[PATCH BlueZ 0/2] Fix use-after-free in GATT client discovery

[Gianluca Altomani <altomanigianluca@gmail.com>]

bluetoothd crashes in discovery_op_complete() when a discovery of a
connected peer's GATT database is cut short, e.g. because the link
drops mid-discovery. Two separate bugs leave a freed service in the
discovery's pending_svcs queue, and each patch fixes one of them.

It reproduces by connecting over LE, reading one characteristic and
disconnecting about once a second, with a peer that answers the
remote's GATT discovery. Each connection is short enough that the
remote's discovery of the peer is still running when the link drops.
On 5.72 bluetoothd crashed on the 15th connection in 4 runs out of 4.
With both patches it survived 381 connections in a row. On 5.83, 50
such connections crashed the unpatched daemon within the first minute
and pass with both patches.

Gianluca Altomani (2):
  shared/gatt-db: Always notify service removal
  shared/gatt-client: Fix double-queued service

 src/shared/gatt-client.c | 10 ++++++++--
 src/shared/gatt-db.c     |  9 +++++++--
 2 files changed, 15 insertions(+), 4 deletions(-)

-- 
2.55.0