profiles/audio: fix UAF on external media service teardown

Keep media_app endpoint/player queues in sync with object lifetime to avoid stale pointers during proxy removal.

When admin allowlist reapply removes audio services, endpoint/player objects may be destroyed through non-proxy paths first. Later proxy_removed_cb calls queue_remove_if() and matching by path can dereference freed endpoint/player memory.

Fix by:
- adding media_app back-references in media_endpoint/local_player
- unlinking from app queues inside media_endpoint_remove or local_player_remove
- setting ownership when app-registering endpoint/player objects

This prevents heap-use-after-free in match_endpoint_by_path or match_player_by_path during service disconnect.

---
 profiles/audio/media.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

index 5d9ea2cbc..95f9580b0 100644
@@ -136,12 +136,14 @@ struct media_endpoint {
 	guint			watch;
 	GSList			*requests;
 	struct media_adapter	*adapter;
+	struct media_app	*app;
 	GSList			*transports;
 	struct endpoint_features	features;
 };
 
 struct local_player {
 	struct media_adapter	*adapter;
+	struct media_app	*app;
 	char			*sender;	/* Player DBus bus id */
 	char			*path;		/* Player object path */
 	GHashTable		*settings;	/* Player settings */

@@ -305,6 +307,11 @@ static void media_endpoint_remove(void *data)
 	}
 #endif
 
+	if (endpoint->app) {
+		queue_remove(endpoint->app->endpoints, endpoint);
+		endpoint->app = NULL;
+	}
+
 	info("Endpoint unregistered: sender=%s path=%s", endpoint->sender,
 			endpoint->path);
 

@@ -2076,6 +2083,11 @@ static void local_player_remove(void *data)
 {
 	struct local_player *mp = data;
 
+	if (mp->app) {
+		queue_remove(mp->app->players, mp);
+		mp->app = NULL;
+	}
+
 	info("Player unregistered: sender=%s path=%s", mp->sender, mp->path);
 
 	local_player_destroy(mp);

@@ -3168,6 +3180,8 @@ static void app_register_endpoint(void *data, void *user_data)
 		return;
 	}
 
+	endpoint->app = app;
+
 	queue_push_tail(app->endpoints, endpoint);
 
 	return;

@@ -3196,6 +3210,8 @@ static void app_register_player(void *data, void *user_data)
 	if (!player)
 		return;
 
+	player->app = app;
+
 	if (g_dbus_proxy_get_property(proxy, "PlaybackStatus", &iter)) {
 		if (!set_status(player, &iter))
 			goto fail;

2.43.0

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1128272

---Test result---

Test Summary:

CheckPatch                    FAIL      0.42 seconds
GitLint                       PASS      0.27 seconds
BuildEll                      PASS      20.19 seconds
BluezMake                     FAIL      486.29 seconds
MakeCheck                     FAIL      19.05 seconds
MakeDistcheck                 PASS      153.50 seconds
CheckValgrind                 FAIL      124.17 seconds
CheckSmatch                   PASS      290.93 seconds
bluezmakeextell               PASS      94.45 seconds
IncrementalBuild              FAIL      471.05 seconds
ScanBuild                     PASS      896.89 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] profiles/audio: fix UAF on external media service teardown WARNING:BAD_SIGN_OFF: Non-standard signature: Assisted-by:
#85:

ERROR:BAD_SIGN_OFF: Unrecognized email address: 'GPT:GPT-5.3-Codex' #85:

/github/workspace/src/patch/14689382.patch total: 1 errors, 1 warnings, 52 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14689382.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.

##############################
Test: BluezMake - FAIL
Desc: Build BlueZ
Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 12990 | int main(int argc, char *argv[])

      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~

monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
2940 | sprintf(str, "Features[%u/%u]", page, i);
| ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]

 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cc1: all warnings being treated as errors make[1]: *** [Makefile:7058: monitor/packet.o] Error 1 make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
##############################
Test: MakeCheck - FAIL
Desc: Run Bluez Make Check
Output:

monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
2940 | sprintf(str, "Features[%u/%u]", page, i);
| ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]

 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cc1: all warnings being treated as errors make[1]: *** [Makefile:7058: monitor/packet.o] Error 1
make: *** [Makefile:10820: check] Error 2
##############################
Test: CheckValgrind - FAIL
Desc: Run Bluez Make Check with Valgrind Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 12990 | int main(int argc, char *argv[])

      |     ^~~~

monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
2940 | sprintf(str, "Features[%u/%u]", page, i);
| ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]

 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cc1: all warnings being treated as errors make[1]: *** [Makefile:7058: monitor/packet.o] Error 1 make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:10820: check] Error 2
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 12990 | int main(int argc, char *argv[])

      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~

monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
2940 | sprintf(str, "Features[%u/%u]", page, i);
| ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]

 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/packet.o] Error 1 make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
[BlueZ] profiles/audio: fix UAF on external media service teardown

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 12990 | int main(int argc, char *argv[])

      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~

monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
2940 | sprintf(str, "Features[%u/%u]", page, i);
| ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]

 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cc1: all warnings being treated as errors make[1]: *** [Makefile:7058: monitor/packet.o] Error 1 make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2

https://github.com/bluez/bluez/pull/2316

---
Regards,
Linux Bluetooth