From: Luiz Augusto von Dentz <noreply@github.com>
To: linux-bluetooth@vger.kernel.org
Subject: [bluez/bluez] 229d41: bthost: Fix crash on bthost_past_set_info
Date: Thu, 30 Oct 2025 15:32:24 -0700 [thread overview]
Message-ID: <bluez/bluez/push/refs/heads/master/f80a2a-32d740@github.com> (raw)
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: 229d411e5a71486e62a13365dfc0049a3d930f62
https://github.com/bluez/bluez/commit/229d411e5a71486e62a13365dfc0049a3d930f62
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2025-10-30 (Thu, 30 Oct 2025)
Changed paths:
M emulator/bthost.c
Log Message:
-----------
bthost: Fix crash on bthost_past_set_info
This fixes the following crash:
Invalid read of size 1
at 0x401DEFE: send_command (bthost.c:1101)
by 0x4021F01: bthost_past_set_info (bthost.c:3758)
by 0x4006038: test_listen_past (iso-tester.c:3246)
by 0x494984A: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x4943862: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x494C7A7: ??? (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x494CA4E: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.8400.4)
by 0x402CC4D: mainloop_run (mainloop-glib.c:65)
by 0x402D224: mainloop_run_with_signal (mainloop-notify.c:196)
by 0x402C445: tester_run (tester.c:1084)
by 0x4005609: main (iso-tester.c:4335)
Address 0x40 is not stack'd, malloc'd or (recently) free'd
Commit: bb82243a6c27d0a0890005eddbea3a6c54b558b8
https://github.com/bluez/bluez/commit/bb82243a6c27d0a0890005eddbea3a6c54b558b8
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2025-10-30 (Thu, 30 Oct 2025)
Changed paths:
M emulator/btdev.c
Log Message:
-----------
btdev: Fix crash on BIG cleanup
This fixes the following crash:
Invalid read of size 8
at 0x400F26F: le_big_free (btdev.c:606)
by 0x4024636: queue_remove_all (queue.c:341)
by 0x40246C2: queue_destroy (queue.c:60)
by 0x401B7C9: btdev_destroy (btdev.c:7820)
by 0x400CFBF: hciemu_client_destroy (hciemu.c:301)
by 0x4024636: queue_remove_all (queue.c:341)
by 0x40246C2: queue_destroy (queue.c:60)
by 0x400DA91: hciemu_unref (hciemu.c:441)
by 0x40072F2: test_post_teardown (iso-tester.c:701)
by 0x402BB0A: tester_teardown_complete (tester.c:713)
by 0x402BB41: default_teardown (tester.c:266)
by 0x402B43B: teardown_callback (tester.c:434)
Commit: 1479b279a016a515aee4fc7fc79fc7bcb229b4cb
https://github.com/bluez/bluez/commit/1479b279a016a515aee4fc7fc79fc7bcb229b4cb
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2025-10-30 (Thu, 30 Oct 2025)
Changed paths:
M monitor/bt.h
M monitor/packet.c
Log Message:
-----------
monitor: Add decoding support for LL Extended Feature Set
This adds support for decoding LL Extended Feature Set introduced in 6.0
that adds the following:
Commands:
- HCI_LE_Read_All_Local_Supported_Features(0x2087)(Feature:47,1)
- HCI_LE_Read_All_Remote_Features(0x2088)(Feature:47,2)
Events:
- HCI_LE_Read_All_Remote_Features_Complete(0x2b)(Mask bit:42)
Commit: 32d740d87970fa476644aeea267663ea3c74644a
https://github.com/bluez/bluez/commit/32d740d87970fa476644aeea267663ea3c74644a
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2025-10-30 (Thu, 30 Oct 2025)
Changed paths:
M monitor/bt.h
M monitor/ll.c
M monitor/packet.c
M monitor/packet.h
Log Message:
-----------
monitor: Add decoding support for LL_FEATURE_EXT_{REQ,RSP}
This adds support for LL_FEATURE_EXT_{REQ,RSP} which is used to
exchange LL Features.
Compare: https://github.com/bluez/bluez/compare/f80a2a57c910...32d740d87970
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
reply other threads:[~2025-10-30 22:32 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bluez/bluez/push/refs/heads/master/f80a2a-32d740@github.com \
--to=noreply@github.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).