Skip to content

Bluetooth: Mesh: Fix crash on disconnect #39098

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 4, 2021
Merged

Bluetooth: Mesh: Fix crash on disconnect #39098

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion subsys/bluetooth/mesh/pb_gatt_srv.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,10 @@ static void gatt_disconnected(struct bt_conn *conn, uint8_t reason)
return;
}

cli = NULL;
if (cli) {
Copy link
Contributor

@LingaoM LingaoM Oct 8, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the late reply. Your modification is very good, but I have a little doubt: Since there is no environment support of BBSIM, I can only simply test the functions of PB-GATT and Proxy locally, and it seems that there is no crash.

Copy link
Contributor Author

@sjanc sjanc Oct 8, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it is very easy to reproduce the crash before this fix: just connect as a central to any device that doesn't support PB-GATT and disconnect.

(we noticed this in autopts run where all BLE Host tests that IUT is central were failing)

bt_mesh_proxy_role_cleanup(cli);
cli = NULL;
}

bt_mesh_pb_gatt_close(conn);

Expand Down
12 changes: 1 addition & 11 deletions subsys/bluetooth/mesh/proxy_msg.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,14 +219,8 @@ struct bt_mesh_proxy_role *bt_mesh_proxy_role_setup(struct bt_conn *conn,
return role;
}

static void gatt_disconnected(struct bt_conn *conn, uint8_t reason)
void bt_mesh_proxy_role_cleanup(struct bt_mesh_proxy_role *role)
{
struct bt_mesh_proxy_role *role;

BT_DBG("conn %p reason 0x%02x", (void *)conn, reason);

role = &roles[bt_conn_index(conn)];

/* If this fails, the work handler exits early, as
* there's no active connection.
*/
Expand All @@ -236,7 +230,3 @@ static void gatt_disconnected(struct bt_conn *conn, uint8_t reason)

bt_mesh_adv_update();
}

BT_CONN_CB_DEFINE(conn_callbacks) = {
.disconnected = gatt_disconnected,
};
1 change: 1 addition & 0 deletions subsys/bluetooth/mesh/proxy_msg.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,5 +54,6 @@ int bt_mesh_proxy_msg_send(struct bt_mesh_proxy_role *role, uint8_t type,
struct bt_mesh_proxy_role *bt_mesh_proxy_role_setup(struct bt_conn *conn,
proxy_send_cb_t send,
proxy_recv_cb_t recv);
void bt_mesh_proxy_role_cleanup(struct bt_mesh_proxy_role *role);

#endif /* ZEPHYR_SUBSYS_BLUETOOTH_MESH_PROXY_MSG_H_ */
5 changes: 4 additions & 1 deletion subsys/bluetooth/mesh/proxy_srv.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -883,7 +883,10 @@ static void gatt_disconnected(struct bt_conn *conn, uint8_t reason)
conn_count--;

client = find_client(conn);
client->cli = NULL;
if (client->cli) {
bt_mesh_proxy_role_cleanup(client->cli);
client->cli = NULL;
}
}

static int proxy_send(struct bt_conn *conn,
Expand Down