Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81f39795 authored by Myles Watson's avatar Myles Watson
Browse files

HCI: Fix use after free in hci_transmit 

Bug: 70626623
Test: Sanity Bluetooth on/off
Change-Id: Ie8c857f8bdf3897fd3776772a4198bab823c6115
parent b47c004f

system/hci/src/hci_layer.cc

+8 −2
Original line number Diff line number Diff line
@@ -427,12 +427,18 @@ static void event_packet_ready(void* pkt) { 
static void transmit_fragment(BT_HDR* packet, bool send_transmit_finished) {

  btsnoop->capture(packet, false);



  // HCI command packets are freed on a different thread when the matching

  // event is received. Check packet->event before sending to avoid a race.

  bool free_after_transmit =

      (packet->event & MSG_EVT_MASK) != MSG_STACK_TO_HC_HCI_CMD &&

      send_transmit_finished;



  hci_transmit(packet);



  uint16_t event = packet->event & MSG_EVT_MASK;

  if (event != MSG_STACK_TO_HC_HCI_CMD && send_transmit_finished)

  if (free_after_transmit) {

    buffer_allocator->free(packet);

  }

}



static void fragmenter_transmit_finished(BT_HDR* packet,

                                         bool all_fragments_sent) {