[PATCH BlueZ] adapter: Fix crash on UUID discovery filter match

[PATCH BlueZ] adapter: Fix crash on UUID discovery filter match

[Tom Catshoek]

is_filter_match() looks up each discovery-filter UUID in the queue of
services parsed from a device advertisement. When that services list was
migrated from a GSList to a struct queue, the queue_find() call kept
GLib's g_slist_find_custom() argument order, passing the UUID string
where queue_find() expects a match function and the comparison function
where it expects the match data.

As a result queue_find() calls the UUID string as if it were a function,
jumping into non-executable heap and crashing bluetoothd with SIGSEGV as
soon as an advertisement matches a UUID filter configured via
SetDiscoveryFilter.

Add a queue_match_func_t helper and pass the arguments in the correct
order.

Fixes: https://github.com/bluez/bluez/issues/2282
---
 src/adapter.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/adapter.c b/src/adapter.c
index 210225243..4ffa32a52 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -7184,6 +7184,14 @@ static void adapter_msd_notify(struct btd_adapter *adapter,
 	}
 }
 
+static bool match_uuid(const void *data, const void *match_data)
+{
+	const char *uuid = data;
+	const char *match = match_data;
+
+	return strcmp(uuid, match) == 0;
+}
+
 static bool is_filter_match(GSList *discovery_filter, struct eir_data *eir_data,
 								int8_t rssi)
 {
@@ -7216,8 +7224,7 @@ static bool is_filter_match(GSList *discovery_filter, struct eir_data *eir_data,
 				 * uuid.
 				 */
 				if (queue_find(eir_data->services,
-							m->data,
-							g_strcmp) != NULL)
+							match_uuid, m->data))
 					got_match = true;
 			}
 		}
-- 
2.55.0

Re: [PATCH BlueZ] adapter: Fix crash on UUID discovery filter match

[Bastien Nocera]

On Thu, 2026-07-09 at 14:27 +0200, Tom Catshoek wrote:
> is_filter_match() looks up each discovery-filter UUID in the queue of
> services parsed from a device advertisement. When that services list
> was
> migrated from a GSList to a struct queue, the queue_find() call kept
> GLib's g_slist_find_custom() argument order, passing the UUID string
> where queue_find() expects a match function and the comparison
> function
> where it expects the match data.
> 
> As a result queue_find() calls the UUID string as if it were a
> function,
> jumping into non-executable heap and crashing bluetoothd with SIGSEGV
> as
> soon as an advertisement matches a UUID filter configured via
> SetDiscoveryFilter.
> 
> Add a queue_match_func_t helper and pass the arguments in the correct
> order.

That'd be my fault, can you please add:
Fixes: 91c340d359b7 ("shared: Remove glib dependency from src/shared/ad.c")
to the commit mesage.

I checked the other queue_find() change in the same commit, and the
args were reordered correctly.

I don't understand why we need match_uuid() though, does it fix a
warning? If so, it might be nice to do in a separate commit (fix the
order first, fix the warning second).

> 
> Fixes: https://github.com/bluez/bluez/issues/2282
> ---
>  src/adapter.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/src/adapter.c b/src/adapter.c
> index 210225243..4ffa32a52 100644
> --- a/src/adapter.c
> +++ b/src/adapter.c
> @@ -7184,6 +7184,14 @@ static void adapter_msd_notify(struct
> btd_adapter *adapter,
>  	}
>  }
>  
> +static bool match_uuid(const void *data, const void *match_data)
> +{
> +	const char *uuid = data;
> +	const char *match = match_data;
> +
> +	return strcmp(uuid, match) == 0;
> +}
> +
>  static bool is_filter_match(GSList *discovery_filter, struct
> eir_data *eir_data,
>  								int8
> _t rssi)
>  {
> @@ -7216,8 +7224,7 @@ static bool is_filter_match(GSList
> *discovery_filter, struct eir_data *eir_data,
>  				 * uuid.
>  				 */
>  				if (queue_find(eir_data->services,
> -							m->data,
> -							g_strcmp) !=
> NULL)
> +							match_uuid,
> m->data))
>  					got_match = true;
>  			}
>  		}

RE: [BlueZ] adapter: Fix crash on UUID discovery filter match

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 824 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1124682

---Test result---

Test Summary:
CheckPatch                    PASS      0.76 seconds
GitLint                       PASS      0.22 seconds
BuildEll                      PASS      18.07 seconds
BluezMake                     PASS      628.26 seconds
CheckSmatch                   PASS      269.35 seconds
bluezmakeextell               PASS      94.72 seconds
IncrementalBuild              PASS      651.86 seconds
ScanBuild                     PASS      866.74 seconds



https://github.com/bluez/bluez/pull/2283

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] adapter: Fix crash on UUID discovery filter match

[Luiz Augusto von Dentz]

Hi Bastien,

On Thu, Jul 9, 2026 at 10:39 AM Bastien Nocera <hadess@hadess.net> wrote:
>
> On Thu, 2026-07-09 at 14:27 +0200, Tom Catshoek wrote:
> > is_filter_match() looks up each discovery-filter UUID in the queue of
> > services parsed from a device advertisement. When that services list
> > was
> > migrated from a GSList to a struct queue, the queue_find() call kept
> > GLib's g_slist_find_custom() argument order, passing the UUID string
> > where queue_find() expects a match function and the comparison
> > function
> > where it expects the match data.
> >
> > As a result queue_find() calls the UUID string as if it were a
> > function,
> > jumping into non-executable heap and crashing bluetoothd with SIGSEGV
> > as
> > soon as an advertisement matches a UUID filter configured via
> > SetDiscoveryFilter.
> >
> > Add a queue_match_func_t helper and pass the arguments in the correct
> > order.
>
> That'd be my fault, can you please add:
> Fixes: 91c340d359b7 ("shared: Remove glib dependency from src/shared/ad.c")
> to the commit mesage.
>
> I checked the other queue_find() change in the same commit, and the
> args were reordered correctly.
>
> I don't understand why we need match_uuid() though, does it fix a
> warning? If so, it might be nice to do in a separate commit (fix the
> order first, fix the warning second).

That is probably needed since the callback signature/return doesn't
match the likes of strcmp.

> >
> > Fixes: https://github.com/bluez/bluez/issues/2282
> > ---
> >  src/adapter.c | 11 +++++++++--
> >  1 file changed, 9 insertions(+), 2 deletions(-)
> >
> > diff --git a/src/adapter.c b/src/adapter.c
> > index 210225243..4ffa32a52 100644
> > --- a/src/adapter.c
> > +++ b/src/adapter.c
> > @@ -7184,6 +7184,14 @@ static void adapter_msd_notify(struct
> > btd_adapter *adapter,
> >       }
> >  }
> >
> > +static bool match_uuid(const void *data, const void *match_data)
> > +{
> > +     const char *uuid = data;
> > +     const char *match = match_data;
> > +
> > +     return strcmp(uuid, match) == 0;
> > +}
> > +
> >  static bool is_filter_match(GSList *discovery_filter, struct
> > eir_data *eir_data,
> >                                                               int8
> > _t rssi)
> >  {
> > @@ -7216,8 +7224,7 @@ static bool is_filter_match(GSList
> > *discovery_filter, struct eir_data *eir_data,
> >                                * uuid.
> >                                */
> >                               if (queue_find(eir_data->services,
> > -                                                     m->data,
> > -                                                     g_strcmp) !=
> > NULL)
> > +                                                     match_uuid,
> > m->data))
> >                                       got_match = true;
> >                       }
> >               }
>


-- 
Luiz Augusto von Dentz

Re: [PATCH BlueZ] adapter: Fix crash on UUID discovery filter match

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  9 Jul 2026 14:27:04 +0200 you wrote:
> is_filter_match() looks up each discovery-filter UUID in the queue of
> services parsed from a device advertisement. When that services list was
> migrated from a GSList to a struct queue, the queue_find() call kept
> GLib's g_slist_find_custom() argument order, passing the UUID string
> where queue_find() expects a match function and the comparison function
> where it expects the match data.
> 
> [...]

Here is the summary with links:
  - [BlueZ] adapter: Fix crash on UUID discovery filter match
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=82af2beafc39

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH BlueZ] adapter: Fix crash on UUID discovery filter match

[Tom Catshoek]

On 7/9/26 5:00 PM, Luiz Augusto von Dentz wrote:
>
> On Thu, Jul 9, 2026 at 10:39 AM Bastien Nocera <hadess@hadess.net> wrote:
>> I don't understand why we need match_uuid() though, does it fix a
>> warning? If so, it might be nice to do in a separate commit (fix the
>> order first, fix the warning second).
>
> That is probably needed since the callback signature/return doesn't
> match the likes of strcmp.

Exactly, queue_find() wants a queue_match_func_t, which returns a bool,
and strcmp returns 0 on a match so it needed a wrapper.

Also sorry I wasn't fast enough preparing v2 with the added line
Fixes: 91c340d359b7 ("shared: Remove glib dependency from
src/shared/ad.c") Bastien suggested, please let me know if I can still
do something there.

Thanks guys!

Re: [PATCH BlueZ] adapter: Fix crash on UUID discovery filter match

[Luiz Augusto von Dentz]

Hi Tom,

On Thu, Jul 9, 2026 at 12:21 PM Tom Catshoek <tomcatshoek@zeelandnet.nl> wrote:
>
> On 7/9/26 5:00 PM, Luiz Augusto von Dentz wrote:
> >
> > On Thu, Jul 9, 2026 at 10:39 AM Bastien Nocera <hadess@hadess.net> wrote:
> >> I don't understand why we need match_uuid() though, does it fix a
> >> warning? If so, it might be nice to do in a separate commit (fix the
> >> order first, fix the warning second).
> >
> > That is probably needed since the callback signature/return doesn't
> > match the likes of strcmp.
>
> Exactly, queue_find() wants a queue_match_func_t, which returns a bool,
> and strcmp returns 0 on a match so it needed a wrapper.
>
> Also sorry I wasn't fast enough preparing v2 with the added line
> Fixes: 91c340d359b7 ("shared: Remove glib dependency from
> src/shared/ad.c") Bastien suggested, please let me know if I can still
> do something there.
>
> Thanks guys!

There is a Fixes tag already:

Fixes: https://github.com/bluez/bluez/issues/2282

And that already informs the whole problem, including 91c340d359b7
being the culprit, doesn't it?

-- 
Luiz Augusto von Dentz

Re: [PATCH BlueZ] adapter: Fix crash on UUID discovery filter match

[Tom Catshoek]

On 7/9/26 6:23 PM, Luiz Augusto von Dentz wrote:
> Hi Tom,
> 
> There is a Fixes tag already:
> 
> Fixes: https://github.com/bluez/bluez/issues/2282
> 
> And that already informs the whole problem, including 91c340d359b7
> being the culprit, doesn't it?
> 

True! I was not sure what the right etiquette was, maybe it was
important to have it directly in the commit message for some reason. If
that's not the case, then everything is good!