[bluez/bluez] ab6c9f: emulator: btdev: fix inquiry_timeout() inquiry des...

[bluez/bluez] ab6c9f: emulator: btdev: fix inquiry_timeout() inquiry des...

[Pauli Virtanen]

  Branch: refs/heads/1157383
  Home:   https://github.com/bluez/bluez
  Commit: ab6c9f110d1d52a7b2f4cf5edc725b3b3ed876c2
      https://github.com/bluez/bluez/commit/ab6c9f110d1d52a7b2f4cf5edc725b3b3ed876c2
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-09-03 (Thu, 03 Sep 2026)

  Changed paths:
    M emulator/btdev.c

  Log Message:
  -----------
  emulator: btdev: fix inquiry_timeout() inquiry destroy

inquiry_timeout() removes inquiry_id callback, whose destroy removes
inquiry_timeout_id callback. Doing this from the callback itself frees
timeout-mainloop.c timeout data under it, leading to crash.

Fix by setting btdev->inquiry_timeout_id = 0 first to avoid the early
free.

Fixes ERROR: AddressSanitizer: heap-use-after-free
READ of size 4 at 0x7b9d9cfe0310 thread T0
    #0 0x00000049ebbe in timeout_callback src/shared/timeout-mainloop.c:33
    #1 0x00000049f270 in timeout_callback src/shared/mainloop.c:245
    #2 0x00000049fbbb in mainloop_run src/shared/mainloop.c:104
    #3 0x0000004a286f in mainloop_run_with_signal src/shared/mainloop-notify.c:196
    #4 0x000000402a66 in main emulator/main.c:261

freed by thread T0 here:
    #0 0x7f7a5e6ee4cf in free.part.0 (/lib64/libasan.so.8+0xee4cf)
    #1 0x00000049f591 in timeout_destroy src/shared/mainloop.c:226

previously allocated by thread T0 here:
    #0 0x7f7a5e6ef41f in malloc (/lib64/libasan.so.8+0xef41f)
    #1 0x00000049158a in util_malloc src/shared/util.c:46



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications