Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 8d0e042d authored by Katta Karthik Reddy's avatar Katta Karthik Reddy Committed by Kyunglyul Hyun
Browse files

Use after free in GATT TCB commands

Steps to reproduce: |-
1. Turn on BT
2. Pair and connect EATT suppoerted LEA remote
3. disconnect
4) reconnect remote

Repeat steps 3 and 4
-
Expected result: Reconnection should be successful
-
Observed result: Reconnection failing some times as Bluetooth reset while sending gatt responce

Root cuase: Stack trying to access already freed GATT TCB command queue

resolve: cleanup of GATT TCB command queue on disconnection

Flag: EXEMPT, strict check without logical change
Bug: 382606738
Test: atest bluetooth_test_gd_unit

Change-Id: I44c336d05e6c84d92f67316e23d78214c4e7b1a0
parent fcb58dac
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment