Skip to content

BLE: Fix access to attcCb.onDeck and attsCb.prepWriteQueue access #13785

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 20, 2020
Merged

BLE: Fix access to attcCb.onDeck and attsCb.prepWriteQueue access #13785

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
542b725
BLE: Fix incorrect index used to access attsCb.prepWriteQueue in Cordio
pan- Oct 19, 2020
3cab377
BLE: Fix index access to attcCb.onDeck in Cordio.
pan- Oct 19, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/stack/att/attc_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -591,9 +591,9 @@ static void attcConnCback(attCcb_t *pCcb, dmEvt_t *pDmEvt)
}

/* free any req on deck */
if (attcCb.onDeck[pCcb->connId].hdr.event != ATTC_MSG_API_NONE)
if (attcCb.onDeck[pCcb->connId - 1].hdr.event != ATTC_MSG_API_NONE)
{
attcReqClear(pCcb->connId, &attcCb.onDeck[pCcb->connId], status);
attcReqClear(pCcb->connId, &attcCb.onDeck[pCcb->connId - 1], status);
}

for (i = 0; i < ATT_BEARER_MAX; i++)
Expand Down Expand Up @@ -672,7 +672,7 @@ void attcMsgCback(attcApiMsg_t *pMsg)
/* verify no API request already waiting on deck, in progress, or no pending write command
already for this handle */
if (((pCcb->slot == ATT_BEARER_SLOT_ID) &&
(attcCb.onDeck[pCcb->connId].hdr.event != ATTC_MSG_API_NONE)) ||
(attcCb.onDeck[pCcb->connId - 1].hdr.event != ATTC_MSG_API_NONE)) ||
(pCcb->outReq.hdr.event > ATTC_MSG_API_MTU) ||
((pMsg->hdr.event == ATTC_MSG_API_WRITE_CMD) &&
attcPendWriteCmd(pCcb, pMsg->handle)))
Expand All @@ -686,7 +686,7 @@ void attcMsgCback(attcApiMsg_t *pMsg)
if ((pCcb->slot == ATT_BEARER_SLOT_ID) && (pCcb->outReq.hdr.event == ATTC_MSG_API_MTU))
{
/* put request "on deck" for processing later */
attcCb.onDeck[pCcb->connId] = *pMsg;
attcCb.onDeck[pCcb->connId - 1] = *pMsg;
}
/* otherwise ready to send; set up request */
else
Expand All @@ -706,9 +706,9 @@ void attcMsgCback(attcApiMsg_t *pMsg)
}
/* else free any req on deck */
else if ((pCcb->slot == ATT_BEARER_SLOT_ID) &
(attcCb.onDeck[pCcb->connId].hdr.event != ATTC_MSG_API_NONE))
(attcCb.onDeck[pCcb->connId - 1].hdr.event != ATTC_MSG_API_NONE))
{
attcReqClear(pCcb->connId, &attcCb.onDeck[pCcb->connId], ATT_ERR_CANCELLED);
attcReqClear(pCcb->connId, &attcCb.onDeck[pCcb->connId - 1], ATT_ERR_CANCELLED);
}
}
/* else if timeout */
Expand Down
6 changes: 3 additions & 3 deletions connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/stack/att/attc_proc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -410,13 +410,13 @@ void attcProcRsp(attcCcb_t *pCcb, uint16_t len, uint8_t *pPacket)
}
/* else if api is on deck */
else if ((pCcb->slot == ATT_BEARER_SLOT_ID) &&
(attcCb.onDeck[pCcb->connId].hdr.event != ATTC_MSG_API_NONE))
(attcCb.onDeck[pCcb->connId - 1].hdr.event != ATTC_MSG_API_NONE))
{
/* set up and send request */
attcSetupReq(pCcb, &attcCb.onDeck[pCcb->connId]);
attcSetupReq(pCcb, &attcCb.onDeck[pCcb->connId - 1]);

