audio/avctp: Match opcode when parsing responses

The transaction may not be unique given the fact that notifications can
take all the outstanding transaction which may cause transactions to be
reused as explained in the errata:

https://www.bluetooth.org/errata/errata_view.cfm?errata_id=3812

diff --git a/profiles/audio/avctp.c b/profiles/audio/avctp.c
index 2a43d32..0807be1 100644 (file)
--- a/profiles/audio/avctp.c
+++ b/profiles/audio/avctp.c
@@ -808,6 +808,10 @@ static void control_response(struct avctp_channel *control,
        GSList *l;
 
        if (p && p->transaction == avctp->transaction) {
+               req = p->data;
+               if (req->op != avc->opcode)
+                       goto done;
+
                control->processed = g_slist_prepend(control->processed, p);
 
                if (p->timeout > 0) {
@@ -822,6 +826,7 @@ static void control_response(struct avctp_channel *control,
                                                                control);
        }
 
+done:
        for (l = control->processed; l; l = l->next) {
                p = l->data;
                req = p->data;
@@ -829,6 +834,9 @@ static void control_response(struct avctp_channel *control,
                if (p->transaction != avctp->transaction)
                        continue;
 
+               if (req->op != avc->opcode)
+                       continue;
+
                if (req->func && req->func(control->session, avc->code,
                                        avc->subunit_type, p->transaction,
                                        operands, operand_count,