espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-08-15 22:47:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

nimble/ll: Fix active scan on aux

Browse Source 
We should not allow to free aux_data from pkt_in if there was
AUX_SCAN_REQ sent for that pdu as this will result in use-after-free of
aux_data when AUX_SCAN_RSP is received.

This can happen if we send AUX_SCAN_REQ from isr and then in pkt_in
figure out this is a duplicate so we don't want to scan this chain
anymore. We should just wait for AUX_SCAN_RSP and stop there.
This commit is contained in:
Andrzej Kaczmarek
2022-09-29 19:22:54 +02:00
parent 9257bfecf2
commit 0c3e1b728c
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/controller/src/ble_ll_scan_aux.c
+6 -4
View File
@@ -1724,12 +1724,14 @@ ble_ll_scan_aux_rx_pkt_in(struct os_mbuf *rxpdu, struct ble_mbuf_hdr *rxhdr)
aux->hci_state |= BLE_LL_SCAN_AUX_H_DONE;
}
/*
* If we are done processing this chain and aux scan was not scheduled or
* we removed it from scheduler, we can remove aux_data now. Otherwise we
* will remove on next pkt_in.
/* If we are done processing this chain we can remove aux_data now if:
* - we did not send AUX_SCAN_REQ for this PDU
* - there was no aux scan scheduled from this PDU
* - there was aux scan scheduled from this PDU but we removed it
* In other cases, we'll remove aux_data on next pkt_in.
*/
if ((aux->hci_state & BLE_LL_SCAN_AUX_H_DONE) &&
!(rxinfo->flags & BLE_MBUF_HDR_F_SCAN_REQ_TXD) &&
(!(rxinfo->flags & BLE_MBUF_HDR_F_AUX_PTR_WAIT) ||
(ble_ll_sched_rmv_elem(&aux->sch) == 0))) {
ble_ll_scan_aux_free(aux);