Skip to content

Commit 6129f50

Browse files
committed
Bluetooth: Host: Fix use of local variable as atomic target
In bt_conn_unref(), the local, non shared, variable "old" is used as an atomic target: atomic_val_t old = atomic_dec(&conn->ref); conn = NULL; bool deallocated = (atomic_get(&old) == 1); The above call to atomic_get() does not prevent any data race or value obsolescence. The resulting additional memory barrier does not seem necessary either. If pedantic, one could also note that atomic_get() expects an atomic_t* argument (target), not an atomic_val_t* (value). This compiles and /works/ just fine since the Zephyr Atomic API defines both to be the same integer type. The equivalent C11 code, where _Atomic(T) and T are different types, wouldn't compile. Signed-off-by: Christophe Dufaza <[email protected]>
1 parent 77bb19c commit 6129f50

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

subsys/bluetooth/host/conn.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1545,14 +1545,15 @@ void bt_conn_unref(struct bt_conn *conn)
15451545
conn_handle = conn->handle;
15461546

15471547
old = atomic_dec(&conn->ref);
1548-
/* Prevent from accessing connection object */
1549-
conn = NULL;
1550-
deallocated = (atomic_get(&old) == 1);
15511548

15521549
LOG_DBG("handle %u ref %ld -> %ld", conn_handle, old, (old - 1));
15531550

15541551
__ASSERT(old > 0, "Conn reference counter is 0");
15551552

1553+
/* Prevent from accessing connection object */
1554+
conn = NULL;
1555+
deallocated = ((old - 1) == 0);
1556+
15561557
/* Slot has been freed and can be taken. No guarantees are made on requests
15571558
* to claim connection object as only the first claim will be served.
15581559
*/

0 commit comments

Comments
 (0)