mirror of
https://github.com/apache/nuttx.git
synced 2026-08-18 12:08:16 +00:00
a79734d6df
Some checks are pending
MemBrowse Memory Report / changes-filter (push) Waiting to run
MemBrowse Memory Report / load-targets (push) Waiting to run
MemBrowse Memory Report / identical (push) Blocked by required conditions
MemBrowse Memory Report / analyze (push) Blocked by required conditions
hci_acl() looked up the connection with bt_conn_lookup_handle(), which returns a new reference, but never released it. This leaked one conn reference for every received ACL packet. bt_conn_receive() also consumes the buffer on every path: it forwards to l2cap (which releases) or stores the buffer in conn->rx without an addref. The hci_rx_work() worker then called bt_buf_release() on the same buffer, which caused a double free or use-after-free. Take an extra buffer reference for the worker to release, and release the connection reference from the lookup. Assisted-by: Fable Signed-off-by: AbhinavMir <atg271@gmail.com> |
||
|---|---|---|
| .. | ||
| bt_atomic.h | ||
| bt_att.c | ||
| bt_att.h | ||
| bt_buf.c | ||
| bt_buf.h | ||
| bt_conn.c | ||
| bt_conn.h | ||
| bt_gatt.c | ||
| bt_hcicore.c | ||
| bt_hcicore.h | ||
| bt_ioctl.c | ||
| bt_ioctl.h | ||
| bt_keys.c | ||
| bt_keys.h | ||
| bt_l2cap.c | ||
| bt_l2cap.h | ||
| bt_netdev.c | ||
| bt_queue.c | ||
| bt_queue.h | ||
| bt_services.c | ||
| bt_smp.c | ||
| bt_smp.h | ||
| bt_uuid.c | ||
| CMakeLists.txt | ||
| Kconfig | ||
| Make.defs | ||