[PATCH v1] gobex: Fix use-after-free when cancelling SRM PUT transfer

[PATCH v1] gobex: Fix use-after-free when cancelling SRM PUT transfer

[Rahul Samana]

In SRM mode put_get_data() queues the next packet during encoding of
the current one, so transfer->req_id and pending_req->id can diverge.
When g_obex_cancel_transfer() cancels the queued packet from tx_queue,
cancel_complete() frees the transfer while pending_req still holds a
callback pointing to it. Its G_OBEX_DEFAULT_TIMEOUT (10s) then fires
on freed memory causing a SIGSEGV.

Fix by clearing pending_req->rsp_func if it belongs to the same
transfer being cancelled.

Signed-off-by: Rahul Samana <rahul.samana@oss.qualcomm.com>
---
 gobex/gobex.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/gobex/gobex.c b/gobex/gobex.c
index df80d79f3..10a438391 100644
--- a/gobex/gobex.c
+++ b/gobex/gobex.c
@@ -861,6 +861,14 @@ gboolean g_obex_cancel_req(GObex *obex, guint req_id, gboolean remove_callback)
 
 	g_queue_delete_link(obex->tx_queue, match);
 
+	/* In SRM mode pending_req may belong to the same transfer but carry
+	 * a different req_id. Clear its callback to avoid use-after-free
+	 * when its timeout fires after transfer_free().
+	 */
+	if (remove_callback && obex->pending_req &&
+				obex->pending_req->rsp_data == p->rsp_data)
+		obex->pending_req->rsp_func = NULL;
+
 immediate_completion:
 	p->cancelled = TRUE;
 	p->obex = g_obex_ref(obex);
-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project

RE: [v1] gobex: Fix use-after-free when cancelling SRM PUT transfer

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 987 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1122826

---Test result---

Test Summary:
CheckPatch                    PASS      0.26 seconds
GitLint                       PASS      0.17 seconds
BuildEll                      PASS      17.73 seconds
BluezMake                     PASS      606.95 seconds
MakeCheck                     PASS      2.51 seconds
MakeDistcheck                 PASS      140.04 seconds
CheckValgrind                 PASS      143.74 seconds
CheckSmatch                   PASS      263.18 seconds
bluezmakeextell               PASS      91.87 seconds
IncrementalBuild              PASS      622.59 seconds
ScanBuild                     PASS      834.49 seconds



https://github.com/bluez/bluez/pull/2275

---
Regards,
Linux Bluetooth

Re: [PATCH v1] gobex: Fix use-after-free when cancelling SRM PUT transfer

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue,  7 Jul 2026 12:05:43 +0530 you wrote:
> In SRM mode put_get_data() queues the next packet during encoding of
> the current one, so transfer->req_id and pending_req->id can diverge.
> When g_obex_cancel_transfer() cancels the queued packet from tx_queue,
> cancel_complete() frees the transfer while pending_req still holds a
> callback pointing to it. Its G_OBEX_DEFAULT_TIMEOUT (10s) then fires
> on freed memory causing a SIGSEGV.
> 
> [...]

Here is the summary with links:
  - [v1] gobex: Fix use-after-free when cancelling SRM PUT transfer
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=9e9f0a370c59

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html