Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0926c0a7 authored by Kyunglyul Hyun's avatar Kyunglyul Hyun
Browse files

Check rcb is released 

When BT is disabled, a race condition can
occur between the release of a registration
control block (RCB) and an attempt to access it.
This can lead to accessing deallocated memory.

This change resolves the issue by checking if
the RCB is still valid before accessing it.

Bug: 377818132
Flag: Exempt, strict checking
Test: atest BumbleBluetoothTests
Change-Id: I63cc4312d544ac6b4dee4b155b18a7aa1f44f794
parent f276b177

system/stack/gatt/gatt_utils.cc

+5 −3
Original line number Diff line number Diff line
@@ -1752,11 +1752,13 @@ bool gatt_is_outstanding_msg_in_att_send_queue(const tGATT_TCB& tcb) { 
 ******************************************************************************/

void gatt_end_operation(tGATT_CLCB* p_clcb, tGATT_STATUS status, void* p_data) {

  tGATT_CL_COMPLETE cb_data;

  tGATT_CMPL_CBACK* p_cmpl_cb = (p_clcb->p_reg) ? p_clcb->p_reg->app_cb.p_cmpl_cb : NULL;

  tGATT_REG* p_reg = gatt_get_regcb(gatt_get_gatt_if(p_clcb->conn_id));

  tGATT_CMPL_CBACK* p_cmpl_cb =

          ((p_clcb->p_reg == p_reg) && p_reg) ? p_reg->app_cb.p_cmpl_cb : NULL;

  tGATT_DISC_CMPL_CB* p_disc_cmpl_cb =

          ((p_clcb->p_reg == p_reg) && p_reg) ? p_clcb->p_reg->app_cb.p_disc_cmpl_cb : NULL;

  tGATTC_OPTYPE op = p_clcb->operation;

  tGATT_DISC_TYPE disc_type = GATT_DISC_MAX;

  tGATT_DISC_CMPL_CB* p_disc_cmpl_cb =

          (p_clcb->p_reg) ? p_clcb->p_reg->app_cb.p_disc_cmpl_cb : NULL;

  tCONN_ID conn_id;

  uint8_t operation;