[PATCH BlueZ] adapter: clear discovery_found list before discovery_cleanup()

[PATCH BlueZ] adapter: clear discovery_found list before discovery_cleanup()

[Pauli Virtanen]

discovery_cleanup() tries to reset RSSI of devices in
adapter->discovery_found list.  When called from adapter_remove(), the
list contains only stale pointers as devices have been already freed,
leading to UAF.

Fix by freeing the discovery_found list in adapter_remove().

Fixes AddressSanitizer: heap-use-after-free
READ of size 1 at 0x7d5b585e033d thread T0
    #0 0x000000772b1a in device_set_rssi_with_delta src/device.c:7121
    #1 0x000000772daa in device_set_rssi src/device.c:7150
    #2 0x0000006aa808 in invalidate_rssi_and_tx_power src/adapter.c:1732
    #3 0x7feb5a35557f in g_slist_foreach (/lib64/libglib-2.0.so.0+0x6257f)
    #4 0x7feb5a355b56 in g_slist_free_full (/lib64/libglib-2.0.so.0+0x62b56)
    #5 0x0000006f67d2 in discovery_cleanup src/adapter.c:1747
    #6 0x0000006f904f in adapter_remove src/adapter.c:7219
    #7 0x0000006f9de2 in adapter_cleanup src/adapter.c:11165
    #8 0x000000418ca9 in main src/main.c:1719

freed by thread T0 here:
    #0 0x7feb5a5434cf in free.part.0 (/lib64/libasan.so.8+0xee4cf)
    #1 0x7feb5a337bb4 in g_free (/lib64/libglib-2.0.so.0+0x44bb4)
    #2 0x0000007519d7 in device_free src/device.c:963

previously allocated by thread T0 here:
    #0 0x7feb5a54424f in calloc (/lib64/libasan.so.8+0xef24f)
    #1 0x000000751fee in device_new src/device.c:4963
---
 src/adapter.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/adapter.c b/src/adapter.c
index 7390ceeee..d6eaa814b 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -7216,6 +7216,9 @@ static void adapter_remove(struct btd_adapter *adapter)
 	g_slist_free(adapter->devices);
 	adapter->devices = NULL;
 
+	g_slist_free(adapter->discovery_found);
+	adapter->discovery_found = NULL;
+
 	discovery_cleanup(adapter, 0);
 
 	unload_drivers(adapter);
-- 
2.55.0

RE: [BlueZ] adapter: clear discovery_found list before discovery_cleanup()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1792 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1157432

---Test result---

Test Summary:
CheckPatch                    FAIL      0.46 seconds
GitLint                       PASS      0.64 seconds
BuildEll                      PASS      19.99 seconds
BluezMake                     PASS      569.77 seconds
CheckSmatch                   PASS      298.68 seconds
bluezmakeextell               PASS      97.69 seconds
IncrementalBuild              PASS      553.61 seconds
ScanBuild                     PASS      887.31 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] adapter: clear discovery_found list before discovery_cleanup()
WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#95: 
    #4 0x7feb5a355b56 in g_slist_free_full (/lib64/libglib-2.0.so.0+0x62b56)

/github/workspace/src/patch/14788726.patch total: 0 errors, 1 warnings, 9 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14788726.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




https://github.com/bluez/bluez/pull/2489

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] adapter: clear discovery_found list before discovery_cleanup()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri,  4 Sep 2026 00:50:33 +0300 you wrote:
> discovery_cleanup() tries to reset RSSI of devices in
> adapter->discovery_found list.  When called from adapter_remove(), the
> list contains only stale pointers as devices have been already freed,
> leading to UAF.
> 
> Fix by freeing the discovery_found list in adapter_remove().
> 
> [...]

Here is the summary with links:
  - [BlueZ] adapter: clear discovery_found list before discovery_cleanup()
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=7e3212fa233e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html