[PATCH BlueZ] transport: Fix use-after-free when replacing a linked transport's owner

[PATCH BlueZ] transport: Fix use-after-free when replacing a linked transport's owner

[Frédéric Danis]

linked_transport_set_owner() unconditionally overwrote a linked
transport's owner pointer. If that transport already had a different
owner assigned (e.g. its own Acquire request was still pending when the
paired transport's owner was set), the previous media_owner was
orphaned: its D-Bus disconnect watch stayed registered and its
->transport back-pointer kept pointing at the transport. Once the
transport was later destroyed, the still-registered watch would
eventually fire media_owner_exit() and dereference the freed transport.

Tear down any pre-existing, different owner via
media_transport_remove_owner() before assigning the new one, so its
pending request is replied to, its watch is removed and the owner is
freed instead of leaked. Since media_transport_remove_owner() itself
recurses into linked_transport_remove_owner() for linked streams, also
guard linked_transport_remove_owner() so it only clears a transport's
owner when it still matches the owner being removed, preventing it
from clobbering an owner that was already reassigned during that
recursion.

Assisted-by: Claude:claude-sonnet-5
---
 profiles/audio/transport.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/profiles/audio/transport.c b/profiles/audio/transport.c
index 22a755064..e3f3df50e 100644
--- a/profiles/audio/transport.c
+++ b/profiles/audio/transport.c
@@ -336,6 +336,13 @@ static void linked_transport_remove_owner(void *data, void *user_data)
 		return;
 	}
 
+	/* Owner may have already been replaced (e.g. by a subsequent
+	 * linked_transport_set_owner), in which case it is not this
+	 * function's place to clear it.
+	 */
+	if (transport->owner != owner)
+		return;
+
 	DBG("Transport %s Owner %s", transport->path, owner->name);
 	transport->owner = NULL;
 }
@@ -728,6 +735,16 @@ static void linked_transport_set_owner(void *data, void *user_data)
 		return;
 	}
 
+	/* If the linked transport already has a different owner (e.g. it
+	 * was Acquired separately), tear it down properly instead of
+	 * silently overwriting it. Otherwise the previous owner is
+	 * orphaned: its D-Bus disconnect watch stays registered and its
+	 * ->transport back-pointer becomes dangling once this transport is
+	 * later destroyed, causing a use-after-free when the watch fires.
+	 */
+	if (transport->owner && transport->owner != owner)
+		media_transport_remove_owner(transport);
+
 	DBG("Transport %s Owner %s", transport->path, owner->name);
 	transport->owner = owner;
 }
-- 
2.43.0

RE: [BlueZ] transport: Fix use-after-free when replacing a linked transport's owner

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1994 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1154589

---Test result---

Test Summary:
CheckPatch                    FAIL      0.49 seconds
GitLint                       PASS      0.33 seconds
BuildEll                      PASS      20.25 seconds
BluezMake                     PASS      543.86 seconds
MakeCheck                     PASS      3.71 seconds
MakeDistcheck                 PASS      157.00 seconds
CheckValgrind                 PASS      153.91 seconds
CheckSmatch                   PASS      300.67 seconds
bluezmakeextell               PASS      97.70 seconds
IncrementalBuild              PASS      581.65 seconds
ScanBuild                     PASS      917.67 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] transport: Fix use-after-free when replacing a linked transport's owner
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#87: 
Assisted-by: Claude:claude-sonnet-5

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-sonnet-5'
#87: 
Assisted-by: Claude:claude-sonnet-5

/github/workspace/src/patch/14778073.patch total: 1 errors, 1 warnings, 29 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14778073.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




https://github.com/bluez/bluez/pull/2463

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] transport: Fix use-after-free when replacing a linked transport's owner

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 31 Aug 2026 16:45:56 +0200 you wrote:
> linked_transport_set_owner() unconditionally overwrote a linked
> transport's owner pointer. If that transport already had a different
> owner assigned (e.g. its own Acquire request was still pending when the
> paired transport's owner was set), the previous media_owner was
> orphaned: its D-Bus disconnect watch stayed registered and its
> ->transport back-pointer kept pointing at the transport. Once the
> transport was later destroyed, the still-registered watch would
> eventually fire media_owner_exit() and dereference the freed transport.
> 
> [...]

Here is the summary with links:
  - [BlueZ] transport: Fix use-after-free when replacing a linked transport's owner
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=a03665b6dd20

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html