[PATCH BlueZ 1/2] shared/gatt-db: Always notify service removal

[Gianluca Altomani <altomanigianluca@gmail.com>]

gatt_db_service_destroy() only notified removal listeners about active
services. A gatt-client discovery keeps services that are not active
yet in its pending_svcs queue, and it only drops them from that queue
through this notification. When such a service is destroyed while the
discovery is in flight, for example through gatt_db_clear_range() after
the link drops mid-discovery, the queue is left pointing at freed
memory, and discovery_op_complete() then dereferences it:

  gatt_db_service_get_active (src/shared/gatt-db.c)
  discovery_op_complete (src/shared/gatt-client.c)

Notify removal whether or not the service was active. The other
removal listeners already ignore services they never saw added, since
services are only announced when they become active.

It is reproduced by connecting over LE, reading one characteristic and
disconnecting about once a second, so that the link repeatedly drops
while bluetoothd is still discovering the peer: on 5.72 bluetoothd
crashed on the 15th connection in 4 runs out of 4.

The same change was found independently in
https://github.com/ownback/airpods-bluez-fix.

Assisted-by: Claude:claude-opus-5-5
---
 src/shared/gatt-db.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/shared/gatt-db.c b/src/shared/gatt-db.c
index 751d4c3da..88c8e9e4e 100644
--- a/src/shared/gatt-db.c
+++ b/src/shared/gatt-db.c
@@ -507,8 +507,13 @@ static void gatt_db_service_destroy(void *data)
 	struct gatt_db_service *service = data;
 	int i;
 
-	if (service->active)
-		notify_service_changed(service->db, service, false);
+	/*
+	 * Notify even if the service never became active: gatt-client
+	 * discovery keeps inactive services in its pending list and only
+	 * learns of their removal from this notification, so skipping it
+	 * leaves that list pointing at freed memory.
+	 */
+	notify_service_changed(service->db, service, false);
 
 	for (i = 0; i < service->num_handles; i++)
 		attribute_destroy(service->attributes[i]);
-- 
2.55.0