Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/bluedroid): Fixed potential double Execute Write Response

Browse Source 
(cherry picked from commit 0a93ccd3b3)

Co-authored-by: zhanghaipeng <zhanghaipeng@espressif.com>
This commit is contained in:
Zhang Hai Peng
2026-06-26 20:23:48 +08:00
parent 368c4e3535
commit 38ae6a02f6
2 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
components/bt/host/bluedroid/stack/gatt/gatt_sr.c
View File

@@ -414,6 +414,27 @@ tGATT_STATUS gatt_sr_process_app_rsp (tGATT_TCB *p_tcb, tGATT_IF gatt_if,
UINT32 trans_id, UINT8 op_code,
tGATT_STATUS status, tGATTS_RSP *p_msg)
{
if ((p_tcb->exec_write_rsp_trans_id == trans_id) && (op_code == GATT_REQ_EXEC_WRITE)) {
/*
* Execute Write is a special case without a handle, so both stack and application
* may try to send a response.
* - Stack: may have already sent an automatic Execute Write Response.
* - App: may call esp_gatts_send_response() with the same trans_id.
*
* To prevent sending two responses for the same Execute Write request,
* we check if this trans_id has already been auto-responded by stack.
* If so, ignore the application response without sending another ATT packet.
* Still update cback_cnt/dequeue sr_cmd so state stays consistent when multiple
* apps are registered; only clear exec_write_rsp_trans_id after all apps respond.
*/
gatt_sr_update_cback_cnt(p_tcb, gatt_if, FALSE, FALSE);
if (gatt_sr_is_cback_cnt_zero(p_tcb)) {
gatt_dequeue_sr_cmd(p_tcb);
p_tcb->exec_write_rsp_trans_id = 0;
}
return GATT_SUCCESS;
}
tGATT_STATUS ret_code = GATT_SUCCESS;
UNUSED(trans_id);
@@ -481,6 +502,7 @@ tGATT_STATUS gatt_sr_process_app_rsp (tGATT_TCB *p_tcb, tGATT_IF gatt_if,
*******************************************************************************/
void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data)
{
BOOLEAN response_sent = false;
UINT8 *p = p_data, flag, i = 0;
UINT32 trans_id = 0;
tGATT_IF gatt_if;
@@ -536,6 +558,7 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
is_prepare_write_valid = TRUE;
}
GATT_TRACE_DEBUG("Send execute_write_rsp\n");
response_sent = TRUE;
} else if ((prepare_record->error_code_app == GATT_SUCCESS) &&
(prepare_record->total_num > queue_num)){
//No error for stack_rsp's handles and there exist some app_rsp's handles,
@@ -580,6 +603,10 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, 0);
gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb);
}
/* Record trans_id if stack already sent response, to prevent app from sending duplicate */
if (response_sent) {
p_tcb->exec_write_rsp_trans_id = trans_id;
}
for (i = 0; i < GATT_MAX_APPS; i++) {
if (p_tcb->prep_cnt[i]) {
gatt_if = (tGATT_IF) (i + 1);
@@ -657,6 +684,11 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U
gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb);
}
/* Record trans_id if stack already sent response, to prevent app from sending duplicate */
if (response_sent) {
p_tcb->exec_write_rsp_trans_id = trans_id;
}
for (i = 0; i < GATT_MAX_APPS; i++) {
if (p_tcb->prep_cnt[i]) {
gatt_if = (tGATT_IF) (i + 1);

1
components/bt/host/bluedroid/stack/gatt/include/gatt_int.h
View File

@@ -423,6 +423,7 @@ typedef struct {
UINT8 tcb_idx;
#if (GATTS_INCLUDED == TRUE)
tGATT_PREPARE_WRITE_RECORD prepare_write_record; /* prepare write packets record */
UINT32 exec_write_rsp_trans_id; /* trans_id of auto-responded execute write */
#endif // (GATTS_INCLUDED == TRUE)
} tGATT_TCB;