Public bug reported: [ Impact ]
bluetoothd can crash due to a use-after-free during GATT client teardown. btd_gatt_client_service_removed() can be called reentrantly via bt_gatt_client_unref() after the services queue has already been freed. When this happens, the reentrant call dereferences freed memory, resulting in a use-after-free that can crash bluetoothd. This affects reliability of Bluetooth on affected systems, as the daemon may crash during GATT client cleanup (for example when a device disconnects or services are removed). The fix resets client->ready to false before destroying the services queue, so any reentrant call is short-circuited and does not dereference freed memory. Upstream fix: https://github.com/bluez/bluez/commit/d01616f0c276a441dad8afe4e8f7bb261b26ba0a [ Test Plan ] This issue was reported by our hardware partner and they have reproduced it in their own test suite. I have not been able to reproduce the issue on my test device, so I do not have a reproduction test plan to include here. Verification will rely on the hardware partner confirming, using their test suite, that the use-after-free no longer occurs with the fixed package. [ Where problems could occur ] The change touches the GATT client teardown path. If the fix were wrong, it could show up as GATT services not being cleaned up correctly, stale service state, or crashes during client teardown. [ Other Info ] This is a small, targeted fix that guards against reentrant calls during teardown by clearing the ready flag before freeing the services queue. The change is a direct backport of the upstream commit and does not introduce any new behaviour beyond preventing the reentrant use-after- free. ** Affects: bluez (Ubuntu) Importance: Undecided Status: New ** Tags: fixed-upstream -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2164630 Title: [SRU][Resolute] Fix use-after-free caused by reentrant client teardown in GATT implementation To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/2164630/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
