[bluez/bluez] 85f3cd: shared/bap: Fix use-after-free in bt_bap_detach

[bluez/bluez] 85f3cd: shared/bap: Fix use-after-free in bt_bap_detach

[fdanis-oss]

  Branch: refs/heads/1154582
  Home:   https://github.com/bluez/bluez
  Commit: 85f3cda412302a1454580994f5529c0dcb2d5dc5
      https://github.com/bluez/bluez/commit/85f3cda412302a1454580994f5529c0dcb2d5dc5
  Author: Frédéric Danis <frederic.danis@collabora.com>
  Date:   2026-08-31 (Mon, 31 Aug 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Fix use-after-free in bt_bap_detach

bt_bap_detach() invoked the pending request's completion callback via
bap_req_detach(bap->req) before clearing bap->req. Since the completion
callback (req->func) can trigger synchronous cleanup that re-enters
bt_bap_stream_cancel() for the same stream, and bt_bap_stream_cancel()
frees bap->req whenever it still matches the request being canceled,
the request could be freed while bap_req_complete() was still executing
on it, causing bap_req_complete() to dereference the now-freed request
once the callback returned.

Clear bap->req before invoking the completion callback, matching the
pattern already used by bap_abort_stream_req(), the ASE IDLE state
handler and bap_cp_notify(), so a reentrant cancel no longer finds a
stale bap->req to free.

Assisted-by: Claude:claude-sonnet-5



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications