Skip to content

ble_l2cap_coc_cleanup_chan corrupts os_mbuf pool #2045

@psilva-dsr

Description

@psilva-dsr

coc_rx.sdus[] is managed by coc_rx.current_sdu_idx and coc_rx.next_sdu_alloc_idx
but ble_l2cap_coc_cleanup_chan() does not check them

Steps to reproduce:
enable MYNEWT_VAL_OS_MEMPOOL_POISON in build
create L2CAP COC connection
exchange some data
close connection

A simple fix that I am using is, in ble_l2cap_coc_rx_fn(), replace
rx_sdu = NULL;
with
rx->sdus[chan->coc_rx.current_sdu_idx] = NULL;
this removes the reference to the mbuf from the stack just before returning it to the application

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions