[PATCH BlueZ v2 0/1] shared/shell: Fix SIGSEGV on invalid input

[PATCH BlueZ v2 0/1] shared/shell: Fix SIGSEGV on invalid input

[Wouter]

I have updated the patch according to feedback received earlier today.
The valgrind input has been attached as a commit message, and checks are
now applied further down the callstack rather than at the source.

--

In `bluetoothctl` when entering a space followed by a tab the CLI
crashes with a segfault. This patch fixes the user input handling.

Wouter (1):
  shared/shell: Fix SIGSEGV on invalid input

 src/shared/shell.c | 6 ++++++
 1 file changed, 6 insertions(+)

-- 
2.53.0

[PATCH BlueZ v2 1/1] shared/shell: Fix SIGSEGV on invalid input

[Wouter]

This fixes a crash when handling "<space><tab>"

==3760495== Invalid read of size 1
==3760495==    at 0x4902187: strcmp (vg_replace_strmem.c:941)
==3760495==    by 0x4067408: menu_completion (shell.c:1126)
==3760495==    by 0x40675DE: shell_completion (shell.c:1177)
==3760495==    by 0x4B267AB: gen_completion_matches (complete.c:1282)
==3760495==    by 0x4B2F8C1: rl_complete_internal (complete.c:2104)
==3760495==    by 0x4B26B52: _rl_dispatch_subseq (readline.c:941)
==3760495==    by 0x4B27B71: readline_internal_char (readline.c:690)
==3760495==    by 0x4B48695: rl_callback_read_char (callback.c:275)
==3760495==    by 0x40655F2: bt_shell_input_line (shell.c:309)
==3760495==    by 0x406577E: input_read (shell.c:343)
==3760495==    by 0x4068CB4: watch_callback (io-glib.c:173)
==3760495==    by 0x49C1F4C: g_main_dispatch (gmain.c:3565)
==3760495==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
---
 src/shared/shell.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/shared/shell.c b/src/shared/shell.c
index b061f8001..87a8a310d 100644
--- a/src/shared/shell.c
+++ b/src/shared/shell.c
@@ -1122,6 +1122,9 @@ static char **menu_completion(const struct bt_shell_menu_entry *entry,
 {
 	char **matches = NULL;
 
+	if (argc == 0)
+		return NULL;
+
 	for (; entry->cmd; entry++) {
 		if (strcmp(entry->cmd, input_cmd))
 			continue;
@@ -1147,6 +1150,9 @@ static char **submenu_completion(const char *text, int argc, char *input_cmd)
 	if (data.main != data.menu)
 		return NULL;
 
+	if (!input_cmd)
+		return NULL;
+
 	cmd = strrchr(input_cmd, '.');
 	if (!cmd)
 		return NULL;
-- 
2.53.0

RE: shared/shell: Fix SIGSEGV on invalid input

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1671 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1069318

---Test result---

Test Summary:
CheckPatch                    PENDING   0.44 seconds
GitLint                       PENDING   0.42 seconds
BuildEll                      PASS      21.16 seconds
BluezMake                     PASS      643.79 seconds
MakeCheck                     PASS      18.66 seconds
MakeDistcheck                 PASS      250.30 seconds
CheckValgrind                 PASS      294.96 seconds
CheckSmatch                   WARNING   354.79 seconds
bluezmakeextell               PASS      183.27 seconds
IncrementalBuild              PENDING   0.33 seconds
ScanBuild                     PASS      1032.91 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



https://github.com/bluez/bluez/pull/1975/checks

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v2 0/1] shared/shell: Fix SIGSEGV on invalid input

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 19 Mar 2026 15:14:34 +0100 you wrote:
> I have updated the patch according to feedback received earlier today.
> The valgrind input has been attached as a commit message, and checks are
> now applied further down the callstack rather than at the source.
> 
> --
> 
> In `bluetoothctl` when entering a space followed by a tab the CLI
> crashes with a segfault. This patch fixes the user input handling.
> 
> [...]

Here is the summary with links:
  - [BlueZ,v2,1/1] shared/shell: Fix SIGSEGV on invalid input
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=1436eab1d0e5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

[PATCH BlueZ 1/1] shared/shell: Fix SIGSEGV on invalid input

[Wouter]

This fixes a crash when handling "<space><tab>"
---
 src/shared/shell.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/shared/shell.c b/src/shared/shell.c
index b061f8001..57bba0977 100644
--- a/src/shared/shell.c
+++ b/src/shared/shell.c
@@ -1174,15 +1174,17 @@ static char **shell_completion(const char *text, int start, int end)
 		if (wordexp(rl_line_buffer, &w, WRDE_NOCMD))
 			return NULL;
 
-		matches = menu_completion(default_menu.entries, text,
-						w.we_wordc, w.we_wordv[0]);
-		if (!matches) {
-			matches = menu_completion(data.menu->entries, text,
-							w.we_wordc,
-							w.we_wordv[0]);
-			if (!matches)
-				matches = submenu_completion(text, w.we_wordc,
+		if (w.we_wordc != 0) {
+			matches = menu_completion(default_menu.entries, text,
+							w.we_wordc, w.we_wordv[0]);
+			if (!matches) {
+				matches = menu_completion(data.menu->entries, text,
+								w.we_wordc,
 								w.we_wordv[0]);
+				if (!matches)
+					matches = submenu_completion(text, w.we_wordc,
+									w.we_wordv[0]);
+			}
 		}
 
 		wordfree(&w);
-- 
2.53.0

RE: shared/shell: Fix SIGSEGV on invalid input

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1671 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1068955

---Test result---

Test Summary:
CheckPatch                    PENDING   0.30 seconds
GitLint                       PENDING   0.36 seconds
BuildEll                      PASS      21.23 seconds
BluezMake                     PASS      633.50 seconds
MakeCheck                     PASS      18.51 seconds
MakeDistcheck                 PASS      244.32 seconds
CheckValgrind                 PASS      291.23 seconds
CheckSmatch                   WARNING   352.53 seconds
bluezmakeextell               PASS      181.41 seconds
IncrementalBuild              PENDING   0.31 seconds
ScanBuild                     PASS      1008.74 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h):
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



https://github.com/bluez/bluez/pull/1970/checks

---
Regards,
Linux Bluetooth