[PATCH BlueZ] emulator: btdev: fix inquiry_timeout() inquiry destroy

[PATCH BlueZ] emulator: btdev: fix inquiry_timeout() inquiry destroy

[Pauli Virtanen]

inquiry_timeout() removes inquiry_id callback, whose destroy removes
inquiry_timeout_id callback. Doing this from the callback itself frees
timeout-mainloop.c timeout data under it, leading to crash.

Fix by setting btdev->inquiry_timeout_id = 0 first to avoid the early
free.

Fixes ERROR: AddressSanitizer: heap-use-after-free
READ of size 4 at 0x7b9d9cfe0310 thread T0
    #0 0x00000049ebbe in timeout_callback src/shared/timeout-mainloop.c:33
    #1 0x00000049f270 in timeout_callback src/shared/mainloop.c:245
    #2 0x00000049fbbb in mainloop_run src/shared/mainloop.c:104
    #3 0x0000004a286f in mainloop_run_with_signal src/shared/mainloop-notify.c:196
    #4 0x000000402a66 in main emulator/main.c:261

freed by thread T0 here:
    #0 0x7f7a5e6ee4cf in free.part.0 (/lib64/libasan.so.8+0xee4cf)
    #1 0x00000049f591 in timeout_destroy src/shared/mainloop.c:226

previously allocated by thread T0 here:
    #0 0x7f7a5e6ef41f in malloc (/lib64/libasan.so.8+0xef41f)
    #1 0x00000049158a in util_malloc src/shared/util.c:46
---
 emulator/btdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/emulator/btdev.c b/emulator/btdev.c
index a53bd8252..bb4d55e74 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -1104,8 +1104,8 @@ static bool inquiry_timeout(void *user_data)
 	struct btdev *btdev = data->btdev;
 	struct bt_hci_evt_inquiry_complete ic;
 
-	timeout_remove(btdev->inquiry_id);
 	btdev->inquiry_timeout_id = 0;
+	timeout_remove(btdev->inquiry_id);
 
 	/* Inquiry is stopped, send Inquiry complete event. */
 	ic.status = BT_HCI_ERR_SUCCESS;
-- 
2.55.0

RE: [BlueZ] emulator: btdev: fix inquiry_timeout() inquiry destroy

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2223 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1157383

---Test result---

Test Summary:
CheckPatch                    FAIL      0.39 seconds
GitLint                       FAIL      0.28 seconds
BuildEll                      PASS      20.19 seconds
BluezMake                     PASS      539.78 seconds
CheckSmatch                   WARNING   306.79 seconds
bluezmakeextell               PASS      96.33 seconds
IncrementalBuild              PASS      539.92 seconds
ScanBuild                     PASS      881.20 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[BlueZ] emulator: btdev: fix inquiry_timeout() inquiry destroy
WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#93: 
    #3 0x0000004a286f in mainloop_run_with_signal src/shared/mainloop-notify.c:196

/github/workspace/src/patch/14788574.patch total: 0 errors, 1 warnings, 9 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14788574.patch has style problems, please review.

NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ] emulator: btdev: fix inquiry_timeout() inquiry destroy

15: B1 Line exceeds max length (82>80): "    #3 0x0000004a286f in mainloop_run_with_signal src/shared/mainloop-notify.c:196"
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
emulator/btdev.c:478:29: warning: Variable length array is used.


https://github.com/bluez/bluez/pull/2488

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] emulator: btdev: fix inquiry_timeout() inquiry destroy

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  3 Sep 2026 23:21:17 +0300 you wrote:
> inquiry_timeout() removes inquiry_id callback, whose destroy removes
> inquiry_timeout_id callback. Doing this from the callback itself frees
> timeout-mainloop.c timeout data under it, leading to crash.
> 
> Fix by setting btdev->inquiry_timeout_id = 0 first to avoid the early
> free.
> 
> [...]

Here is the summary with links:
  - [BlueZ] emulator: btdev: fix inquiry_timeout() inquiry destroy
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=e271e0adae50

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html