mirror of
https://github.com/apache/nuttx.git
synced 2026-09-29 18:45:22 +00:00
a73bea0653
The GATT ioctls looked up a connection by address and then checked only that a connection object existed, not that it had reached CONNECTED. While a connection is still being established conn->att is NULL, and bt_att_create_pdu() dereferenced it to read the ATT MTU, so issuing SIOCBTEXCHANGE, SIOCBTDISCOVER, SIOCBTGATTRD or SIOCBTGATTWR for a peer that is merely pending faulted. Any task with access to the network device can reach that path, and in PROTECTED and KERNEL builds the fault is taken in the kernel on behalf of user code. Require CONNECTED in those four ioctls, releasing the reference the lookup took, and make bt_att_create_pdu() return NULL when there is no ATT context instead of relying on every caller having checked first. Testing: builds for sim:bluetooth with Make; every commit in this series verified to build individually. On sim:bluetooth with CONFIG_BTSAK=y: nsh> ifup bnep0 ifup bnep0...OK nsh> bt bnep0 gatt connect 11:22:33:44:55:66 public Connect pending... nsh> bt bnep0 gatt exchange-mtu 11:22:33:44:55:66 public ERROR: ioctl(SIOCBTEXCHANGE) failed: 107 107 is ENOTCONN, and the shell continues to run; before this change the same sequence terminated the simulator in bt_att_create_pdu(). Signed-off-by: Alan C. Assis <acassis@gmail.com> Assisted-by: Claude Code Opus 5 |
||
|---|---|---|
| .. | ||
| bt_atomic.h | ||
| bt_att.c | ||
| bt_att.h | ||
| bt_buf.c | ||
| bt_buf.h | ||
| bt_conn.c | ||
| bt_conn.h | ||
| bt_gatt.c | ||
| bt_hcicore.c | ||
| bt_hcicore.h | ||
| bt_ioctl.c | ||
| bt_ioctl.h | ||
| bt_keys.c | ||
| bt_keys.h | ||
| bt_l2cap.c | ||
| bt_l2cap.h | ||
| bt_netdev.c | ||
| bt_queue.c | ||
| bt_queue.h | ||
| bt_services.c | ||
| bt_smp.c | ||
| bt_smp.h | ||
| bt_uuid.c | ||
| CMakeLists.txt | ||
| Kconfig | ||
| Make.defs | ||