/* clear on deck */
attcCb.onDeck[pCcb->connId].hdr.event = ATTC_MSG_API_NONE;
attcCb.onDeck[pCcb->connId - 1].hdr.event = ATTC_MSG_API_NONE;
}
}
}
Expand Down
4 changes: 2 additions & 2 deletions connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/stack/att/attc_sign.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ static void attcSignMsgCback(attcCcb_t *pCcb, attcSignMsg_t *pMsg)
/* verify no API request already waiting on deck or in progress,
* and no signed write already in progress
*/
if ((attcCb.onDeck[pCcb->connId].hdr.event != ATTC_MSG_API_NONE) ||
if ((attcCb.onDeck[pCcb->connId - 1].hdr.event != ATTC_MSG_API_NONE) ||
(pCcb->outReq.hdr.event > ATTC_MSG_API_MTU) ||
(attcSignCbByConnId((dmConnId_t) pMsg->hdr.param) != NULL))
{
Expand Down Expand Up @@ -238,7 +238,7 @@ static void attcSignMsgCback(attcCcb_t *pCcb, attcSignMsg_t *pMsg)
pCcb->pMainCcb->sccb[ATT_BEARER_SLOT_ID].control & ATT_CCB_STATUS_FLOW_DISABLED)
{
/* put request "on deck" for processing later */
attcCb.onDeck[pCcb->connId] = pCb->msg;
attcCb.onDeck[pCcb->connId - 1] = pCb->msg;
}
/* otherwise ready to send */
else
Expand Down
2 changes: 1 addition & 1 deletion connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/stack/att/atts_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,7 +366,7 @@ void attsClearPrepWrites(attsCcb_t *pCcb)
{
void *pBuf;

while ((pBuf = WsfQueueDeq(&attsCb.prepWriteQueue[pCcb->connId])) != NULL)
while ((pBuf = WsfQueueDeq(&attsCb.prepWriteQueue[pCcb->connId - 1])) != NULL)
{
WsfBufFree(pBuf);
}
Expand Down
8 changes: 4 additions & 4 deletions connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/stack/att/atts_write.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,7 @@ void attsProcPrepWriteReq(attsCcb_t *pCcb, uint16_t len, uint8_t *pPacket)
err = ATT_ERR_LENGTH;
}
/* verify prepare write queue limit not reached */
else if (WsfQueueCount(&attsCb.prepWriteQueue[pCcb->connId]) >= pAttCfg->numPrepWrites)
else if (WsfQueueCount(&attsCb.prepWriteQueue[pCcb->connId - 1]) >= pAttCfg->numPrepWrites)
{
err = ATT_ERR_QUEUE_FULL;
}
Expand All @@ -288,7 +288,7 @@ void attsProcPrepWriteReq(attsCcb_t *pCcb, uint16_t len, uint8_t *pPacket)
pPrep->handle = handle;
pPrep->offset = offset;
memcpy(pPrep->packet, pPacket, writeLen);
WsfQueueEnq(&attsCb.prepWriteQueue[pCcb->connId], pPrep);
WsfQueueEnq(&attsCb.prepWriteQueue[pCcb->connId - 1], pPrep);

/* allocate response buffer */
if ((pBuf = attMsgAlloc(L2C_PAYLOAD_START + ATT_PREP_WRITE_RSP_LEN + writeLen)) != NULL)
Expand Down Expand Up @@ -342,7 +342,7 @@ void attsProcExecWriteReq(attsCcb_t *pCcb, uint16_t len, uint8_t *pPacket)
else if (*pPacket == ATT_EXEC_WRITE_ALL)
{
/* iterate over prepare write queue and verify offset and length */
for (pPrep = attsCb.prepWriteQueue[pCcb->connId].pHead; pPrep != NULL; pPrep = pPrep->pNext)
for (pPrep = attsCb.prepWriteQueue[pCcb->connId - 1].pHead; pPrep != NULL; pPrep = pPrep->pNext)
{
/* find attribute */
if ((pAttr = attsFindByHandle(pPrep->handle, &pGroup)) != NULL)
Expand Down Expand Up @@ -371,7 +371,7 @@ void attsProcExecWriteReq(attsCcb_t *pCcb, uint16_t len, uint8_t *pPacket)
if (err == ATT_SUCCESS)
{
/* for each buffer */
while ((pPrep = WsfQueueDeq(&attsCb.prepWriteQueue[pCcb->connId])) != NULL)
while ((pPrep = WsfQueueDeq(&attsCb.prepWriteQueue[pCcb->connId - 1])) != NULL)
{
/* write buffer */
if ((err = attsExecPrepWrite(pCcb, pPrep)) != ATT_SUCCESS)
Expand Down