kanodayo1111 opened a new issue, #19834:
URL: https://github.com/apache/nuttx/issues/19834
### Description / Steps to reproduce the issue
## Bug report
### Description
`hci_acl()` in `wireless/bluetooth/bt_hcicore.c` obtains a new reference to
the connection object via `bt_conn_lookup_handle()` but never releases it. The
function's contract explicitly requires the caller to release:
```c
/* bt_conn.c, bt_conn_lookup_handle():
* On success, the caller gets a new reference to the connection object
* which must be released with bt_conn_release() once done using the
connection.
*/
```
Every other caller in `bt_hcicore.c` (`hci_encrypt_change`,
`hci_encrypt_key_refresh_complete`, `hci_disconn_complete`, `le_ltk_request`)
releases the reference. Only `hci_acl()` misses it.
### Impact
- Every inbound ACL packet leaks one connection reference.
- `bt_conn_release()` clears the slot address to `BT_ADDR_LE_ANY` only when
the refcount reaches zero; with the leak it never does, so the slot is never
recycled.
- With the default `CONFIG_BLUETOOTH_MAX_CONN=1`, the **second** connection
after any session with inbound ACL traffic fails: `LE_CONN_COMPLETE
status=0x00` is received, but `bt_conn_add()` in `le_conn_complete()` returns
NULL (`"Unable to add new conn for handle"`), no L2CAP/ATT context exists, and
the peer's GATT discovery times out.
- Reproducible with **any** standard HCI controller; the first
connect/disconnect/GATT cycle permanently exhausts the single slot.
### Regression origin
The release was present in `hci_acl()` but was accidentally removed by PR
#9082, commit `dd5abe86914c` ("wireless/bluetooth: fix double buffer free"),
which dropped three lines while fixing an unrelated double-free in the event
path:
```diff
bt_conn_receive(conn, buf, flags);
- bt_conn_release(conn);
```
### Proposed fix
```c
conn = bt_conn_lookup_handle(buf->u.acl.handle);
if (!conn)
{
return;
}
bt_conn_receive(conn, buf, flags);
bt_conn_release(conn);
```
### Reference
Zephyr's `hci_acl()` (the origin of this host stack) does exactly this:
`bt_conn_recv(conn, buf, flags); bt_conn_unref(conn);`.
### On which OS does this issue occur?
[OS: Linux]
### What is the version of your OS?
Ubuntu 22.04.5 LTS
### NuttX Version
master
### Issue Architecture
[Arch: all]
### Issue Area
[Area: Other]
### Host information
_No response_
### Verification
- [x] I have verified before submitting the report.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
