[PATCH v1] avdtp: Fix use-after-free in connection_lost

[PATCH v1] avdtp: Fix use-after-free in connection_lost

[Jinwang Li]

release_stream() may free the session's a2dp_setup through
abort_cfm(). Subsequently, finalize_discovery() passes the same
freed a2dp_setup to discover_cb(), resulting in a use-after-free.

Call finalize_discovery() before release_stream() instead.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
---
 profiles/audio/avdtp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
index 56d27b973..b8d9b8e94 100644
--- a/profiles/audio/avdtp.c
+++ b/profiles/audio/avdtp.c
@@ -1158,11 +1158,11 @@ static void connection_lost(struct avdtp *session, int err)
 	ba2str(device_get_address(session->device), address);
 	DBG("Disconnected from %s", address);
 
+	finalize_discovery(session, err);
+
 	g_slist_foreach(session->streams, (GFunc) release_stream, session);
 	session->streams = NULL;
 
-	finalize_discovery(session, err);
-
 	avdtp_set_state(session, AVDTP_SESSION_STATE_DISCONNECTED);
 
 	avdtp_unref(session);
-- 
2.34.1

RE: [v1] avdtp: Fix use-after-free in connection_lost

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1966 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1142087

---Test result---

Test Summary:
CheckPatch                    FAIL      0.38 seconds
GitLint                       PASS      0.26 seconds
BuildEll                      PASS      16.04 seconds
BluezMake                     PASS      446.70 seconds
MakeCheck                     PASS      3.53 seconds
MakeDistcheck                 PASS      122.19 seconds
CheckValgrind                 PASS      120.72 seconds
CheckSmatch                   PASS      228.31 seconds
bluezmakeextell               PASS      74.06 seconds
IncrementalBuild              PASS      464.74 seconds
ScanBuild                     PASS      681.68 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v1] avdtp: Fix use-after-free in connection_lost
WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#122: 
Assisted-by: Claude:claude-sonnet-5

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'Claude:claude-sonnet-5'
#122: 
Assisted-by: Claude:claude-sonnet-5

/github/workspace/src/patch/14736692.patch total: 1 errors, 1 warnings, 13 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14736692.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




https://github.com/bluez/bluez/pull/2386

---
Regards,
Linux Bluetooth