* [PATCH BlueZ v1 1/2] bthost: Fix crash on bthost_past_set_info
@ 2025-10-30 17:01 Luiz Augusto von Dentz
2025-10-30 17:01 ` [PATCH BlueZ v1 2/2] btdev: Fix crash on BIG cleanup Luiz Augusto von Dentz
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Luiz Augusto von Dentz @ 2025-10-30 17:01 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This fixes the following crash:
Invalid read of size 1
at 0x401DEFE: send_command (bthost.c:1101)
by 0x4021F01: bthost_past_set_info (bthost.c:3758)
by 0x4006038: test_listen_past (iso-tester.c:3246)
by 0x494984A: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x4943862: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x494C7A7: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x494CA4E: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x402CC4D: mainloop_run (mainloop-glib.c:65)
by 0x402D224: mainloop_run_with_signal (mainloop-notify.c:196)
by 0x402C445: tester_run (tester.c:1084)
by 0x4005609: main (iso-tester.c:4335)
Address 0x40 is not stack'd, malloc'd or (recently) free'd
---
emulator/bthost.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/emulator/bthost.c b/emulator/bthost.c
index 79d8305d78cf..faabbaa36a4a 100644
--- a/emulator/bthost.c
+++ b/emulator/bthost.c
@@ -3751,6 +3751,9 @@ void bthost_past_set_info(struct bthost *bthost, uint16_t handle)
{
struct bt_hci_cmd_le_past_set_info cp;
+ if (!bthost)
+ return;
+
memset(&cp, 0, sizeof(cp));
cp.handle = cpu_to_le16(handle);
cp.adv_handle = 0x01;
--
2.51.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH BlueZ v1 2/2] btdev: Fix crash on BIG cleanup
2025-10-30 17:01 [PATCH BlueZ v1 1/2] bthost: Fix crash on bthost_past_set_info Luiz Augusto von Dentz
@ 2025-10-30 17:01 ` Luiz Augusto von Dentz
2025-10-30 18:24 ` [BlueZ,v1,1/2] bthost: Fix crash on bthost_past_set_info bluez.test.bot
2025-10-30 22:30 ` [PATCH BlueZ v1 1/2] " patchwork-bot+bluetooth
2 siblings, 0 replies; 4+ messages in thread
From: Luiz Augusto von Dentz @ 2025-10-30 17:01 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This fixes the following crash:
Invalid read of size 8
at 0x400F26F: le_big_free (btdev.c:606)
by 0x4024636: queue_remove_all (queue.c:341)
by 0x40246C2: queue_destroy (queue.c:60)
by 0x401B7C9: btdev_destroy (btdev.c:7820)
by 0x400CFBF: hciemu_client_destroy (hciemu.c:301)
by 0x4024636: queue_remove_all (queue.c:341)
by 0x40246C2: queue_destroy (queue.c:60)
by 0x400DA91: hciemu_unref (hciemu.c:441)
by 0x40072F2: test_post_teardown (iso-tester.c:701)
by 0x402BB0A: tester_teardown_complete (tester.c:713)
by 0x402BB41: default_teardown (tester.c:266)
by 0x402B43B: teardown_callback (tester.c:434)
---
emulator/btdev.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/emulator/btdev.c b/emulator/btdev.c
index 8c72a24290c6..c53db7040d39 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -6863,7 +6863,7 @@ static int cmd_term_big_complete(struct btdev *dev, const void *data,
{
const struct bt_hci_cmd_le_term_big *cmd = data;
struct bt_hci_evt_le_big_terminate rsp;
- struct le_big *big;
+ struct le_big *big, *rbig;
struct btdev_conn *conn;
struct btdev *remote = NULL;
@@ -6875,7 +6875,6 @@ static int cmd_term_big_complete(struct btdev *dev, const void *data,
big = queue_find(dev->le_big, match_big_handle,
UINT_TO_PTR(cmd->handle));
-
if (!big)
return 0;
@@ -6892,14 +6891,17 @@ static int cmd_term_big_complete(struct btdev *dev, const void *data,
remote = conn->link->dev;
- big = queue_find(remote->le_big, match_bis, conn->link);
- if (big) {
+ rbig = queue_find(remote->le_big, match_bis,
+ conn->link);
+ if (rbig) {
memset(&evt, 0, sizeof(evt));
- evt.big_handle = big->handle;
+ evt.big_handle = rbig->handle;
evt.reason = cmd->reason;
le_meta_event(remote,
BT_HCI_EVT_LE_BIG_SYNC_LOST,
&evt, sizeof(evt));
+ queue_remove(remote->le_big, rbig);
