[PATCH BlueZ] gatt: Fix crash when a device is removed

* [PATCH BlueZ] gatt: Fix crash when a device is removed
@ 2021-01-19 19:35 Luiz Augusto von Dentz
  2021-01-19 20:27 ` [BlueZ] " bluez.test.bot
  0 siblings, 1 reply; 3+ messages in thread
From: Luiz Augusto von Dentz @ 2021-01-19 19:35 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

If a device is removed with notifications enabled that would lead to
device_state being freed while att_disconnected has not been called
yet.

gh-issue: https://github.com/bluez/bluez/issues/82
---
 src/gatt-database.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/gatt-database.c b/src/gatt-database.c
index d99604826..d635c3214 100644
--- a/src/gatt-database.c
+++ b/src/gatt-database.c
@@ -1350,11 +1350,17 @@ static void send_notification_to_device(void *data, void *user_data)
 	if (!ccc->value || (notify->conf && !(ccc->value & 0x0002)))
 		return;
 
-	device = btd_adapter_get_device(notify->database->adapter,
+	device = btd_adapter_find_device(notify->database->adapter,
 						&device_state->bdaddr,
 						device_state->bdaddr_type);
-	if (!device)
+	if (!device) {
+		/* If ATT has not disconnect yet don't remove the state as it
+		 * will eventually be removed when att_disconnected is called.
+		 */
+		if (device_state->disc_id)
+			return;
 		goto remove;
+	}
 
 	server = btd_device_get_gatt_server(device);
 	if (!server) {
-- 
2.26.2


^ permalink raw reply related	[flat|nested] 3+ messages in thread