[PATCH v1] avdtp: Fix use-after-free in connection_lost

release_stream() may free the session's a2dp_setup through
abort_cfm(). Subsequently, finalize_discovery() passes the same
freed a2dp_setup to discover_cb(), resulting in a use-after-free.

Call finalize_discovery() before release_stream() instead.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Jinwang Li <[email protected]>
---
 profiles/audio/avdtp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
index 56d27b973..b8d9b8e94 100644
--- a/profiles/audio/avdtp.c
+++ b/profiles/audio/avdtp.c
@@ -1158,11 +1158,11 @@ static void connection_lost(struct avdtp *session, int err)
 	ba2str(device_get_address(session->device), address);
 	DBG("Disconnected from %s", address);
 
+	finalize_discovery(session, err);
+
 	g_slist_foreach(session->streams, (GFunc) release_stream, session);
 	session->streams = NULL;
 
-	finalize_discovery(session, err);
-
 	avdtp_set_state(session, AVDTP_SESSION_STATE_DISCONNECTED);
 
 	avdtp_unref(session);
-- 
2.34.1