[bluez/bluez] 38f8e4: transport: Fix use-after-free when replacing a lin...

[bluez/bluez] 38f8e4: transport: Fix use-after-free when replacing a lin...

[fdanis-oss]

  Branch: refs/heads/1154589
  Home:   https://github.com/bluez/bluez
  Commit: 38f8e4dc7d4e6180501772f0e6f3dd90c9cba7aa
      https://github.com/bluez/bluez/commit/38f8e4dc7d4e6180501772f0e6f3dd90c9cba7aa
  Author: Frédéric Danis <frederic.danis@collabora.com>
  Date:   2026-08-31 (Mon, 31 Aug 2026)

  Changed paths:
    M profiles/audio/transport.c

  Log Message:
  -----------
  transport: Fix use-after-free when replacing a linked transport's owner

linked_transport_set_owner() unconditionally overwrote a linked
transport's owner pointer. If that transport already had a different
owner assigned (e.g. its own Acquire request was still pending when the
paired transport's owner was set), the previous media_owner was
orphaned: its D-Bus disconnect watch stayed registered and its
->transport back-pointer kept pointing at the transport. Once the
transport was later destroyed, the still-registered watch would
eventually fire media_owner_exit() and dereference the freed transport.

Tear down any pre-existing, different owner via
media_transport_remove_owner() before assigning the new one, so its
pending request is replied to, its watch is removed and the owner is
freed instead of leaked. Since media_transport_remove_owner() itself
recurses into linked_transport_remove_owner() for linked streams, also
guard linked_transport_remove_owner() so it only clears a transport's
owner when it still matches the owner being removed, preventing it
from clobbering an owner that was already reassigned during that
recursion.

Assisted-by: Claude:claude-sonnet-5



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications