From: Pauli Virtanen <noreply@github.com>
To: linux-bluetooth@vger.kernel.org
Subject: [bluez/bluez] 37b825: adapter: clear discovery_found list before discove...
Date: Thu, 03 Sep 2026 16:13:28 -0700 [thread overview]
Message-ID: <bluez/bluez/push/refs/heads/1157432/000000-37b825@github.com> (raw)
Branch: refs/heads/1157432
Home: https://github.com/bluez/bluez
Commit: 37b825c7d0206b7662f3d1663245660f2493bd85
https://github.com/bluez/bluez/commit/37b825c7d0206b7662f3d1663245660f2493bd85
Author: Pauli Virtanen <pav@iki.fi>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
M src/adapter.c
Log Message:
-----------
adapter: clear discovery_found list before discovery_cleanup()
discovery_cleanup() tries to reset RSSI of devices in
adapter->discovery_found list. When called from adapter_remove(), the
list contains only stale pointers as devices have been already freed,
leading to UAF.
Fix by freeing the discovery_found list in adapter_remove().
Fixes AddressSanitizer: heap-use-after-free
READ of size 1 at 0x7d5b585e033d thread T0
#0 0x000000772b1a in device_set_rssi_with_delta src/device.c:7121
#1 0x000000772daa in device_set_rssi src/device.c:7150
#2 0x0000006aa808 in invalidate_rssi_and_tx_power src/adapter.c:1732
#3 0x7feb5a35557f in g_slist_foreach (/lib64/libglib-2.0.so.0+0x6257f)
#4 0x7feb5a355b56 in g_slist_free_full (/lib64/libglib-2.0.so.0+0x62b56)
#5 0x0000006f67d2 in discovery_cleanup src/adapter.c:1747
#6 0x0000006f904f in adapter_remove src/adapter.c:7219
#7 0x0000006f9de2 in adapter_cleanup src/adapter.c:11165
#8 0x000000418ca9 in main src/main.c:1719
freed by thread T0 here:
#0 0x7feb5a5434cf in free.part.0 (/lib64/libasan.so.8+0xee4cf)
#1 0x7feb5a337bb4 in g_free (/lib64/libglib-2.0.so.0+0x44bb4)
#2 0x0000007519d7 in device_free src/device.c:963
previously allocated by thread T0 here:
#0 0x7feb5a54424f in calloc (/lib64/libasan.so.8+0xef24f)
#1 0x000000751fee in device_new src/device.c:4963
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
reply other threads:[~2026-09-03 23:13 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bluez/bluez/push/refs/heads/1157432/000000-37b825@github.com \
--to=noreply@github.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox