Skip to content

[nrf fromtree] bluetooth: mesh: fix buffer leakage if mesh was suspended #2893

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 21, 2025
Merged

[nrf fromtree] bluetooth: mesh: fix buffer leakage if mesh was suspended #2893

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 17 additions & 16 deletions subsys/bluetooth/mesh/adv_ext.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -459,6 +459,13 @@ void bt_mesh_adv_friend_ready(void)
}
}

static void adv_sent(struct bt_mesh_ext_adv *ext_adv)
{
atomic_set_bit(ext_adv->flags, ADV_FLAG_SENT);

bt_mesh_wq_submit(&ext_adv->work);
}

int bt_mesh_adv_terminate(struct bt_mesh_adv *adv)
{
int err;
Expand All @@ -483,9 +490,7 @@ int bt_mesh_adv_terminate(struct bt_mesh_adv *adv)
/* Do not call `cb:end`, since this user action */
adv->ctx.cb = NULL;

atomic_set_bit(ext_adv->flags, ADV_FLAG_SENT);

bt_mesh_wq_submit(&ext_adv->work);
adv_sent(ext_adv);

return 0;
}
Expand Down Expand Up @@ -539,8 +544,7 @@ static struct bt_mesh_ext_adv *adv_instance_find(struct bt_le_ext_adv *instance)
return NULL;
}

static void adv_sent(struct bt_le_ext_adv *instance,
struct bt_le_ext_adv_sent_info *info)
static void ext_adv_set_sent(struct bt_le_ext_adv *instance, struct bt_le_ext_adv_sent_info *info)
{
struct bt_mesh_ext_adv *ext_adv = adv_instance_find(instance);

Expand All @@ -554,17 +558,15 @@ static void adv_sent(struct bt_le_ext_adv *instance,
return;
}

atomic_set_bit(ext_adv->flags, ADV_FLAG_SENT);

bt_mesh_wq_submit(&ext_adv->work);
adv_sent(ext_adv);
}

int bt_mesh_adv_enable(void)
{
int err;

static const struct bt_le_ext_adv_cb adv_cb = {
.sent = adv_sent,
.sent = ext_adv_set_sent,
};

if (advs[0].instance) {
Expand All @@ -573,8 +575,7 @@ int bt_mesh_adv_enable(void)
}

for (int i = 0; i < ARRAY_SIZE(advs); i++) {
err = bt_le_ext_adv_create(&advs[i].adv_param, &adv_cb,
&advs[i].instance);
err = bt_le_ext_adv_create(&advs[i].adv_param, &adv_cb, &advs[i].instance);
if (err) {
return err;
}
Expand Down Expand Up @@ -611,11 +612,6 @@ int bt_mesh_adv_disable(void)
return err;
}

/* `adv_sent` is called to finish transmission of an adv buffer that was pushed to
* the host before the advertiser was stopped, but did not finish.
*/
adv_sent(advs[i].instance, NULL);

err = bt_le_ext_adv_delete(advs[i].instance);
if (err) {
LOG_ERR("Failed to delete adv %d", err);
Expand All @@ -625,6 +621,11 @@ int bt_mesh_adv_disable(void)
advs[i].instance = NULL;

atomic_clear_bit(advs[i].flags, ADV_FLAG_SUSPENDING);

/* `adv_sent` is called to finish transmission of an adv buffer that was pushed to
* the host before the advertiser was stopped, but did not finish.
*/
adv_sent(&advs[i]);
}

return 0;
Expand Down