Skip to content

[nrf fromtree] mgmt: mcumgr: transport: smp_bt: Fix deadlock on disconnect with data #948

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

[nrf fromtree] mgmt: mcumgr: transport: smp_bt: Fix deadlock on disconnect with data #948

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion subsys/mgmt/mcumgr/transport/smp_bt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,13 +387,30 @@ static int smp_bt_tx_pkt(struct net_buf *nb)
.data = nb->data,
};
bool sent = false;
struct bt_conn_info info;

conn = smp_bt_conn_from_pkt(nb);
if (conn == NULL) {
rc = MGMT_ERR_ENOENT;
goto cleanup;
}

/* Verify that the device is connected, the necessity for this check is that the remote
* device might have sent a command and disconnected before the command has been processed
* completely, if this happens then the the connection details will still be valid due to
* the incremented connection reference count, but the connection has actually been
* dropped, this avoids waiting for a semaphore that will never be given which would
* otherwise cause a deadlock.
*/
rc = bt_conn_get_info(conn, &info);

if (rc != 0 || info.state != BT_CONN_STATE_CONNECTED) {
/* Remote device has disconnected */
bt_conn_unref(conn);
rc = MGMT_ERR_ENOENT;
goto cleanup;
}

/* Send data in chunks of the MTU size */
mtu_size = smp_bt_get_mtu(nb);

Expand All @@ -414,7 +431,6 @@ static int smp_bt_tx_pkt(struct net_buf *nb)
notify_param.len = mtu_size;

rc = bt_gatt_notify_cb(conn, &notify_param);
k_sem_take(&smp_notify_sem, K_FOREVER);

if (rc == -ENOMEM) {
if (sent == false) {
Expand Down Expand Up @@ -443,7 +459,10 @@ static int smp_bt_tx_pkt(struct net_buf *nb)
off += mtu_size;
notify_param.data = &nb->data[off];
sent = true;

k_sem_take(&smp_notify_sem, K_FOREVER);
} else {
/* No connection, cannot continue */
rc = MGMT_ERR_EUNKNOWN;
break;
}
Expand Down
Loading