[bluez/bluez] 37b825: adapter: clear discovery_found list before discove...

[bluez/bluez] 37b825: adapter: clear discovery_found list before discove...

[Pauli Virtanen]

  Branch: refs/heads/1157432
  Home:   https://github.com/bluez/bluez
  Commit: 37b825c7d0206b7662f3d1663245660f2493bd85
      https://github.com/bluez/bluez/commit/37b825c7d0206b7662f3d1663245660f2493bd85
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-09-03 (Thu, 03 Sep 2026)

  Changed paths:
    M src/adapter.c

  Log Message:
  -----------
  adapter: clear discovery_found list before discovery_cleanup()

discovery_cleanup() tries to reset RSSI of devices in
adapter->discovery_found list.  When called from adapter_remove(), the
list contains only stale pointers as devices have been already freed,
leading to UAF.

Fix by freeing the discovery_found list in adapter_remove().

Fixes AddressSanitizer: heap-use-after-free
READ of size 1 at 0x7d5b585e033d thread T0
    #0 0x000000772b1a in device_set_rssi_with_delta src/device.c:7121
    #1 0x000000772daa in device_set_rssi src/device.c:7150
    #2 0x0000006aa808 in invalidate_rssi_and_tx_power src/adapter.c:1732
    #3 0x7feb5a35557f in g_slist_foreach (/lib64/libglib-2.0.so.0+0x6257f)
    #4 0x7feb5a355b56 in g_slist_free_full (/lib64/libglib-2.0.so.0+0x62b56)
    #5 0x0000006f67d2 in discovery_cleanup src/adapter.c:1747
    #6 0x0000006f904f in adapter_remove src/adapter.c:7219
    #7 0x0000006f9de2 in adapter_cleanup src/adapter.c:11165
    #8 0x000000418ca9 in main src/main.c:1719

freed by thread T0 here:
    #0 0x7feb5a5434cf in free.part.0 (/lib64/libasan.so.8+0xee4cf)
    #1 0x7feb5a337bb4 in g_free (/lib64/libglib-2.0.so.0+0x44bb4)
    #2 0x0000007519d7 in device_free src/device.c:963

previously allocated by thread T0 here:
    #0 0x7feb5a54424f in calloc (/lib64/libasan.so.8+0xef24f)
    #1 0x000000751fee in device_new src/device.c:4963



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications