Re: [PATCH BlueZ] adapter: Fix crash on UUID discovery filter match

[Bastien Nocera <hadess@hadess.net>]

On Thu, 2026-07-09 at 14:27 +0200, Tom Catshoek wrote:
> is_filter_match() looks up each discovery-filter UUID in the queue of
> services parsed from a device advertisement. When that services list
> was
> migrated from a GSList to a struct queue, the queue_find() call kept
> GLib's g_slist_find_custom() argument order, passing the UUID string
> where queue_find() expects a match function and the comparison
> function
> where it expects the match data.
> 
> As a result queue_find() calls the UUID string as if it were a
> function,
> jumping into non-executable heap and crashing bluetoothd with SIGSEGV
> as
> soon as an advertisement matches a UUID filter configured via
> SetDiscoveryFilter.
> 
> Add a queue_match_func_t helper and pass the arguments in the correct
> order.

That'd be my fault, can you please add:
Fixes: 91c340d359b7 ("shared: Remove glib dependency from src/shared/ad.c")
to the commit mesage.

I checked the other queue_find() change in the same commit, and the
args were reordered correctly.

I don't understand why we need match_uuid() though, does it fix a
warning? If so, it might be nice to do in a separate commit (fix the
order first, fix the warning second).

> 
> Fixes: https://github.com/bluez/bluez/issues/2282
> ---
>  src/adapter.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/src/adapter.c b/src/adapter.c
> index 210225243..4ffa32a52 100644
> --- a/src/adapter.c
> +++ b/src/adapter.c
> @@ -7184,6 +7184,14 @@ static void adapter_msd_notify(struct
> btd_adapter *adapter,
>  	}
>  }
>  
> +static bool match_uuid(const void *data, const void *match_data)
> +{
> +	const char *uuid = data;
> +	const char *match = match_data;
> +
> +	return strcmp(uuid, match) == 0;
> +}
> +
>  static bool is_filter_match(GSList *discovery_filter, struct
> eir_data *eir_data,
>  								int8
> _t rssi)
>  {
> @@ -7216,8 +7224,7 @@ static bool is_filter_match(GSList
> *discovery_filter, struct eir_data *eir_data,
>  				 * uuid.
>  				 */
>  				if (queue_find(eir_data->services,
> -							m->data,
> -							g_strcmp) !=
> NULL)
> +							match_uuid,
> m->data))
>  					got_match = true;
>  			}
>  		}