[bluez/bluez] 07c44f: gatt-client: Fix use-after-free caused by reentran...

[bluez/bluez] 07c44f: gatt-client: Fix use-after-free caused by reentran...

[github-actions[bot]]

  Branch: refs/heads/1087435
  Home:   https://github.com/bluez/bluez
  Commit: 07c44f7b5232fc39c0dbad1e351210daac0c77db
      https://github.com/bluez/bluez/commit/07c44f7b5232fc39c0dbad1e351210daac0c77db
  Author: Jinwang Li <jinwang.li@oss.qualcomm.com>
  Date:   2026-04-29 (Wed, 29 Apr 2026)

  Changed paths:
    M src/gatt-client.c

  Log Message:
  -----------
  gatt-client: Fix use-after-free caused by reentrant client teardown

btd_gatt_client_service_removed() can be called reentrantly via
bt_gatt_client_unref() after the services queue has already been freed,
resulting in a use-after-free.

Reset client->ready to false before destroying the services queue to
prevent reentrant calls from dereferencing freed memory.

This was found with the following backtrace:

    #0  match_service_handle ()
    #1  queue_remove_if ()
    #2  queue_remove_all ()
    #3  btd_gatt_client_service_removed ()
    #4  gatt_service_removed ()
    #5  handle_notify ()
    #6  queue_foreach ()
    #7  notify_service_changed ()
    #8  gatt_db_service_destroy ()
    #9  queue_remove_all ()
    #10 gatt_db_clear_range ()
    #11 service_changed_failure ()
    #12 discovery_op_unref ()
    #13 bt_gatt_request_unref ()
    #14 bt_gatt_client_cancel_all ()
    #15 bt_gatt_client_free ()
    #16 bt_gatt_client_unref ()
    #17 bt_gatt_client_free ()
    #18 bt_gatt_client_unref ()
    #19 btd_gatt_client_destroy ()
    #20 device_free ()

Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications