espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-10-31 09:36:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

nimble/host: Add return parameter to the ble_hs_misc_conn_chan_find_reqd()

Browse Source 
ble_hs_misc_conn_chan_find_reqd() did not return an error code if
the connection and or the channel were not found, i.e in a disconnected state.
When debug is not enabled and `ble_hs_misc_conn_chan_find_reqd()` is called and
the device has disconnected from the peer various functions may attempt to access
memory that is not valid causing an null pointer exception.
This commit is contained in:
h2zero
2020-04-23 00:34:07 +02:00
committed by Łukasz Rymanowski
parent 2da39a1fe5
commit 6ced1dd4ca
6 changed files with 32 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/host/src/ble_att_cmd.c
+3 -4
View File
@@ -66,11 +66,10 @@ ble_att_tx(uint16_t conn_handle, struct os_mbuf *txom)
ble_hs_lock();
ble_hs_misc_conn_chan_find_reqd(conn_handle, BLE_L2CAP_CID_ATT, &conn,
&chan);
if (chan == NULL) {
rc = ble_hs_misc_conn_chan_find_reqd(conn_handle, BLE_L2CAP_CID_ATT, &conn,
&chan);
if (rc != 0) {
os_mbuf_free_chain(txom);
rc = BLE_HS_ENOTCONN;
} else {
ble_att_truncate_to_mtu(chan, txom);
rc = ble_l2cap_tx(conn, chan, txom);
nimble/host/src/ble_hs_misc.c
+6 -2
View File
@@ -56,7 +56,7 @@ ble_hs_misc_conn_chan_find(uint16_t conn_handle, uint16_t cid,
return rc;
}
void
int
ble_hs_misc_conn_chan_find_reqd(uint16_t conn_handle, uint16_t cid,
struct ble_hs_conn **out_conn,
struct ble_l2cap_chan **out_chan)
@@ -66,7 +66,9 @@ ble_hs_misc_conn_chan_find_reqd(uint16_t conn_handle, uint16_t cid,
int rc;
rc = ble_hs_misc_conn_chan_find(conn_handle, cid, &conn, &chan);
BLE_HS_DBG_ASSERT_EVAL(rc == 0);
if (rc != 0) {
return rc;
}
if (out_conn != NULL) {
*out_conn = conn;
@@ -74,6 +76,8 @@ ble_hs_misc_conn_chan_find_reqd(uint16_t conn_handle, uint16_t cid,
if (out_chan != NULL) {
*out_chan = chan;
}
return 0;
}
uint8_t
nimble/host/src/ble_hs_priv.h
+3 -3
View File
@@ -114,9 +114,9 @@ int ble_hs_hci_evt_acl_process(struct os_mbuf *om);
int ble_hs_misc_conn_chan_find(uint16_t conn_handle, uint16_t cid,
struct ble_hs_conn **out_conn,
struct ble_l2cap_chan **out_chan);
void ble_hs_misc_conn_chan_find_reqd(uint16_t conn_handle, uint16_t cid,
struct ble_hs_conn **out_conn,
struct ble_l2cap_chan **out_chan);
int ble_hs_misc_conn_chan_find_reqd(uint16_t conn_handle, uint16_t cid,
struct ble_hs_conn **out_conn,
struct ble_l2cap_chan **out_chan);
uint8_t ble_hs_misc_own_addr_type_to_id(uint8_t addr_type);
uint8_t ble_hs_misc_peer_addr_type_to_id(uint8_t addr_type);
int ble_hs_misc_restore_irks(void);
nimble/host/src/ble_l2cap_sig.c
+7 -2
View File
@@ -508,8 +508,13 @@ ble_l2cap_sig_update(uint16_t conn_handle,
STATS_INC(ble_l2cap_stats, update_init);
ble_hs_lock();
ble_hs_misc_conn_chan_find_reqd(conn_handle, BLE_L2CAP_CID_SIG,
&conn, &chan);
rc = ble_hs_misc_conn_chan_find_reqd(conn_handle, BLE_L2CAP_CID_SIG,
&conn, &chan);
if (rc != 0) {
ble_hs_unlock();
goto done;
}
master = conn->bhc_flags & BLE_HS_CONN_F_MASTER;
ble_hs_unlock();
nimble/host/src/ble_l2cap_sig_cmd.c
+5 -3
View File
@@ -28,9 +28,11 @@ ble_l2cap_sig_tx(uint16_t conn_handle, struct os_mbuf *txom)
int rc;
ble_hs_lock();
ble_hs_misc_conn_chan_find_reqd(conn_handle, BLE_L2CAP_CID_SIG,
&conn, &chan);
rc = ble_l2cap_tx(conn, chan, txom);
rc = ble_hs_misc_conn_chan_find_reqd(conn_handle, BLE_L2CAP_CID_SIG,
&conn, &chan);
if (rc == 0) {
rc = ble_l2cap_tx(conn, chan, txom);
}
ble_hs_unlock();
return rc;
nimble/host/src/ble_sm_cmd.c
+8 -3
View File
@@ -52,12 +52,17 @@ ble_sm_tx(uint16_t conn_handle, struct os_mbuf *txom)
{
struct ble_l2cap_chan *chan;
struct ble_hs_conn *conn;
int rc;
BLE_HS_DBG_ASSERT(ble_hs_locked_by_cur_task());
STATS_INC(ble_l2cap_stats, sm_tx);
ble_hs_misc_conn_chan_find_reqd(conn_handle, BLE_L2CAP_CID_SM,
&conn, &chan);
return ble_l2cap_tx(conn, chan, txom);
rc = ble_hs_misc_conn_chan_find_reqd(conn_handle, BLE_L2CAP_CID_SM,
&conn, &chan);
if (rc == 0) {
rc = ble_l2cap_tx(conn, chan, txom);
}
return rc;
}