+ le_big_free(rbig);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [BlueZ,v1,1/2] bthost: Fix crash on bthost_past_set_info
2025-10-30 17:01 [PATCH BlueZ v1 1/2] bthost: Fix crash on bthost_past_set_info Luiz Augusto von Dentz
2025-10-30 17:01 ` [PATCH BlueZ v1 2/2] btdev: Fix crash on BIG cleanup Luiz Augusto von Dentz
@ 2025-10-30 18:24 ` bluez.test.bot
2025-10-30 22:30 ` [PATCH BlueZ v1 1/2] " patchwork-bot+bluetooth
2 siblings, 0 replies; 4+ messages in thread
From: bluez.test.bot @ 2025-10-30 18:24 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
[-- Attachment #1: Type: text/plain, Size: 1753 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1017827
---Test result---
Test Summary:
CheckPatch PENDING 0.34 seconds
GitLint PENDING 0.43 seconds
BuildEll PASS 20.06 seconds
BluezMake PASS 2601.24 seconds
MakeCheck PASS 20.41 seconds
MakeDistcheck PASS 186.43 seconds
CheckValgrind PASS 238.88 seconds
CheckSmatch WARNING 309.74 seconds
bluezmakeextell PASS 129.07 seconds
IncrementalBuild PENDING 0.42 seconds
ScanBuild PASS 911.10 seconds
Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:
##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
emulator/bthost.c:699:28: warning: Variable length array is used.emulator/bthost.c:700:32: warning: Variable length array is used.emulator/bthost.c:917:28: warning: Variable length array is used.emulator/bthost.c:951:28: warning: Variable length array is used.emulator/bthost.c:952:32: warning: Variable length array is used.emulator/btdev.c:459:29: warning: Variable length array is used.
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH BlueZ v1 1/2] bthost: Fix crash on bthost_past_set_info
2025-10-30 17:01 [PATCH BlueZ v1 1/2] bthost: Fix crash on bthost_past_set_info Luiz Augusto von Dentz
2025-10-30 17:01 ` [PATCH BlueZ v1 2/2] btdev: Fix crash on BIG cleanup Luiz Augusto von Dentz
2025-10-30 18:24 ` [BlueZ,v1,1/2] bthost: Fix crash on bthost_past_set_info bluez.test.bot
@ 2025-10-30 22:30 ` patchwork-bot+bluetooth
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+bluetooth @ 2025-10-30 22:30 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Thu, 30 Oct 2025 13:01:25 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> This fixes the following crash:
>
> Invalid read of size 1
> at 0x401DEFE: send_command (bthost.c:1101)
> by 0x4021F01: bthost_past_set_info (bthost.c:3758)
> by 0x4006038: test_listen_past (iso-tester.c:3246)
> by 0x494984A: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
> by 0x4943862: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
> by 0x494C7A7: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
> by 0x494CA4E: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.8400.4)
> by 0x402CC4D: mainloop_run (mainloop-glib.c:65)
> by 0x402D224: mainloop_run_with_signal (mainloop-notify.c:196)
> by 0x402C445: tester_run (tester.c:1084)
> by 0x4005609: main (iso-tester.c:4335)
> Address 0x40 is not stack'd, malloc'd or (recently) free'd
>
> [...]
Here is the summary with links:
- [BlueZ,v1,1/2] bthost: Fix crash on bthost_past_set_info
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=229d411e5a71
- [BlueZ,v1,2/2] btdev: Fix crash on BIG cleanup
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=bb82243a6c27
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-10-30 22:30 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-30 17:01 [PATCH BlueZ v1 1/2] bthost: Fix crash on bthost_past_set_info Luiz Augusto von Dentz
2025-10-30 17:01 ` [PATCH BlueZ v1 2/2] btdev: Fix crash on BIG cleanup Luiz Augusto von Dentz
2025-10-30 18:24 ` [BlueZ,v1,1/2] bthost: Fix crash on bthost_past_set_info bluez.test.bot
2025-10-30 22:30 ` [PATCH BlueZ v1 1/2] " patchwork-bot+bluetooth
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.