[bluez/bluez] bce86b: adapter: remove the devices from the list before f...

[bluez/bluez] bce86b: adapter: remove the devices from the list before f...

[Luiz Augusto von Dentz]

  Branch: refs/heads/1169029
  Home:   https://github.com/bluez/bluez
  Commit: bce86bc9645e31c6c20b9e2d58337cbdec689811
      https://github.com/bluez/bluez/commit/bce86bc9645e31c6c20b9e2d58337cbdec689811
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-09-18 (Fri, 18 Sep 2026)

  Changed paths:
    M src/adapter.c

  Log Message:
  -----------
  adapter: remove the devices from the list before freeing them

The devices of an adapter are freed one by one when it is removed, but
the list keeps pointing at them until every one of them is gone, so it
refers to freed devices while the remaining ones are being removed.

Freeing a device looks devices up though, e.g. cleaning up its GATT
server reports the disconnection, which searches the list for the
device it belongs to, and the search reads the devices already freed:

  ERROR: AddressSanitizer: heap-use-after-free
    in bacmp lib/bluetooth/bluetooth.h:438
    in device_addr_type_cmp src/device.c:5657
    in btd_adapter_find_device src/adapter.c:1055
    in att_disconnected src/gatt-database.c:335
    in gatt_server_cleanup src/device.c:842
    in device_free src/device.c:918

Take each device out of the list before removing it, so only the ones
still to be removed are ever found.

This needs more than one device on the adapter to show up, which the
test of a coordinated set is the first to leave behind.

Assisted-by: opencode:claude-opus-5



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications