Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:
On Thu, 19 May 2022 14:40:02 -0700 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
>
> If there is a pending notify multiple the code was not removing before
> freeing the object causing the following crash:
>
> Invalid read of size 8
> at 0x4A3D10: notify_multiple (gatt-server.c:1703)
> by 0x4D05F0: timeout_callback (timeout-glib.c:25)
> by 0x4956900: ??? (in /usr/lib64/libglib-2.0.so.0.7000.5)
> by 0x49560AE: g_main_context_dispatch
> (in /usr/lib64/libglib-2.0.so.0.7000.5)
> by 0x49AB307: ??? (in /usr/lib64/libglib-2.0.so.0.7000.5)
> by 0x49557C2: g_main_loop_run
> (in /usr/lib64/libglib-2.0.so.0.7000.5)
> by 0x4D0A34: mainloop_run (mainloop-glib.c:66)
> by 0x4D0F2B: mainloop_run_with_signal (mainloop-notify.c:188)
> by 0x2B0CD1: main (main.c:1276)
> Address 0x6ca35c8 is 136 bytes inside a block of size 144 free'd
> at 0x48470E4: free (vg_replace_malloc.c:872)
> by 0x415E73: gatt_server_cleanup (device.c:698)
> by 0x415E73: attio_cleanup (device.c:715)
> by 0x47745B: queue_foreach (queue.c:207)
> by 0x490C54: disconnect_cb (att.c:701)
> by 0x4CF4AF: watch_callback (io-glib.c:157)
> by 0x49560AE: g_main_context_dispatch
> (in /usr/lib64/libglib-2.0.so.0.7000.5)
> by 0x49AB307: ??? (in /usr/lib64/libglib-2.0.so.0.7000.5)
> by 0x49557C2: g_main_loop_run
> (in /usr/lib64/libglib-2.0.so.0.7000.5)
> by 0x4D0A34: mainloop_run (mainloop-glib.c:66)
> by 0x4D0F2B: mainloop_run_with_signal (mainloop-notify.c:188)
> by 0x2B0CD1: main (main.c:1276)
>
> [...]
Here is the summary with links:
- [BlueZ] gatt-server: Fix crash while disconnecting
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=f1069c4fe106
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
