From 476ae809a27ef2a3e3cf4f448ea3e50dbaca41f3 Mon Sep 17 00:00:00 2001 From: Andreas Kemnade Date: Mon, 30 Jun 2025 16:39:33 +0200 Subject: [PATCH] gatt-client: avoid UAF after acquire notify failure If a disconnect happens during AcquireNotify dbus calls, a lot of debris is left over. Subsequent calls to AcquireNotify will return NotPermitted and StopNotify leads to an UAF, crashing bluetoothd. Fix that by also clean up the socket stuff on failure. This was provoked by putting the device into some RF shielding bag and open and close it quickly. Valgrind output: bluetoothd[26032]: [:1.126:method_call] > org.bluez.GattCharacteristic1.AcquireNotify [#145] bluetoothd[26032]: [:1.126:error] < org.bluez.Error.NotPermitted [#145] bluetoothd[26032]: [:1.74:method_call] > org.freedesktop.DBus.Properties.GetAll [#895] bluetoothd[26032]: [:1.74:method_return] < [#895] bluetoothd[26032]: [:1.74:method_call] > org.bluez.GattCharacteristic1.StopNotify [#896] ==26032== Invalid read of size 8 ==26032== at 0x1A5721: notify_io_destroy (gatt-client.c:1562) ==26032== by 0x1A7290: sock_io_destroy (gatt-client.c:1171) ==26032== by 0x1A7290: destroy_sock (gatt-client.c:1192) ==26032== by 0x1A73D6: characteristic_stop_notify (gatt-client.c:1698) ==26032== by 0x1CF478: process_message (object.c:293) ==26032== by 0x49CB71B: ??? (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4) ==26032== by 0x49BB62A: dbus_connection_dispatch (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4) ==26032== by 0x1CBCEF: message_dispatch (mainloop.c:59) ==26032== by 0x48BF61E: g_main_context_dispatch (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BF9D7: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BFC8E: g_main_loop_run (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x202114: mainloop_run (mainloop-glib.c:65) ==26032== by 0x202501: mainloop_run_with_signal (mainloop-notify.c:196) ==26032== Address 0x5a7a430 is 0 bytes inside a block of size 32 free'd ==26032== at 0x484417B: free (vg_replace_malloc.c:872) ==26032== by 0x1DEC0F: complete_notify_request (gatt-client.c:1663) ==26032== by 0x1DEC0F: enable_ccc_callback (gatt-client.c:1735) ==26032== by 0x1DB8FF: disc_att_send_op (att.c:464) ==26032== by 0x1DB8FF: disconnect_cb (att.c:676) ==26032== by 0x2017A4: watch_callback (io-glib.c:173) ==26032== by 0x48BF61E: g_main_context_dispatch (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BF9D7: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BFC8E: g_main_loop_run (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x202114: mainloop_run (mainloop-glib.c:65) ==26032== by 0x202501: mainloop_run_with_signal (mainloop-notify.c:196) ==26032== by 0x12E60C: main (main.c:1535) ==26032== Block was alloc'd at ==26032== at 0x48417B4: malloc (vg_replace_malloc.c:381) ==26032== by 0x1D2F4D: util_malloc (util.c:46) ==26032== by 0x1A5DD3: notify_client_create (gatt-client.c:1426) ==26032== by 0x1A5EFC: characteristic_acquire_notify (gatt-client.c:1588) ==26032== by 0x1CF478: process_message (object.c:293) ==26032== by 0x49CB71B: ??? (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4) ==26032== by 0x49BB62A: dbus_connection_dispatch (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.32.4) ==26032== by 0x1CBCEF: message_dispatch (mainloop.c:59) ==26032== by 0x48BF61E: g_main_context_dispatch (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) ==26032== by 0x48BF9D7: ??? (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7400.6) --- src/gatt-client.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/gatt-client.c b/src/gatt-client.c index 3c31a422e..65308c0f7 100644 --- a/src/gatt-client.c +++ b/src/gatt-client.c @@ -1539,8 +1539,13 @@ static void register_notify_io_cb(uint16_t att_ecode, void *user_data) struct bt_gatt_client *gatt = chrc->service->client->gatt; if (att_ecode) { - queue_remove(chrc->notify_clients, client); - notify_client_free(client); + DBusMessage *reply = + create_gatt_dbus_error(chrc->notify_io->msg, att_ecode); + + g_dbus_send_message(btd_get_dbus_connection(), reply); + dbus_message_unref(chrc->notify_io->msg); + chrc->notify_io->msg = NULL; + destroy_sock(chrc, chrc->notify_io->io); return; } -- 2.47.3