Bluetooth: Mesh: Fix tx seg buffer with NULL pointer reference

anchao · jhedberg · commit 5328adcff5e1 · 2020-08-04T12:47:05.000+03:00
Fix tx seg buffer with NULL pointer reference if enable mesh friendly

Signed-off-by: chao an &lt;anchao@xiaomi.com&gt;
diff --git a/subsys/bluetooth/mesh/transport.c b/subsys/bluetooth/mesh/transport.c
@@ -532,6 +532,8 @@ static int send_seg(struct bt_mesh_net_tx *net_tx, struct net_buf_simple *sdu,
 
 		BT_DBG("seg %u: %s", seg_o, bt_hex(buf, len));
 
+		tx->seg[seg_o] = buf;
+
 		if (IS_ENABLED(CONFIG_BT_MESH_FRIEND)) {
 			enum bt_mesh_friend_pdu_type type;
 
@@ -552,11 +554,11 @@ static int send_seg(struct bt_mesh_net_tx *net_tx, struct net_buf_simple *sdu,
 				 * out through the Friend Queue.
 				 */
 				k_mem_slab_free(&segs, &buf);
-				continue;
+				tx->seg[seg_o] = NULL;
 			}
+
 		}
 
-		tx->seg[seg_o] = buf;
 	}
 
 	/* This can happen if segments only went into the Friend Queue */

Original file line number	Diff line number	Diff line change
`@@ -532,6 +532,8 @@ static int send_seg(struct bt_mesh_net_tx net_tx, struct net_buf_simple sdu,`
`532`	`532`
`533`	`533`	`BT_DBG("seg %u: %s", seg_o, bt_hex(buf, len));`
`534`	`534`
	`535`	`+ tx->seg[seg_o] = buf;`
	`536`	`+`
`535`	`537`	`if (IS_ENABLED(CONFIG_BT_MESH_FRIEND)) {`
`536`	`538`	`enum bt_mesh_friend_pdu_type type;`
`537`	`539`
`@@ -552,11 +554,11 @@ static int send_seg(struct bt_mesh_net_tx net_tx, struct net_buf_simple sdu,`
`552`	`554`	`* out through the Friend Queue.`
`553`	`555`	`*/`
`554`	`556`	`k_mem_slab_free(&segs, &buf);`
`555`		`- continue;`
	`557`	`+ tx->seg[seg_o] = NULL;`
`556`	`558`	`}`
	`559`	`+`
`557`	`560`	`}`
`558`	`561`
`559`		`- tx->seg[seg_o] = buf;`
`560`	`562`	`}`
`561`	`563`
`562`	`564`	`/* This can happen if segments only went into the Friend Queue */`