jerpelea opened a new pull request, #21278: URL: https://github.com/apache/nuttx/pull/21278
## Summary bt_hci_cmd_send_sync() puts a semaphore on its own stack and stores a pointer to it in the command buffer, so that the completion handler can wake it. On timeout it destroyed that semaphore and returned without clearing the stored pointer, while g_btdev.sent_cmd still referred to the same buffer. A Command Complete or Command Status arriving after the timeout therefore reached hci_cmd_done(), found the pointer and posted a semaphore belonging to a stack frame that had already returned. The comment just below the timeout already observed that the packet may still be in flight. Detach the semaphore from the buffer, and drop the pending command that refers to that buffer, before destroying it. This narrows the window rather than closing it: the completion runs in another context and shares no lock with this one. Removing the race needs a command queue with per-command state, which is a larger change, and the code now says so where it matters. Ref: Core v6.0, Vol 4, Part E, 7.7.14 (Command Complete event) Ref: Core v6.0, Vol 4, Part E, 7.7.15 (Command Status event) Testing: builds for sim:bluetooth with Make; every commit in this series verified to build individually. Not yet exercised at runtime - the scriptable controller can withhold a completion past the host timeout, and that case is added separately. ## Impact RELEASE ## Testing CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
