remote: free io area after we set the new area

First set the new area, then destroy the old one. Otherwise the
data thread might still be using the old area and crash.

2 files changed, 21 insertions, 19 deletions

diff --git a/pipewire-jack/src/pipewire-jack.c b/pipewire-jack/src/pipewire-jack.c
index c7688a4a..0c92edcf 100644
--- a/pipewire-jack/src/pipewire-jack.c
+++ b/pipewire-jack/src/pipewire-jack.c
@@ -1287,26 +1287,24 @@ static int client_node_set_io(void *object,
 			uint32_t size)
 {
 	struct client *c = (struct client *) object;
-        struct pw_memmap *mm;
-        void *ptr;
+	struct pw_memmap *old, *mm;
+	void *ptr;
 	uint32_t tag[5] = { c->node_id, id, };
 
-	if ((mm = pw_mempool_find_tag(c->pool, tag, sizeof(tag))) != NULL)
-		pw_memmap_free(mm);
+	old = pw_mempool_find_tag(c->pool, tag, sizeof(tag));
 
-        if (mem_id == SPA_ID_INVALID) {
+	if (mem_id == SPA_ID_INVALID) {
 		mm = ptr = NULL;
 		size = 0;
-        }
-        else {
+	} else {
 		mm = pw_mempool_map_id(c->pool, mem_id,
 				PW_MEMMAP_FLAG_READWRITE, offset, size, tag);
-                if (mm == NULL) {
+		if (mm == NULL) {
                         pw_log_warn(NAME" %p: can't map memory id %u", c, mem_id);
 			return -errno;
-                }
+		}
 		ptr = mm->ptr;
-        }
+	}
 	pw_log_debug(NAME" %p: set io %s %p", c,
 			spa_debug_type_find_name(spa_type_io, id), ptr);
 
@@ -1323,6 +1321,8 @@ static int client_node_set_io(void *object,
 	default:
 		break;
 	}
+	if (old != NULL)
+		pw_memmap_free(old);
 
 	return 0;
 }
diff --git a/src/modules/module-client-node/remote-node.c b/src/modules/module-client-node/remote-node.c
index 3bc4fb67..f07e1130 100644
--- a/src/modules/module-client-node/remote-node.c
+++ b/src/modules/module-client-node/remote-node.c
@@ -418,18 +418,17 @@ client_node_set_io(void *object,
 {
 	struct pw_proxy *proxy = object;
 	struct node_data *data = proxy->user_data;
-	struct pw_memmap *mm;
+	struct pw_memmap *old, *mm;
 	void *ptr;
 	uint32_t tag[5] = { data->remote_id, id, };
+	int res;
 
-	if ((mm = pw_mempool_find_tag(data->pool, tag, sizeof(tag))) != NULL)
-		pw_memmap_free(mm);
+	old = pw_mempool_find_tag(data->pool, tag, sizeof(tag));
 
 	if (memid == SPA_ID_INVALID) {
 		mm = ptr = NULL;
 		size = 0;
-	}
-	else {
+	} else {
 		mm = pw_mempool_map_id(data->pool, memid,
 				PW_MEMMAP_FLAG_READWRITE, offset, size, tag);
 		if (mm == NULL) {
@@ -442,7 +441,12 @@ client_node_set_io(void *object,
 	pw_log_debug("node %p: set io %s %p", proxy,
 			spa_debug_type_find_name(spa_type_io, id), ptr);
 
-	return spa_node_set_io(data->node->node, id, ptr, size);
+	res =  spa_node_set_io(data->node->node, id, ptr, size);
+
+	if (old != NULL)
+		pw_memmap_free(old);
+
+	return res;
 }
 
 static int client_node_event(void *object, const struct spa_event *event)
@@ -840,8 +844,7 @@ client_node_set_activation(void *object,
 	if (memid == SPA_ID_INVALID) {
 		mm = ptr = NULL;
 		size = 0;
-	}
-	else {
+	} else {
 		mm = pw_mempool_map_id(data->pool, memid,
 				PW_MEMMAP_FLAG_READWRITE, offset, size, NULL);
 		if (mm == NULL) {
@@ -852,7 +855,6 @@ client_node_set_activation(void *object,
 	}
 	pw_log_debug("node %p: set activation %d %p %u %u", node, node_id, ptr, offset, size);
 
-
 	if (ptr) {
 		link = calloc(1, sizeof(struct link));
 		if (link == NULL) {