This is an automated email from the ASF dual-hosted git repository. janc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 002bdcfc7678a36307db893f4c165e4712e7d7dd Author: Szymon Janc <[email protected]> AuthorDate: Mon Dec 8 15:20:58 2025 +0100 nimble/host: Fix mbuf leak on L2CAP Make sure to free rx data if not passing it to channel callback. --- nimble/host/src/ble_l2cap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nimble/host/src/ble_l2cap.c b/nimble/host/src/ble_l2cap.c index 584f44312..c79081eec 100644 --- a/nimble/host/src/ble_l2cap.c +++ b/nimble/host/src/ble_l2cap.c @@ -394,6 +394,7 @@ ble_l2cap_rx(uint16_t conn_handle, uint8_t pb, struct os_mbuf *om) if (!chan) { ble_l2cap_sig_reject_invalid_cid_tx(conn_handle, 0, 0, rx_cid); + os_mbuf_free_chain(rx_frags); return BLE_HS_ENOENT; } @@ -406,11 +407,13 @@ ble_l2cap_rx(uint16_t conn_handle, uint8_t pb, struct os_mbuf *om) if (chan->dcid >= BLE_L2CAP_COC_CID_START && chan->dcid <= BLE_L2CAP_COC_CID_END && rx_len > chan->my_coc_mps) { ble_l2cap_disconnect(chan); + os_mbuf_free_chain(rx_frags); return BLE_HS_EBADDATA; } if (rx_len > ble_l2cap_get_mtu(chan)) { ble_l2cap_disconnect(chan); + os_mbuf_free_chain(rx_frags); return BLE_HS_EBADDATA; }
