[PATCH BlueZ v6 13/23] shared/gatt-client: Fix calling idle callbacks again while notifying

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The idle callbacks are called while being removed from the queue, so if
one of them makes the client idle again, e.g. if a request it sends
fails right away, they are called again while the queue is being
iterated, corrupting it:

 Invalid read of size 8
    at queue_remove_if (queue.c:285)
    by queue_remove_all (queue.c:321)
    by notify_client_idle (gatt-client.c:187)
    ...
  Address is 8 bytes inside a block of size 16 free'd
    at free
    by queue_remove_if (queue.c:292)
    by queue_remove_all (queue.c:321)
    by notify_client_idle (gatt-client.c:187)
    by request_unref (gatt-client.c:206)
    by bt_gatt_client_read_long_value (gatt-client.c:3140)

Detach the callbacks from the client before calling them.

Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index b3bc62220e16..5135283e4526 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -180,11 +180,21 @@ bt_gatt_client_ref_safe(struct bt_gatt_client *client)
 
 static void notify_client_idle(struct bt_gatt_client *client)
 {
+	struct queue *idle_cbs;
+
 	client = bt_gatt_client_ref_safe(client);
 	if (!client)
 		return;
 
-	queue_remove_all(client->idle_cbs, idle_notify, NULL, idle_destroy);
+	/* Detach the callbacks before calling them, as a callback may make
+	 * the client idle again, e.g. if a request it sends fails right away,
+	 * which would otherwise call them again while being removed.
+	 */
+	idle_cbs = client->idle_cbs;
+	client->idle_cbs = queue_new();
+
+	queue_remove_all(idle_cbs, idle_notify, NULL, idle_destroy);
+	queue_destroy(idle_cbs, NULL);
 
 	bt_gatt_client_unref(client);
 }
-- 
2.55.0