[bluez/bluez] 7482ac: profiles/audio: fix UAF on external media service ...

[bluez/bluez] 7482ac: profiles/audio: fix UAF on external media service ...

[Bhavani]

  Branch: refs/heads/master
  Home:   https://github.com/bluez/bluez
  Commit: 7482aceece7044e688f20f113263b50c21d69fb6
      https://github.com/bluez/bluez/commit/7482aceece7044e688f20f113263b50c21d69fb6
  Author: Frédéric Danis <frederic.danis@collabora.com>
  Date:   2026-07-15 (Wed, 15 Jul 2026)

  Changed paths:
    M profiles/audio/media.c

  Log Message:
  -----------
  profiles/audio: fix UAF on external media service teardown

Keep media_app endpoint/player queues in sync with object lifetime to
avoid stale pointers during proxy removal.

When admin allowlist reapply removes audio services, endpoint/player
objects may be destroyed through non-proxy paths first.
Later proxy_removed_cb calls queue_remove_if() and matching by path
can dereference freed endpoint/player memory.

Fix by:
- adding media_app back-references in media_endpoint/local_player
- unlinking from app queues inside media_endpoint_remove or
  local_player_remove
- setting ownership when app-registering endpoint/player objects

This prevents heap-use-after-free in match_endpoint_by_path or
match_player_by_path during service disconnect.

Assisted-by: GPT:GPT-5.3-Codex


  Commit: b0abe23f58f1ecc44d9d0b6b328be72d2d2113b8
      https://github.com/bluez/bluez/commit/b0abe23f58f1ecc44d9d0b6b328be72d2d2113b8
  Author: Naga Bhavani Akella <naga.akella@oss.qualcomm.com>
  Date:   2026-07-15 (Wed, 15 Jul 2026)

  Changed paths:
    M Makefile.am
    A doc/org.bluez.ChannelSounding1.rst

  Log Message:
  -----------
  doc/org.bluez.ChannelSounding1:Add Used by reference and Examples

Add :Used by: field linking to bluetoothctl cs submenu and
Examples section showing corresponding bluetoothctl cs commands
for D-Bus methods


  Commit: 30db66dc971bd1cd95d4a7b0eea296367ab65b3b
      https://github.com/bluez/bluez/commit/30db66dc971bd1cd95d4a7b0eea296367ab65b3b
  Author: Naga Bhavani Akella <naga.akella@oss.qualcomm.com>
  Date:   2026-07-15 (Wed, 15 Jul 2026)

  Changed paths:
    M Makefile.tools
    A doc/bluetoothctl-cs.rst

  Log Message:
  -----------
  doc/bluetoothctl-cs: Add :Uses: fields and document arguments

Add :Uses: fields to link commands to their corresponding D-Bus API
methods, and document command arguments with usage examples


Compare: https://github.com/bluez/bluez/compare/1309d5f9305d...30db66dc971b

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications