From 9e62ec5cfe34de0e3d4b4f063afbb191255cfc40 Mon Sep 17 00:00:00 2001 From: andy Date: Fri, 11 Sep 2026 14:33:18 +0100 Subject: [PATCH] Fix use-after-free on exit in BLE GATT Server Teardown freed the view port before unhooking the serial and status callbacks, which run on the BLE/BT thread and call view_port_update. A late notification or status change during exit could touch freed memory. Unhook both callbacks and restore the default profile first, then free the view port. --- ble_gattsrv/ble_gattsrv.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/ble_gattsrv/ble_gattsrv.c b/ble_gattsrv/ble_gattsrv.c index 9f7e830..ad40c67 100644 --- a/ble_gattsrv/ble_gattsrv.c +++ b/ble_gattsrv/ble_gattsrv.c @@ -131,15 +131,17 @@ int32_t ble_gattsrv_app(void* p) { } } - gui_remove_view_port(app->gui, app->vp); - view_port_free(app->vp); - furi_record_close(RECORD_GUI); + // Unhook every callback that runs on the BLE/BT thread BEFORE freeing the + // view port, or serial_cb/status_cb can call view_port_update on freed memory. if(app->profile) { ble_profile_serial_set_event_callback(app->profile, 0, NULL, NULL); bt_profile_restore_default(app->bt); } bt_set_status_changed_callback(app->bt, NULL, NULL); furi_record_close(RECORD_BT); + gui_remove_view_port(app->gui, app->vp); + view_port_free(app->vp); + furi_record_close(RECORD_GUI); furi_message_queue_free(app->input); furi_mutex_free(app->mutex); free(app);