Branch: refs/heads/975818 Home: https://github.com/bluez/bluez Commit: c9acde78c668eaf28a41d58926031c3c02c8602f https://github.com/bluez/bluez/commit/c9acde78c668eaf28a41d58926031c3c02c8602f Author: Andreas Kemnade <andreas@xxxxxxxxxxxx> Date: 2025-06-25 (Wed, 25 Jun 2025) Changed paths: M src/gatt-client.c Log Message: ----------- gatt-client: avoid UAF after acquire notify failure If a disconnect happens during AcquireNotify dbus calls, a lot of debris is left over. Subsequent calls to AcquireNotify will return NotPermitted and StopNotify leads to an UAF, crashing bluetoothd. Fix that by also clean up the socket stuff on failure. This was provoked by putting the device into some RF shielding bag and open and close it quickly. Valgrind output: bluetoothd[26032]: [:1.126:method_call] > org.bluez.GattCharacteristic1.AcquireNotify [#145] bluetoothd[26032]: [:1.126:error] < org.bluez.Error.NotPermitted [#145] bluetoothd[26032]: [:1.74:method_call] > org.freedesktop.DBus.Properties.GetAll [#895] bluetoothd[26032]: [:1.74:method_return] < [#895] bluetoothd[26032]: [:1.74:method_call] > org.bluez.GattCharacteristic1.StopNotify [#896] ==26032== Invalid read of size 8 ==26032== at 0x1A5721: notify_io_destroy (gatt-client.c:1562) ==26032== by 0x1A7290: sock_io_destroy (gatt-client.c:1171) ==26032== by 0x1A7290: destroy_sock (gatt-client.c:1192) ==26032== by 0x1A73D6: characteristic_stop_notify (gatt-client.c:1698) ==26032== by 0x1CF478: process_message (object.c:293) ==26032== by 0x49CB71B: ??? (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4) ==26032== by 0x49BB62A: dbus_connection_dispatch (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4) ==26032== by 0x1CBCEF: message_dispatch (mainloop.c:59) ==26032== by 0x48BF61E: g_main_context_dispatch (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BF9D7: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BFC8E: g_main_loop_run (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x202114: mainloop_run (mainloop-glib.c:65) ==26032== by 0x202501: mainloop_run_with_signal (mainloop-notify.c:196) ==26032== Address 0x5a7a430 is 0 bytes inside a block of size 32 free'd ==26032== at 0x484417B: free (vg_replace_malloc.c:872) ==26032== by 0x1DEC0F: complete_notify_request (gatt-client.c:1663) ==26032== by 0x1DEC0F: enable_ccc_callback (gatt-client.c:1735) ==26032== by 0x1DB8FF: disc_att_send_op (att.c:464) ==26032== by 0x1DB8FF: disconnect_cb (att.c:676) ==26032== by 0x2017A4: watch_callback (io-glib.c:173) ==26032== by 0x48BF61E: g_main_context_dispatch (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BF9D7: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BFC8E: g_main_loop_run (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x202114: mainloop_run (mainloop-glib.c:65) ==26032== by 0x202501: mainloop_run_with_signal (mainloop-notify.c:196) ==26032== by 0x12E60C: main (main.c:1535) ==26032== Block was alloc'd at ==26032== at 0x48417B4: malloc (vg_replace_malloc.c:381) ==26032== by 0x1D2F4D: util_malloc (util.c:46) ==26032== by 0x1A5DD3: notify_client_create (gatt-client.c:1426) ==26032== by 0x1A5EFC: characteristic_acquire_notify (gatt-client.c:1588) ==26032== by 0x1CF478: process_message (object.c:293) ==26032== by 0x49CB71B: ??? (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4) ==26032== by 0x49BB62A: dbus_connection_dispatch (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4) ==26032== by 0x1CBCEF: message_dispatch (mainloop.c:59) ==26032== by 0x48BF61E: g_main_context_dispatch (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BF9D7: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
