Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Subject: Re: [PATCH BlueZ] gatt-server: Fix crash while disconnecting
From:   patchwork-bot+bluetooth@kernel.org
Message-Id: <165308161200.31176.4427175768508209959.git-patchwork-notify@kernel.org>
Date:   Fri, 20 May 2022 21:20:12 +0000
References: <20220519214002.2525857-1-luiz.dentz@gmail.com>
In-Reply-To: <20220519214002.2525857-1-luiz.dentz@gmail.com>
To:     Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc:     linux-bluetooth@vger.kernel.org
Precedence: bulk

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 19 May 2022 14:40:02 -0700 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> If there is a pending notify multiple the code was not removing before
> freeing the object causing the following crash:
> 
> Invalid read of size 8
>    at 0x4A3D10: notify_multiple (gatt-server.c:1703)
>    by 0x4D05F0: timeout_callback (timeout-glib.c:25)
>    by 0x4956900: ??? (in /usr/lib64/libglib-2.0.so.0.7000.5)
>    by 0x49560AE: g_main_context_dispatch
>    (in /usr/lib64/libglib-2.0.so.0.7000.5)
>    by 0x49AB307: ??? (in /usr/lib64/libglib-2.0.so.0.7000.5)
>    by 0x49557C2: g_main_loop_run
>    (in /usr/lib64/libglib-2.0.so.0.7000.5)
>    by 0x4D0A34: mainloop_run (mainloop-glib.c:66)
>    by 0x4D0F2B: mainloop_run_with_signal (mainloop-notify.c:188)
>    by 0x2B0CD1: main (main.c:1276)
>  Address 0x6ca35c8 is 136 bytes inside a block of size 144 free'd
>    at 0x48470E4: free (vg_replace_malloc.c:872)
>    by 0x415E73: gatt_server_cleanup (device.c:698)
>    by 0x415E73: attio_cleanup (device.c:715)
>    by 0x47745B: queue_foreach (queue.c:207)
>    by 0x490C54: disconnect_cb (att.c:701)
>    by 0x4CF4AF: watch_callback (io-glib.c:157)
>    by 0x49560AE: g_main_context_dispatch
>    (in /usr/lib64/libglib-2.0.so.0.7000.5)
>    by 0x49AB307: ??? (in /usr/lib64/libglib-2.0.so.0.7000.5)
>    by 0x49557C2: g_main_loop_run
>    (in /usr/lib64/libglib-2.0.so.0.7000.5)
>    by 0x4D0A34: mainloop_run (mainloop-glib.c:66)
>    by 0x4D0F2B: mainloop_run_with_signal (mainloop-notify.c:188)
>    by 0x2B0CD1: main (main.c:1276)
> 
> [...]

Here is the summary with links:
  - [BlueZ] gatt-server: Fix crash while disconnecting
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=f1069c4fe106

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html