[PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready

From: Derek Tern <redacted>

A late stream-ready event can reach bap_resume_complete() after Release
has queued Disable. It then replies to Release with an Acquire payload
and drops the Disable request ID. Client disconnection can subsequently
free the owner while the Disable callback still refers to it.

Only complete pending Acquire/TryAcquire requests from this path. Leave
Release and its request ID for the Disable callback or cancellation.
---
Based on master ebbb4ee31. The new resume test fails all three pause
variants on that base with malformed Release replies and a Disable
cleanup crash. With the series: 7 targeted functional tests and all 697
BAP unit tests pass. The tests check transport lifecycle, not audio data.

 profiles/audio/transport.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/profiles/audio/transport.c b/profiles/audio/transport.c
index e3f3df50e..02c5c7ac0 100644
--- a/profiles/audio/transport.c
+++ b/profiles/audio/transport.c

@@ -1952,8 +1952,16 @@ static void bap_resume_complete(struct media_transport *transport)
 	if (!owner)
 		return;
 
-	if (owner->pending)
+	if (owner->pending) {
+		const char *member;
+
+		member = dbus_message_get_member(owner->pending->msg);
+		/* A late ready event must not complete a pending Release. */
+		if (strcmp(member, "Acquire") && strcmp(member, "TryAcquire"))
+			return;
+
 		owner->pending->id = 0;
+	}
 
 	if (transport->fd < 0) {
 		media_transport_remove_owner(transport);