mempool_find_tag(c->pool, tag, sizeof(tag))) != NULL)
-		pw_memmap_free(mm);
+	old = pw_mempool_find_tag(c->pool, tag, sizeof(tag));
 
-        if (mem_id == SPA_ID_INVALID) {
+	if (mem_id == SPA_ID_INVALID) {
 		mm = ptr = NULL;
 		size = 0;
-        }
-        else {
+	} else {
 		mm = pw_mempool_map_id(c->pool, mem_id,
 				PW_MEMMAP_FLAG_READWRITE, offset, size, tag);
-                if (mm == NULL) {
+		if (mm == NULL) {
                         pw_log_warn(NAME" %p: can't map memory id %u", c, mem_id);
 			return -errno;
-                }
+		}
 		ptr = mm->ptr;
-        }
+	}
 	pw_log_debug(NAME" %p: set io %s %p", c,
 			spa_debug_type_find_name(spa_type_io, id), ptr);
 
@@ -1323,6 +1321,8 @@ static int client_node_set_io(void *object,
 	default:
 		break;
 	}
+	if (old != NULL)
+		pw_memmap_free(old);
 
 	return 0;
 }
diff --git a/src/modules/module-client-node/remote-node.c b/src/modules/module-client-node/remote-node.c
index 3bc4fb67f..f07e11301 100644
--- a/src/modules/module-client-node/remote-node.c
+++ b/src/modules/module-client-node/remote-node.c
@@ -418,18 +418,17 @@ client_node_set_io(void *object,
 {
 	struct pw_proxy *proxy = object;
 	struct node_data *data = proxy->user_data;
-	struct pw_memmap *mm;
+	struct pw_memmap *old, *mm;
 	void *ptr;
 	uint32_t tag[5] = { data->remote_id, id, };
+	int res;
 
-	if ((mm = pw_mempool_find_tag(data->pool, tag, sizeof(tag))) != NULL)
-		pw_memmap_free(mm);
+	old = pw_mempool_find_tag(data->pool, tag, sizeof(tag));
 
 	if (memid == SPA_ID_INVALID) {
 		mm = ptr = NULL;
 		size = 0;
-	}
-	else {
+	} else {
 		mm = pw_mempool_map_id(data->pool, memid,
 				PW_MEMMAP_FLAG_READWRITE, offset, size, tag);
 		if (mm == NULL) {
@@ -442,7 +441,12 @@ client_node_set_io(void *object,
 	pw_log_debug("node %p: set io %s %p", proxy,
 			spa_debug_type_find_name(spa_type_io, id), ptr);
 
-	return spa_node_set_io(data->node->node, id, ptr, size);
+	res =  spa_node_set_io(data->node->node, id, ptr, size);
+
+	if (old != NULL)
+		pw_memmap_free(old);
+
+	return res;
 }
 
 static int client_node_event(void *object, const struct spa_event *event)
@@ -840,8 +844,7 @@ client_node_set_activation(void *object,
 	if (memid == SPA_ID_INVALID) {
 		mm = ptr = NULL;
 		size = 0;
-	}
-	else {
+	} else {
 		mm = pw_mempool_map_id(data->pool, memid,
 				PW_MEMMAP_FLAG_READWRITE, offset, size, NULL);
 		if (mm == NULL) {
@@ -852,7 +855,6 @@ client_node_set_activation(void *object,
 	}
 	pw_log_debug("node %p: set activation %d %p %u %u", node, node_id, ptr, offset, size);
 
-
 	if (ptr) {
 		link = calloc(1, sizeof(struct link));
 		if (link == NULL) {