From: Pauli Virtanen <noreply@github.com>
To: linux-bluetooth@vger.kernel.org
Subject: [bluez/bluez] 37b825: adapter: clear discovery_found list before discove...
Date: Thu, 03 Sep 2026 16:13:28 -0700 [thread overview]
Message-ID: <bluez/bluez/push/refs/heads/1157432/000000-37b825@github.com> (raw)
Branch: refs/heads/1157432
Home: https://github.com/bluez/bluez
Commit: 37b825c7d0206b7662f3d1663245660f2493bd85
https://github.com/bluez/bluez/commit/37b825c7d0206b7662f3d1663245660f2493bd85
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
M src/adapter.c
Log Message:
-----------
adapter: clear discovery_found list before discovery_cleanup()
discovery_cleanup() tries to reset RSSI of devices in
adapter->discovery_found list. When called from adapter_remove(), the
list contains only stale pointers as devices have been already freed,
leading to UAF.
Fix by freeing the discovery_found list in adapter_remove().
Fixes AddressSanitizer: heap-use-after-free
READ of size 1 at 0x7d5b585e033d thread T0
#0 0x000000772b1a in device_set_rssi_with_delta src/device.c:7121
#1 0x000000772daa in device_set_rssi src/device.c:7150
#2 0x0000006aa808 in invalidate_rssi_and_tx_power src/adapter.c:1732
#3 0x7feb5a35557f in g_slist_foreach (/lib64/libglib-2.0.so.0+0x6257f)
#4 0x7feb5a355b56 in g_slist_free_full (/lib64/libglib-2.0.so.0+0x62b56)
#5 0x0000006f67d2 in discovery_cleanup src/adapter.c:1747
#6 0x0000006f904f in adapter_remove src/adapter.c:7219
#7 0x0000006f9de2 in adapter_cleanup src/adapter.c:11165
#8 0x000000418ca9 in main src/main.c:1719
freed by thread T0 here:
#0 0x7feb5a5434cf in free.part.0 (/lib64/libasan.so.8+0xee4cf)
#1 0x7feb5a337bb4 in g_free (/lib64/libglib-2.0.so.0+0x44bb4)
#2 0x0000007519d7 in device_free src/device.c:963
previously allocated by thread T0 here:
#0 0x7feb5a54424f in calloc (/lib64/libasan.so.8+0xef24f)
#1 0x000000751fee in device_new src/device.c:4963
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
reply other threads:[~2026-09-03 23:13 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bluez/bluez/push/refs/heads/1157432/000000-37b825@github.com \
--to=noreply@github.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.