Re: [PATCH BlueZ 0/2] Fix use-after-free in GATT client discovery

[patchwork-bot+bluetooth@kernel.org]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 30 Sep 2026 11:39:26 +0200 you wrote:
> bluetoothd crashes in discovery_op_complete() when a discovery of a
> connected peer's GATT database is cut short, e.g. because the link
> drops mid-discovery. Two separate bugs leave a freed service in the
> discovery's pending_svcs queue, and each patch fixes one of them.
> 
> It reproduces by connecting over LE, reading one characteristic and
> disconnecting about once a second, with a peer that answers the
> remote's GATT discovery. Each connection is short enough that the
> remote's discovery of the peer is still running when the link drops.
> On 5.72 bluetoothd crashed on the 15th connection in 4 runs out of 4.
> With both patches it survived 381 connections in a row. On 5.83, 50
> such connections crashed the unpatched daemon within the first minute
> and pass with both patches.
> 
> [...]

Here is the summary with links:
  - [BlueZ,1/2] shared/gatt-db: Always notify service removal
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=6cdb936ebb6a
  - [BlueZ,2/2] shared/gatt-client: Fix double-queued service
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=a338533f913b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html