From: Luiz Augusto von Dentz <noreply@github.com>
To: linux-bluetooth@vger.kernel.org
Subject: [bluez/bluez] 4bb428: bass: Fix possible crash on bass_update_bis_sync
Date: Mon, 29 Jun 2026 09:48:57 -0700 [thread overview]
Message-ID: <bluez/bluez/push/refs/heads/1118322/000000-dc5f00@github.com> (raw)
Branch: refs/heads/1118322
Home: https://github.com/bluez/bluez
Commit: 4bb4281e3b7b51c2b322f4ba1882826c139ef52a
https://github.com/bluez/bluez/commit/4bb4281e3b7b51c2b322f4ba1882826c139ef52a
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M profiles/audio/bass.c
Log Message:
-----------
bass: Fix possible crash on bass_update_bis_sync
bass_update_bis_sync does use bass_remove_bis which may end up
removing the current entry causing a crash on entry->next, to avoid
that prefetch the next entry.
Commit: 7a4396677522a537c751327defe8d66ca26ad3cd
https://github.com/bluez/bluez/commit/7a4396677522a537c751327defe8d66ca26ad3cd
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M src/shared/bap.c
Log Message:
-----------
shared/bap: Check if stream is valid before attempting to release
bt_bap_stream_release shall check if the stream is still valid before
attempting to release it just as done with other operations.
Commit: 6214233de73d8e101322487f79bf8a89b8ccdb7a
https://github.com/bluez/bluez/commit/6214233de73d8e101322487f79bf8a89b8ccdb7a
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M src/shared/bap.c
Log Message:
-----------
shared/bap: Don't transition to IDLE inside bap_bcast_set_state
Remove the recursive stream_set_state(IDLE) call from the RELEASING
case in bap_bcast_set_state. This call re-entered bap_bcast_set_state
while the state_cbs queue was still being iterated, causing a
use-after-free if a callback unregistered itself during notification.
Commit: cb4ff884ae40b2bad3ba63191b4f9848c8d892b1
https://github.com/bluez/bluez/commit/cb4ff884ae40b2bad3ba63191b4f9848c8d892b1
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M src/shared/bap.c
Log Message:
-----------
shared/bap: Use queue_foreach to notify state changes
Use queue_foreach to notify state changes since that is considered
safer as it does attempt to detect list modification while traversing
the list.
Commit: dc5f004af4bbc56381a74f2dd11b113608941ded
https://github.com/bluez/bluez/commit/dc5f004af4bbc56381a74f2dd11b113608941ded
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
M src/shared/bap.c
Log Message:
-----------
shared/bap: Protect bap_stream_notify_connecting
bap_stream_notify_connecting may encounter callbacks that remove itself
while traversing the state_cbs, so this attempts to prevent to cause a
crash by prefetching the next entry.
Compare: https://github.com/bluez/bluez/compare/4bb4281e3b7b%5E...dc5f004af4bb
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
reply other threads:[~2026-06-29 16:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bluez/bluez/push/refs/heads/1118322/000000-dc5f00@github.com \
--to=noreply@github.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.