[PATCH v2] avdtp: Fix use-after-free in connection_lost

[PATCH v2] avdtp: Fix use-after-free in connection_lost

[Jinwang Li]

release_stream() may free the session's a2dp_setup through
abort_cfm(). Subsequently, finalize_discovery() passes the same
freed a2dp_setup to discover_cb(), resulting in a use-after-free.

Call finalize_discovery() before release_stream() instead.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
---
Changes for V2
 - Rebased the patch.
 - V1 link
   https://lore.kernel.org/all/20260807095809.2584501-1-jinwang.li@oss.qualcomm.com/
---
 profiles/audio/avdtp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
index 56d27b973..b8d9b8e94 100644
--- a/profiles/audio/avdtp.c
+++ b/profiles/audio/avdtp.c
@@ -1158,11 +1158,11 @@ static void connection_lost(struct avdtp *session, int err)
 	ba2str(device_get_address(session->device), address);
 	DBG("Disconnected from %s", address);
 
+	finalize_discovery(session, err);
+
 	g_slist_foreach(session->streams, (GFunc) release_stream, session);
 	session->streams = NULL;
 
-	finalize_discovery(session, err);
-
 	avdtp_set_state(session, AVDTP_SESSION_STATE_DISCONNECTED);
 
 	avdtp_unref(session);
-- 
2.34.1

RE: [v2] avdtp: Fix use-after-free in connection_lost

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1021 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1187029/

---Test result---

Test Summary:
CheckPatch                    PASS      0.39 seconds
GitLint                       PASS      0.28 seconds
BuildEll                      PASS      20.00 seconds
BluezMake                     PASS      297.54 seconds
MakeCheck                     PASS      3.51 seconds
MakeDistcheck                 PASS      149.89 seconds
CheckValgrind                 PASS      154.87 seconds
CheckSmatch                   PASS      299.49 seconds
bluezmakeextell               PASS      96.41 seconds
TestFunctional                PASS      1125.89 seconds
IncrementalBuild              PASS      303.29 seconds
ScanBuild                     PASS      1186.10 seconds



https://github.com/bluez/bluez/pull/2685

---
Regards,
Linux Bluetooth

RE: [v2] avdtp: Fix use-after-free in connection_lost

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 689 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

This series was picked up by the CI more than 2 weeks ago and the pull
request created for it is still open, which means the series was never
applied to the tree.

   Series:       [v2] avdtp: Fix use-after-free in connection_lost
   Pull Request: https://github.com/bluez/bluez/pull/2685
   Created:      2026-10-16 10:33:05+00:00

The pull request has been closed and no further action is taken on this
series.

If the change should still be considered, it must be resent to the Linux
Bluetooth mailing list (linux-bluetooth@vger.kernel.org) so that it is
picked up again.

---
Regards,
Linux Bluetooth