[PATCH BlueZ] transport: Fix use-after-free when replacing a linked transport's owner

["Frédéric Danis" <frederic.danis@collabora.com>]

linked_transport_set_owner() unconditionally overwrote a linked
transport's owner pointer. If that transport already had a different
owner assigned (e.g. its own Acquire request was still pending when the
paired transport's owner was set), the previous media_owner was
orphaned: its D-Bus disconnect watch stayed registered and its
->transport back-pointer kept pointing at the transport. Once the
transport was later destroyed, the still-registered watch would
eventually fire media_owner_exit() and dereference the freed transport.

Tear down any pre-existing, different owner via
media_transport_remove_owner() before assigning the new one, so its
pending request is replied to, its watch is removed and the owner is
freed instead of leaked. Since media_transport_remove_owner() itself
recurses into linked_transport_remove_owner() for linked streams, also
guard linked_transport_remove_owner() so it only clears a transport's
owner when it still matches the owner being removed, preventing it
from clobbering an owner that was already reassigned during that
recursion.

Assisted-by: Claude:claude-sonnet-5
---
 profiles/audio/transport.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/profiles/audio/transport.c b/profiles/audio/transport.c
index 22a755064..e3f3df50e 100644
--- a/profiles/audio/transport.c
+++ b/profiles/audio/transport.c
@@ -336,6 +336,13 @@ static void linked_transport_remove_owner(void *data, void *user_data)
 		return;
 	}
 
+	/* Owner may have already been replaced (e.g. by a subsequent
+	 * linked_transport_set_owner), in which case it is not this
+	 * function's place to clear it.
+	 */
+	if (transport->owner != owner)
+		return;
+
 	DBG("Transport %s Owner %s", transport->path, owner->name);
 	transport->owner = NULL;
 }
@@ -728,6 +735,16 @@ static void linked_transport_set_owner(void *data, void *user_data)
 		return;
 	}
 
+	/* If the linked transport already has a different owner (e.g. it
+	 * was Acquired separately), tear it down properly instead of
+	 * silently overwriting it. Otherwise the previous owner is
+	 * orphaned: its D-Bus disconnect watch stays registered and its
+	 * ->transport back-pointer becomes dangling once this transport is
+	 * later destroyed, causing a use-after-free when the watch fires.
+	 */
+	if (transport->owner && transport->owner != owner)
+		media_transport_remove_owner(transport);
+
 	DBG("Transport %s Owner %s", transport->path, owner->name);
 	transport->owner = owner;
 }
-- 
2.43.0