[PATCH BlueZ] shared/bap: Fix use-after-free in bt_bap_detach

[PATCH BlueZ] shared/bap: Fix use-after-free in bt_bap_detach

[Frédéric Danis]

bt_bap_detach() invoked the pending request's completion callback via
bap_req_detach(bap->req) before clearing bap->req. Since the completion
callback (req->func) can trigger synchronous cleanup that re-enters
bt_bap_stream_cancel() for the same stream, and bt_bap_stream_cancel()
frees bap->req whenever it still matches the request being canceled,
the request could be freed while bap_req_complete() was still executing
on it, causing bap_req_complete() to dereference the now-freed request
once the callback returned.

Clear bap->req before invoking the completion callback, matching the
pattern already used by bap_abort_stream_req(), the ASE IDLE state
handler and bap_cp_notify(), so a reentrant cancel no longer finds a
stale bap->req to free.

Assisted-by: Claude:claude-sonnet-5
---
 src/shared/bap.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/shared/bap.c b/src/shared/bap.c
index da3e265e2..891a2f4fd 100644
--- a/src/shared/bap.c
+++ b/src/shared/bap.c
@@ -5958,8 +5958,10 @@ void bt_bap_detach(struct bt_bap *bap)
 
 	/* Cancel ongoing request */
 	if (bap->req) {
-		bap_req_detach(bap->req);
+		struct bt_bap_req *req = bap->req;
+
 		bap->req = NULL;
+		bap_req_detach(req);
 	}
 
 	bt_gatt_client_idle_unregister(bap->client, bap->idle_id);
-- 
2.43.0

RE: [BlueZ] shared/bap: Fix use-after-free in bt_bap_detach

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2576 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1154582

---Test result---

Test Summary:
CheckPatch                    FAIL      0.49 seconds
GitLint                       PASS      0.37 seconds
BuildEll                      PASS      22.35 seconds
BluezMake                     PASS      630.19 seconds
MakeCheck                     PASS      12.77 seconds
MakeDistcheck                 PASS      163.29 seconds
CheckValgrind                 PASS      214.31 seconds
CheckSmatch                   WARNING   318.66 seconds
bluezmakeextell               PASS      105.24 seconds
IncrementalBuild              PASS      626.74 seconds
ScanBuild                     PASS      1029.37 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] shared/bap: Fix use-after-free in bt_bap_detach
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#81: 
Assisted-by: Claude:claude-sonnet-5

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-sonnet-5'
#81: 
Assisted-by: Claude:claude-sonnet-5

/github/workspace/src/patch/14778040.patch total: 1 errors, 1 warnings, 11 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14778040.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structuressrc/shared/bap.c:318:25: warning: array of flexible structuressrc/shared/bap.c: note: in included file:./src/shared/ascs.h:88:25: warning: array of flexible structures


https://github.com/bluez/bluez/pull/2462

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] shared/bap: Fix use-after-free in bt_bap_detach

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 31 Aug 2026 16:44:37 +0200 you wrote:
> bt_bap_detach() invoked the pending request's completion callback via
> bap_req_detach(bap->req) before clearing bap->req. Since the completion
> callback (req->func) can trigger synchronous cleanup that re-enters
> bt_bap_stream_cancel() for the same stream, and bt_bap_stream_cancel()
> frees bap->req whenever it still matches the request being canceled,
> the request could be freed while bap_req_complete() was still executing
> on it, causing bap_req_complete() to dereference the now-freed request
> once the callback returned.
> 
> [...]

Here is the summary with links:
  - [BlueZ] shared/bap: Fix use-after-free in bt_bap_detach
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=a909d5d303cb

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html