[bluez/bluez] 5e5bca: input/hog: Cancel pending report requests on detach

[birddog87 <noreply@github.com>]

  Branch: refs/heads/1170874
  Home:   https://github.com/bluez/bluez
  Commit: 5e5bca93ee19f1097efe6b8bbe799e8abe4219b8
      https://github.com/bluez/bluez/commit/5e5bca93ee19f1097efe6b8bbe799e8abe4219b8
  Author: Nick Hammond <blender7@gmail.com>
  Date:   2026-09-22 (Tue, 22 Sep 2026)

  Changed paths:
    M profiles/input/hog-lib.c

  Log Message:
  -----------
  input/hog: Cancel pending report requests on detach

GET_REPORT and SET_REPORT requests are tracked by getrep_att and
setrep_att rather than gatt_op. Cancelling gatt_op during detach leaves
these callbacks registered on the shared GAttrib connection.

A reply delivered after the HoG object is freed can therefore access a
freed report in get_report_cb or a freed hog in set_report_cb. A long
GET_REPORT read can also retain its callback through a READ_BLOB
continuation. If the HoG object survives detach, the callback can instead
send a stale UHID reply.

Cancel both outstanding requests before releasing attrib and clear their
IDs so a later attachment starts without stale request state.

This was investigated following a bluetoothd crash on Ubuntu BlueZ 5.72
during keyboard reconnection. A socketpair regression reproduces the
use-after-free on current master with AddressSanitizer as well.

Assisted-by: Codex:gpt-6 AddressSanitizer


  Commit: 6286e10b54a581740fe7c974d8da3b488a50a724
      https://github.com/bluez/bluez/commit/6286e10b54a581740fe7c974d8da3b488a50a724
  Author: Nick Hammond <blender7@gmail.com>
  Date:   2026-09-22 (Tue, 22 Sep 2026)

  Changed paths:
    A unit/test-hog-lifetime.c

  Log Message:
  -----------
  unit: Test pending HoG reports across detach

Exercise the real HoG, GAttrib and ATT implementations with socketpairs
for ATT and UHID, without requiring a controller or /dev/uhid.

Cover pending reads, READ_BLOB continuations and writes whose responses
arrive after detach and object destruction. Also check normal completion
and reuse of a surviving object after detach. Keep another GAttrib
reference alive to model the connection shared with other profiles.

Include hog-lib.c to construct a single report and invoke its request
handlers without unrelated service discovery or new production APIs.
The follow-up build change registers this test with make check.

Without the preceding fix, the three teardown cases fail under
AddressSanitizer and the reuse case receives a stale reply. All five
cases pass with the fix and leak detection enabled.

Assisted-by: Codex:gpt-6 AddressSanitizer


  Commit: 8fb194ba6d72dab24450271e8e14972d8ef22318
      https://github.com/bluez/bluez/commit/8fb194ba6d72dab24450271e8e14972d8ef22318
  Author: Nick Hammond <blender7@gmail.com>
  Date:   2026-09-22 (Tue, 22 Sep 2026)

  Changed paths:
    M Makefile.am

  Log Message:
  -----------
  build: Register the HoG report lifetime tests

Build and run test-hog-lifetime with the existing unit test suite. Link
its support sources without a second copy of hog-lib.c, which the test
includes to exercise the private report callbacks.

Assisted-by: Codex:gpt-6 AddressSanitizer


Compare: https://github.com/bluez/bluez/compare/5e5bca93ee19%5E...8fb194ba6d72

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications