From dda185b528c6ad195993763fba8059459a3fa54f Mon Sep 17 00:00:00 2001 From: Andrzej Kaczmarek Date: Mon, 15 Mar 2021 16:51:20 +0100 Subject: [PATCH] nimble/ll: Fix possible race on TX queue Removing from ll_tx_pkt_q should be done in critical section since insertion can be done from isr. There's no need to protect peek on 1st element since we only insert in isr and remove in LL so there's no risk of element being removed after we checked not-null. --- nimble/controller/src/ble_ll.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nimble/controller/src/ble_ll.c b/nimble/controller/src/ble_ll.c index a5c489788..cf83b79c3 100644 --- a/nimble/controller/src/ble_ll.c +++ b/nimble/controller/src/ble_ll.c @@ -711,6 +711,7 @@ ble_ll_tx_pkt_in(void) uint16_t pb; struct os_mbuf_pkthdr *pkthdr; struct os_mbuf *om; + os_sr_t sr; /* Drain all packets off the queue */ while (STAILQ_FIRST(&g_ble_ll_data.ll_tx_pkt_q)) { @@ -719,7 +720,9 @@ ble_ll_tx_pkt_in(void) om = (struct os_mbuf *)((uint8_t *)pkthdr - sizeof(struct os_mbuf)); /* Remove from queue */ + OS_ENTER_CRITICAL(sr); STAILQ_REMOVE_HEAD(&g_ble_ll_data.ll_tx_pkt_q, omp_next); + OS_EXIT_CRITICAL(sr); /* Strip HCI ACL header to get handle and length */ handle = get_le16(om->om_data);