[bluez/bluez] 4bb428: bass: Fix possible crash on bass_update_bis_sync

[bluez/bluez] 4bb428: bass: Fix possible crash on bass_update_bis_sync

[Luiz Augusto von Dentz]

  Branch: refs/heads/1118322
  Home:   https://github.com/bluez/bluez
  Commit: 4bb4281e3b7b51c2b322f4ba1882826c139ef52a
      https://github.com/bluez/bluez/commit/4bb4281e3b7b51c2b322f4ba1882826c139ef52a
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M profiles/audio/bass.c

  Log Message:
  -----------
  bass: Fix possible crash on bass_update_bis_sync

bass_update_bis_sync does use bass_remove_bis which may end up
removing the current entry causing a crash on entry->next, to avoid
that prefetch the next entry.


  Commit: 7a4396677522a537c751327defe8d66ca26ad3cd
      https://github.com/bluez/bluez/commit/7a4396677522a537c751327defe8d66ca26ad3cd
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Check if stream is valid before attempting to release

bt_bap_stream_release shall check if the stream is still valid before
attempting to release it just as done with other operations.


  Commit: 6214233de73d8e101322487f79bf8a89b8ccdb7a
      https://github.com/bluez/bluez/commit/6214233de73d8e101322487f79bf8a89b8ccdb7a
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Don't transition to IDLE inside bap_bcast_set_state

Remove the recursive stream_set_state(IDLE) call from the RELEASING
case in bap_bcast_set_state. This call re-entered bap_bcast_set_state
while the state_cbs queue was still being iterated, causing a
use-after-free if a callback unregistered itself during notification.


  Commit: cb4ff884ae40b2bad3ba63191b4f9848c8d892b1
      https://github.com/bluez/bluez/commit/cb4ff884ae40b2bad3ba63191b4f9848c8d892b1
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Use queue_foreach to notify state changes

Use queue_foreach to notify state changes since that is considered
safer as it does attempt to detect list modification while traversing
the list.


  Commit: dc5f004af4bbc56381a74f2dd11b113608941ded
      https://github.com/bluez/bluez/commit/dc5f004af4bbc56381a74f2dd11b113608941ded
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Protect bap_stream_notify_connecting

bap_stream_notify_connecting may encounter callbacks that remove itself
while traversing the state_cbs, so this attempts to prevent to cause a
crash by prefetching the next entry.


Compare: https://github.com/bluez/bluez/compare/4bb4281e3b7b%5E...dc5f004af4bb

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications