[PATCH BlueZ] device: Fix NULL pointer dereference in dev_property_get_uuids

[PATCH BlueZ] device: Fix NULL pointer dereference in dev_property_get_uuids

[Tao Cai]

The bluetoothd process crashes during D-Bus property serialization when
the device UUID list contains a NULL entry. Add a NULL check before
calling dbus_message_iter_append_basic().

---
Crash Stack Trace (BlueZ 5.71 AArch64):
#0  0x0000ffff8ecfbe98 in ??? () at /lib/aarch64-linux-gnu/libc.so.6
#1  0x0000ffff8ecfe548 in ??? () at /lib/aarch64-linux-gnu/libc.so.6
#2  0x0000ffff8ecff120 in ??? () at /lib/aarch64-linux-gnu/libc.so.6
#3  0x0000ffff8ed005c8 in realloc () at /lib/aarch64-linux-gnu/libc.so.6
#4  0x0000ffff8f250204 in ??? () at /lib/aarch64-linux-gnu/libdbus-1.so.3
#5  0x0000ffff8f251c34 in _dbus_string_copy_len () at /lib/aarch64-linux-gnu/libdbus-1.so.3
#6  0x0000ffff8f254294 in ??? () at /lib/aarch64-linux-gnu/libdbus-1.so.3
#7  0x0000ffff8f23f968 in _dbus_type_writer_write_basic () at /lib/aarch64-linux-gnu/libdbus-1.so.3
#8  0x0000ffff8f243208 in dbus_message_iter_append_basic () at /lib/aarch64-linux-gnu/libdbus-1.so.3
#9  0x0000aaaabe2f64d0 in dev_property_get_uuids (property=<optimized out>, iter=0xffffd510cf28, data=0xaaaac18514e0) at src/device.c:1339
...
#21 main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1456
---
 src/device.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/device.c b/src/device.c
index 6d82ea3e2..c5d8e4c6e 100644
--- a/src/device.c
+++ b/src/device.c
@@ -1455,9 +1455,13 @@ static gboolean dev_property_get_uuids(const GDBusPropertyTable *property,
 	else
 		l = dev->uuids;
 
-	for (; l != NULL; l = l->next)
-		dbus_message_iter_append_basic(&entry, DBUS_TYPE_STRING,
-							&l->data);
+	for (; l != NULL; l = l->next) {
+		const char *uuid = l->data;
+		if (uuid != NULL) {
+			dbus_message_iter_append_basic(&entry, DBUS_TYPE_STRING,
+							&uuid);
+		}
+	}
 
 	dbus_message_iter_close_container(iter, &entry);
 
-- 
2.43.0

RE: [BlueZ] device: Fix NULL pointer dereference in dev_property_get_uuids

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1808 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1170934/

---Test result---

Test Summary:
CheckPatch                    FAIL      0.35 seconds
GitLint                       PASS      0.25 seconds
BuildEll                      PASS      16.37 seconds
BluezMake                     PASS      272.05 seconds
CheckSmatch                   PASS      199.12 seconds
bluezmakeextell               PASS      75.39 seconds
TestFunctional                PASS      872.86 seconds
IncrementalBuild              PASS      265.89 seconds
ScanBuild                     PASS      787.21 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] device: Fix NULL pointer dereference in dev_property_get_uuids
WARNING:LINE_SPACING: Missing a blank line after declarations
#112: FILE: src/device.c:1460:
+		const char *uuid = l->data;
+		if (uuid != NULL) {

/home/runner/work/bluez/bluez/src/patch/14837278.patch total: 0 errors, 1 warnings, 16 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluez/bluez/src/patch/14837278.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




https://github.com/bluez/bluez/pull/2564

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] device: Fix NULL pointer dereference in dev_property_get_uuids

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 22 Sep 2026 11:10:17 +0800 you wrote:
> The bluetoothd process crashes during D-Bus property serialization when
> the device UUID list contains a NULL entry. Add a NULL check before
> calling dbus_message_iter_append_basic().
> 
> ---
> Crash Stack Trace (BlueZ 5.71 AArch64):
> #0  0x0000ffff8ecfbe98 in ??? () at /lib/aarch64-linux-gnu/libc.so.6
> #1  0x0000ffff8ecfe548 in ??? () at /lib/aarch64-linux-gnu/libc.so.6
> #2  0x0000ffff8ecff120 in ??? () at /lib/aarch64-linux-gnu/libc.so.6
> #3  0x0000ffff8ed005c8 in realloc () at /lib/aarch64-linux-gnu/libc.so.6
> #4  0x0000ffff8f250204 in ??? () at /lib/aarch64-linux-gnu/libdbus-1.so.3
> #5  0x0000ffff8f251c34 in _dbus_string_copy_len () at /lib/aarch64-linux-gnu/libdbus-1.so.3
> #6  0x0000ffff8f254294 in ??? () at /lib/aarch64-linux-gnu/libdbus-1.so.3
> #7  0x0000ffff8f23f968 in _dbus_type_writer_write_basic () at /lib/aarch64-linux-gnu/libdbus-1.so.3
> #8  0x0000ffff8f243208 in dbus_message_iter_append_basic () at /lib/aarch64-linux-gnu/libdbus-1.so.3
> #9  0x0000aaaabe2f64d0 in dev_property_get_uuids (property=<optimized out>, iter=0xffffd510cf28, data=0xaaaac18514e0) at src/device.c:1339
> ...
> #21 main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1456
> 
> [...]

Here is the summary with links:
  - [BlueZ] device: Fix NULL pointer dereference in dev_property_get_uuids
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=f26da4389e2d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html