[PATCH 1/4] dbus-filter: avoid NULL pointer dereference after removing all rules

Christian Eggers <[email protected]> Wed, 25 Jun 2025 15:14:29 +0200
Newsgroups dev.linux.lists.ell
Message-ID <[email protected]>
l_dbus_register() is called by _dbus_filter_new() directly before the
first filter rule is added (so filter->root is only transitional NULL).
Later, if all filter rules have been removed, filter->root is
permanently NULL which causes NULL pointer dereference in
_dbus_filter_dispatch() / filter_dispatch_match_recurse().

I get this situation after creating a D-Bus proxy and destroying the
proxy later (so that no filter rules are left, but the D-Bus' filter is
still registered).
---
 ell/dbus-filter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ell/dbus-filter.c b/ell/dbus-filter.c
index 7853c2b087a3..91f96718fcd6 100644
--- a/ell/dbus-filter.c
+++ b/ell/dbus-filter.c
@@ -141,7 +141,8 @@ void _dbus_filter_dispatch(struct l_dbus_message *message, void *user_data)
 {
 	struct _dbus_filter *filter = user_data;
 
-	filter_dispatch_match_recurse(filter, filter->root, message);
+	if (filter->root)
+		filter_dispatch_match_recurse(filter, filter->root, message);
 }
 
 struct _dbus_filter *_dbus_filter_new(struct l_dbus *dbus,
-- 
2.43.0