[PATCH BlueZ v1] adapter: Fix crash on dev_disconnected

[PATCH BlueZ v1] adapter: Fix crash on dev_disconnected

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Commit 5d836f1c697c ("adapter: Fix failed bonding attempt after LE
link disconnection") introduces a regression since it attempts to
call device_is_connected after adapter_remove_connection which may
free the device causing the following backtrace:

    #0 0x5cd6e384262f in btd_device_bearer_is_connected src/device.c:3754
    #1 0x5cd6e384266f in btd_device_is_connected src/device.c:3745
    #2 0x5cd6e37f8614 in dev_disconnected src/adapter.c:8626

Fixes: https://github.com/bluez/bluez/issues/2221
---
 src/adapter.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/src/adapter.c b/src/adapter.c
index 538f63e0a153..210225243f00 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -7612,12 +7612,16 @@ struct agent *adapter_get_agent(struct btd_adapter *adapter)
 static void adapter_remove_connection(struct btd_adapter *adapter,
 						struct btd_device *device,
 						uint8_t bdaddr_type,
-						uint8_t reason)
+						uint8_t reason,
+						bool *removed)
 {
 	bool remove_device = false;
 
 	DBG("");
 
+	if (removed)
+		*removed = false;
+
 	if (!g_slist_find(adapter->connections, device)) {
 		btd_error(adapter->dev_id, "No matching connection for device");
 		return;
@@ -7638,6 +7642,9 @@ static void adapter_remove_connection(struct btd_adapter *adapter,
 
 		DBG("Removing temporary device %s", path);
 		btd_adapter_remove_device(adapter, device);
+
+		if (removed)
+			*removed = true;
 	}
 }
 
@@ -7665,10 +7672,10 @@ static void adapter_stop(struct btd_adapter *adapter)
 		uint8_t addr_type = btd_device_get_bdaddr_type(device);
 
 		adapter_remove_connection(adapter, device, BDADDR_BREDR,
-						MGMT_DEV_DISCONN_UNKNOWN);
+						MGMT_DEV_DISCONN_UNKNOWN, NULL);
 		if (addr_type != BDADDR_BREDR)
 			adapter_remove_connection(adapter, device, addr_type,
-						MGMT_DEV_DISCONN_UNKNOWN);
+						MGMT_DEV_DISCONN_UNKNOWN, NULL);
 	}
 
 	g_dbus_emit_property_changed(dbus_conn, adapter->path,
@@ -8618,7 +8625,17 @@ static void dev_disconnected(struct btd_adapter *adapter,
 
 	device = btd_adapter_find_device(adapter, &addr->bdaddr, addr->type);
 	if (device) {
-		adapter_remove_connection(adapter, device, addr->type, reason);
+		bool removed;
+
+		adapter_remove_connection(adapter, device, addr->type, reason,
+						&removed);
+		/* No need to continue if device was removed from the adapter,
+		 * as it will be freed and the disconnect notify will be called
+		 * in the device free callback.
+		 */
+		if (removed)
+			return;
+
 		disconnect_notify(device, reason);
 	}
 
-- 
2.54.0

RE: [BlueZ,v1] adapter: Fix crash on dev_disconnected

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 825 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1120587

---Test result---

Test Summary:
CheckPatch                    PASS      0.34 seconds
GitLint                       PASS      0.23 seconds
BuildEll                      PASS      21.00 seconds
BluezMake                     PASS      544.95 seconds
CheckSmatch                   PASS      312.22 seconds
bluezmakeextell               PASS      101.33 seconds
IncrementalBuild              PASS      539.68 seconds
ScanBuild                     PASS      962.30 seconds



https://github.com/bluez/bluez/pull/2264

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v1] adapter: Fix crash on dev_disconnected

[Frédéric Danis]

Hi Luiz,

On 02/07/2026 17:50, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> Commit 5d836f1c697c ("adapter: Fix failed bonding attempt after LE
> link disconnection") introduces a regression since it attempts to
> call device_is_connected after adapter_remove_connection which may
> free the device causing the following backtrace:
>
>      #0 0x5cd6e384262f in btd_device_bearer_is_connected src/device.c:3754
>      #1 0x5cd6e384266f in btd_device_is_connected src/device.c:3745
>      #2 0x5cd6e37f8614 in dev_disconnected src/adapter.c:8626
>
> Fixes: https://github.com/bluez/bluez/issues/2221
> ---
>   src/adapter.c | 25 +++++++++++++++++++++----
>   1 file changed, 21 insertions(+), 4 deletions(-)
>
> diff --git a/src/adapter.c b/src/adapter.c
> index 538f63e0a153..210225243f00 100644
> --- a/src/adapter.c
> +++ b/src/adapter.c
> @@ -7612,12 +7612,16 @@ struct agent *adapter_get_agent(struct btd_adapter *adapter)
>   static void adapter_remove_connection(struct btd_adapter *adapter,
>   						struct btd_device *device,
>   						uint8_t bdaddr_type,
> -						uint8_t reason)
> +						uint8_t reason,
> +						bool *removed)
>   {
>   	bool remove_device = false;
>   
>   	DBG("");
>   
> +	if (removed)
> +		*removed = false;
> +
>   	if (!g_slist_find(adapter->connections, device)) {
>   		btd_error(adapter->dev_id, "No matching connection for device");
>   		return;
> @@ -7638,6 +7642,9 @@ static void adapter_remove_connection(struct btd_adapter *adapter,
>   
>   		DBG("Removing temporary device %s", path);
>   		btd_adapter_remove_device(adapter, device);
> +
> +		if (removed)
> +			*removed = true;
>   	}
>   }
>   
> @@ -7665,10 +7672,10 @@ static void adapter_stop(struct btd_adapter *adapter)
>   		uint8_t addr_type = btd_device_get_bdaddr_type(device);
>   
>   		adapter_remove_connection(adapter, device, BDADDR_BREDR,
> -						MGMT_DEV_DISCONN_UNKNOWN);
> +						MGMT_DEV_DISCONN_UNKNOWN, NULL);
>   		if (addr_type != BDADDR_BREDR)
>   			adapter_remove_connection(adapter, device, addr_type,
> -						MGMT_DEV_DISCONN_UNKNOWN);
> +						MGMT_DEV_DISCONN_UNKNOWN, NULL);
>   	}
>   
>   	g_dbus_emit_property_changed(dbus_conn, adapter->path,
> @@ -8618,7 +8625,17 @@ static void dev_disconnected(struct btd_adapter *adapter,
>   
>   	device = btd_adapter_find_device(adapter, &addr->bdaddr, addr->type);
>   	if (device) {
> -		adapter_remove_connection(adapter, device, addr->type, reason);
> +		bool removed;
> +
> +		adapter_remove_connection(adapter, device, addr->type, reason,
> +						&removed);
> +		/* No need to continue if device was removed from the adapter,
> +		 * as it will be freed and the disconnect notify will be called
> +		 * in the device free callback.
> +		 */
> +		if (removed)
> +			return;
> +
>   		disconnect_notify(device, reason);
>   	}
>   

I tested this and crash is fixed.

Frédéric Danis

-- 
Frédéric Danis
Senior Software Engineer

Collabora Ltd.
Platinum Building, St John's Innovation Park, Cambridge CB4 0DS, United Kingdom
Registered in England & Wales, no. 5513718