Skip to content

[Backport v2.4-branch] Bluetooth: host: Fix L2CAP sent callback on disconnected channel #36105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

[Backport v2.4-branch] Bluetooth: host: Fix L2CAP sent callback on disconnected channel #36105

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 22 additions & 6 deletions subsys/bluetooth/host/l2cap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1657,9 +1657,16 @@ static void l2cap_chan_tx_resume(struct bt_l2cap_le_chan *ch)

static void l2cap_chan_sdu_sent(struct bt_conn *conn, void *user_data)
{
struct bt_l2cap_chan *chan = user_data;
uint16_t cid = POINTER_TO_UINT(user_data);
struct bt_l2cap_chan *chan;

BT_DBG("conn %p chan %p", conn, chan);
BT_DBG("conn %p CID 0x%04x", conn, cid);

chan = bt_l2cap_le_lookup_tx_cid(conn, cid);
if (!chan) {
/* Received SDU sent callback for disconnected channel */
return;
}

if (chan->ops->sent) {
chan->ops->sent(chan);
Expand All @@ -1670,9 +1677,16 @@ static void l2cap_chan_sdu_sent(struct bt_conn *conn, void *user_data)

static void l2cap_chan_seg_sent(struct bt_conn *conn, void *user_data)
{
struct bt_l2cap_chan *chan = user_data;
uint16_t cid = POINTER_TO_UINT(user_data);
struct bt_l2cap_chan *chan;

BT_DBG("conn %p chan %p", conn, chan);
BT_DBG("conn %p CID 0x%04x", conn, cid);

chan = bt_l2cap_le_lookup_tx_cid(conn, cid);
if (!chan) {
/* Received segment sent callback for disconnected channel */
return;
}

l2cap_chan_tx_resume(BT_L2CAP_LE_CHAN(chan));
}
Expand Down Expand Up @@ -1734,10 +1748,12 @@ static int l2cap_chan_le_send(struct bt_l2cap_le_chan *ch,
*/
if ((buf == seg || !buf->len) && ch->chan.ops->sent) {
err = bt_l2cap_send_cb(ch->chan.conn, ch->tx.cid, seg,
l2cap_chan_sdu_sent, &ch->chan);
l2cap_chan_sdu_sent,
UINT_TO_POINTER(ch->tx.cid));
} else {
err = bt_l2cap_send_cb(ch->chan.conn, ch->tx.cid, seg,
l2cap_chan_seg_sent, &ch->chan);
l2cap_chan_seg_sent,
UINT_TO_POINTER(ch->tx.cid));
}

if (err) {
Expand Down