acassis opened a new pull request, #20688: URL: https://github.com/apache/nuttx/pull/20688
## Summary bt_hci_cmd_send_sync() puts a semaphore on its own stack and stores a pointer to it in the command buffer, so that the completion handler can wake it. On timeout it destroyed that semaphore and returned without clearing the stored pointer, while g_btdev.sent_cmd still referred to the same buffer. A Command Complete or Command Status arriving after the timeout therefore reached hci_cmd_done(), found the pointer and posted a semaphore belonging to a stack frame that had already returned. The comment just below the timeout already observed that the packet may still be in flight. ## Impact Improvement ## Testing before: ``` bt_buf_release: buf 0x400a4080 ref 2 type 0 bt_buf_release: Remaining references: 1 <- buffer kept (ref 1), pointer dangling btnet_ioctl: Start scan: -5 ERROR: ioctl(SIOCBTSCANSTART) failed: 5 ``` after: ``` hci_cmd_complete: opcode 200c hci_cmd_complete: Unhandled opcode 200c bt_buf_release: buf 0x400a4080 ref 1 type 1 <- just frees the incoming event; no addref(old), no post bt_buf_release: Buffer freed: 0x400a4080 ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
