This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new a79734d6dff wireless/bluetooth/bt_hcicore.c: Balance conn and buffer
refs in hci_acl().
a79734d6dff is described below
commit a79734d6dff6445095da772f9c3c16784390a04a
Author: AbhinavMir <[email protected]>
AuthorDate: Thu Aug 13 16:44:19 2026 -0700
wireless/bluetooth/bt_hcicore.c: Balance conn and buffer refs in hci_acl().
hci_acl() looked up the connection with bt_conn_lookup_handle(), which
returns a new reference, but never released it. This leaked one conn
reference for every received ACL packet.
bt_conn_receive() also consumes the buffer on every path: it forwards
to l2cap (which releases) or stores the buffer in conn->rx without an
addref. The hci_rx_work() worker then called bt_buf_release() on the
same buffer, which caused a double free or use-after-free.
Take an extra buffer reference for the worker to release, and release
the connection reference from the lookup.
Assisted-by: Fable
Signed-off-by: AbhinavMir <[email protected]>
---
wireless/bluetooth/bt_hcicore.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/wireless/bluetooth/bt_hcicore.c b/wireless/bluetooth/bt_hcicore.c
index 2cddf6ebdc8..ce6c85d8d35 100644
--- a/wireless/bluetooth/bt_hcicore.c
+++ b/wireless/bluetooth/bt_hcicore.c
@@ -265,7 +265,9 @@ static void hci_acl(FAR struct bt_buf_s *buf)
return;
}
+ bt_buf_addref(buf);
bt_conn_receive(conn, buf, flags);
+ bt_conn_release(conn);
}
/* HCI event processing */
