apache / mynewt-nimble

Apache mynewt
https://mynewt.apache.org/
Apache License 2.0
664 stars 384 forks source link

host/ble_l2cap_coc: fix possible race condition in L2CAP COC #1766

Closed KKopyscinski closed 2 months ago

KKopyscinski commented 2 months ago

Two functions: ble_l2cap_coc_continue_tx and ble_l2cap_coc_recv_ready can be reached from other task than host, for example separate thread running in application, by calling ble_l2cap_recv_ready or ble_l2cap_send. Because pointer to chan passed into these functions may be outdated (connection is being terminated by host) this will lead to either:

KKopyscinski commented 2 months ago

Rest of functions that use ble_hs_conn_find_assert are reachable from host and should indeed cause assert to be triggered, or have conn already checked, as described in 8ec1b8d BLE Host - Check conn state once before proc.