From: Pauli Virtanen <noreply@github.com>
To: linux-bluetooth@vger.kernel.org
Subject: [bluez/bluez] ab6c9f: emulator: btdev: fix inquiry_timeout() inquiry des...
Date: Thu, 03 Sep 2026 14:05:00 -0700 [thread overview]
Message-ID: <bluez/bluez/push/refs/heads/1157383/000000-ab6c9f@github.com> (raw)
Branch: refs/heads/1157383
Home: https://github.com/bluez/bluez
Commit: ab6c9f110d1d52a7b2f4cf5edc725b3b3ed876c2
https://github.com/bluez/bluez/commit/ab6c9f110d1d52a7b2f4cf5edc725b3b3ed876c2
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
M emulator/btdev.c
Log Message:
-----------
emulator: btdev: fix inquiry_timeout() inquiry destroy
inquiry_timeout() removes inquiry_id callback, whose destroy removes
inquiry_timeout_id callback. Doing this from the callback itself frees
timeout-mainloop.c timeout data under it, leading to crash.
Fix by setting btdev->inquiry_timeout_id = 0 first to avoid the early
free.
Fixes ERROR: AddressSanitizer: heap-use-after-free
READ of size 4 at 0x7b9d9cfe0310 thread T0
#0 0x00000049ebbe in timeout_callback src/shared/timeout-mainloop.c:33
#1 0x00000049f270 in timeout_callback src/shared/mainloop.c:245
#2 0x00000049fbbb in mainloop_run src/shared/mainloop.c:104
#3 0x0000004a286f in mainloop_run_with_signal src/shared/mainloop-notify.c:196
#4 0x000000402a66 in main emulator/main.c:261
freed by thread T0 here:
#0 0x7f7a5e6ee4cf in free.part.0 (/lib64/libasan.so.8+0xee4cf)
#1 0x00000049f591 in timeout_destroy src/shared/mainloop.c:226
previously allocated by thread T0 here:
#0 0x7f7a5e6ef41f in malloc (/lib64/libasan.so.8+0xef41f)
#1 0x00000049158a in util_malloc src/shared/util.c:46
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
reply other threads:[~2026-09-03 21:05 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bluez/bluez/push/refs/heads/1157383/000000-ab6c9f@github.com \
--to=noreply@github.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.