Re: [PATCH BlueZ 0/5] player: Fix crash and related defects around the pending request

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <[email protected]>:

On Fri, 21 Aug 2026 22:34:44 +0300 you wrote:
> A player that advertises the AVRCP NowPlaying feature bit but not the
> Browsing bit exports playable MediaItem1 objects while the player scope
> is still unset, and calling org.bluez.MediaItem1.Play() on one of them
> crashes bluetoothd with a NULL dereference at offset 0x28.
> 
> media_item_play() dereferences mp->scope, which is only ever set from
> SetBrowsedPlayer or ChangeFolder, and both are reached only when the
> player advertises Browsing (features[7] & 0x08). The /NowPlaying folder
> and its playable items are gated on a different bit (features[8] &
> 0x02), so the two can disagree. msg sits at offset 40 in struct
> media_folder on LP64, which is the reported fault address.
> 
> [...]

Here is the summary with links:
  - [BlueZ,1/5] player: Fix crash on MediaItem1.Play() without a browsing scope
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=a8d22214940d
  - [BlueZ,2/5] player: Answer pending request when the player is destroyed
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=ede23fb50e41
  - [BlueZ,3/5] player: Fix NumberOfItems never being updated on SetBrowsedPlayer
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=3215010456f1
  - [BlueZ,4/5] player: Report EBUSY from a busy Search()
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=a93047cd044f
  - [BlueZ,5/5] unit/test-media-player: Add media player tests
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html