[PATCH BlueZ] advertising: Fix leaking clients that exit while registering

[Kevin Dewald <kevin@simpleble.org>]

RegisterAdvertisement allocates an instance and adds the client to the
list ActiveInstances counts, but only watches for the client
disconnecting once the advertisement has been added. A client that goes
away before that, for example one that never answers GetAll on its
advertisement object, is never removed, and its instance stays
allocated until bluetoothd restarts. Once all instances have leaked,
every registration fails with "Maximum advertisements reached".

Watch for the disconnection when registering instead, and clear the
watch on the registration failure paths, which free the client from an
idle callback.

Closes: https://github.com/bluez/bluez/issues/969
Fixes: cf99200d1505 ("core/advertising: Implement RegisterAdvertisement")
Assisted-by: Claude:claude-opus-5.5
---
Reproduced with a functional test that kills a client while it is
registering an advertisement: on master, ActiveInstances stays at 1
after the client exits (3 of 3 runs); with this patch it goes back to 0
(5 of 5). I can send the test as well if you want it.

 src/advertising.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/advertising.c b/src/advertising.c
index 1ed09c902..5c929d6c2 100644
--- a/src/advertising.c
+++ b/src/advertising.c
@@ -1388,6 +1388,7 @@ static void add_client_complete(struct btd_adv_client *client, uint8_t status)
 		reply = btd_error_failed(client->reg,
 					"Failed to register advertisement");
 		queue_remove(client->manager->clients, client);
+		g_dbus_client_set_disconnect_watch(client->client, NULL, NULL);
 		g_idle_add(client_free_idle_cb, client);
 
 	} else {
@@ -1427,8 +1428,6 @@ static void add_adv_callback(uint8_t status, uint16_t length,
 
 	client->instance = rp->instance;
 
-	g_dbus_client_set_disconnect_watch(client->client, client_disconnect_cb,
-									client);
 	DBG("Advertisement registered: %s", client->path);
 
 	g_dbus_emit_property_changed(btd_get_dbus_connection(),
@@ -1641,6 +1640,7 @@ static void client_proxy_added(GDBusProxy *proxy, void *data)
 
 	/* Failed to publish for some reason, remove. */
 	queue_remove(client->manager->clients, client);
+	g_dbus_client_set_disconnect_watch(client->client, NULL, NULL);
 
 	g_idle_add(client_free_idle_cb, client);
 
@@ -1757,6 +1757,9 @@ static DBusMessage *register_advertisement(DBusConnection *conn,
 
 	queue_push_tail(manager->clients, client);
 
+	g_dbus_client_set_disconnect_watch(client->client, client_disconnect_cb,
+									client);
+
 	return NULL;
 }
 

base-commit: b0bf49270d445da0852851f393cd67a0a1e5f05e
-- 
2.54.0 (Apple Git-157)