[PATCH BlueZ] advertising: Fix leaking clients that exit while registering

[PATCH BlueZ] advertising: Fix leaking clients that exit while registering

[Kevin Dewald]

RegisterAdvertisement allocates an instance and adds the client to the
list ActiveInstances counts, but only watches for the client
disconnecting once the advertisement has been added. A client that goes
away before that, for example one that never answers GetAll on its
advertisement object, is never removed, and its instance stays
allocated until bluetoothd restarts. Once all instances have leaked,
every registration fails with "Maximum advertisements reached".

Watch for the disconnection when registering instead, and clear the
watch on the registration failure paths, which free the client from an
idle callback.

Closes: https://github.com/bluez/bluez/issues/969
Fixes: cf99200d1505 ("core/advertising: Implement RegisterAdvertisement")
Assisted-by: Claude:claude-opus-5.5
---
Reproduced with a functional test that kills a client while it is
registering an advertisement: on master, ActiveInstances stays at 1
after the client exits (3 of 3 runs); with this patch it goes back to 0
(5 of 5). I can send the test as well if you want it.

 src/advertising.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/advertising.c b/src/advertising.c
index 1ed09c902..5c929d6c2 100644
--- a/src/advertising.c
+++ b/src/advertising.c
@@ -1388,6 +1388,7 @@ static void add_client_complete(struct btd_adv_client *client, uint8_t status)
 		reply = btd_error_failed(client->reg,
 					"Failed to register advertisement");
 		queue_remove(client->manager->clients, client);
+		g_dbus_client_set_disconnect_watch(client->client, NULL, NULL);
 		g_idle_add(client_free_idle_cb, client);
 
 	} else {
@@ -1427,8 +1428,6 @@ static void add_adv_callback(uint8_t status, uint16_t length,
 
 	client->instance = rp->instance;
 
-	g_dbus_client_set_disconnect_watch(client->client, client_disconnect_cb,
-									client);
 	DBG("Advertisement registered: %s", client->path);
 
 	g_dbus_emit_property_changed(btd_get_dbus_connection(),
@@ -1641,6 +1640,7 @@ static void client_proxy_added(GDBusProxy *proxy, void *data)
 
 	/* Failed to publish for some reason, remove. */
 	queue_remove(client->manager->clients, client);
+	g_dbus_client_set_disconnect_watch(client->client, NULL, NULL);
 
 	g_idle_add(client_free_idle_cb, client);
 
@@ -1757,6 +1757,9 @@ static DBusMessage *register_advertisement(DBusConnection *conn,
 
 	queue_push_tail(manager->clients, client);
 
+	g_dbus_client_set_disconnect_watch(client->client, client_disconnect_cb,
+									client);
+
 	return NULL;
 }
 

base-commit: b0bf49270d445da0852851f393cd67a0a1e5f05e
-- 
2.54.0 (Apple Git-157)

RE: [BlueZ] advertising: Fix leaking clients that exit while registering

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1222 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1194268/

---Test result---

Test Summary:
CheckPatch                    PASS      0.35 seconds
GitLint                       PASS      0.25 seconds
BuildEll                      PASS      13.15 seconds
BluezMake                     PASS      170.17 seconds
CheckSmatch                   WARNING   171.41 seconds
bluezmakeextell               PASS      58.38 seconds
TestFunctional                PASS      809.77 seconds
IncrementalBuild              PASS      177.82 seconds
ScanBuild                     PASS      584.87 seconds

Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/advertising.c: note: in included file:./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capabilitysrc/advertising.c: note: in included file:./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability


https://github.com/bluez/bluez/pull/2718

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] advertising: Fix leaking clients that exit while registering

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 26 Oct 2026 22:12:06 -0700 you wrote:
> RegisterAdvertisement allocates an instance and adds the client to the
> list ActiveInstances counts, but only watches for the client
> disconnecting once the advertisement has been added. A client that goes
> away before that, for example one that never answers GetAll on its
> advertisement object, is never removed, and its instance stays
> allocated until bluetoothd restarts. Once all instances have leaked,
> every registration fails with "Maximum advertisements reached".
> 
> [...]

Here is the summary with links:
  - [BlueZ] advertising: Fix leaking clients that exit while registering
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=0d57c12f5aca

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html