From 54e7b74cc1e08a32efe12fc723e3d4d3c9258f14 Mon Sep 17 00:00:00 2001 From: Zhang Hai Peng Date: Fri, 26 Jun 2026 20:23:59 +0800 Subject: [PATCH] fix(ble/bluedroid): Fixed potential double Execute Write Response (cherry picked from commit 0a93ccd3b30852ed563698ec32d0aa02ae1a0b06) Co-authored-by: zhanghaipeng --- .../bt/host/bluedroid/stack/gatt/gatt_sr.c | 32 +++++++++++++++++++ .../bluedroid/stack/gatt/include/gatt_int.h | 1 + 2 files changed, 33 insertions(+) diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_sr.c b/components/bt/host/bluedroid/stack/gatt/gatt_sr.c index b30fd173f0e..41b6db2d184 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_sr.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_sr.c @@ -414,6 +414,27 @@ tGATT_STATUS gatt_sr_process_app_rsp (tGATT_TCB *p_tcb, tGATT_IF gatt_if, UINT32 trans_id, UINT8 op_code, tGATT_STATUS status, tGATTS_RSP *p_msg) { + if ((p_tcb->exec_write_rsp_trans_id == trans_id) && (op_code == GATT_REQ_EXEC_WRITE)) { + /* + * Execute Write is a special case without a handle, so both stack and application + * may try to send a response. + * - Stack: may have already sent an automatic Execute Write Response. + * - App: may call esp_gatts_send_response() with the same trans_id. + * + * To prevent sending two responses for the same Execute Write request, + * we check if this trans_id has already been auto-responded by stack. + * If so, ignore the application response without sending another ATT packet. + * Still update cback_cnt/dequeue sr_cmd so state stays consistent when multiple + * apps are registered; only clear exec_write_rsp_trans_id after all apps respond. + */ + gatt_sr_update_cback_cnt(p_tcb, gatt_if, FALSE, FALSE); + if (gatt_sr_is_cback_cnt_zero(p_tcb)) { + gatt_dequeue_sr_cmd(p_tcb); + p_tcb->exec_write_rsp_trans_id = 0; + } + return GATT_SUCCESS; + } + tGATT_STATUS ret_code = GATT_SUCCESS; UNUSED(trans_id); @@ -481,6 +502,7 @@ tGATT_STATUS gatt_sr_process_app_rsp (tGATT_TCB *p_tcb, tGATT_IF gatt_if, *******************************************************************************/ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, UINT8 *p_data) { + BOOLEAN response_sent = false; UINT8 *p = p_data, flag, i = 0; UINT32 trans_id = 0; tGATT_IF gatt_if; @@ -536,6 +558,7 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U is_prepare_write_valid = TRUE; } GATT_TRACE_DEBUG("Send execute_write_rsp\n"); + response_sent = TRUE; } else if ((prepare_record->error_code_app == GATT_SUCCESS) && (prepare_record->total_num > queue_num)){ //No error for stack_rsp's handles and there exist some app_rsp's handles, @@ -580,6 +603,10 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U trans_id = gatt_sr_enqueue_cmd(p_tcb, op_code, 0); gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb); } + /* Record trans_id if stack already sent response, to prevent app from sending duplicate */ + if (response_sent) { + p_tcb->exec_write_rsp_trans_id = trans_id; + } for (i = 0; i < GATT_MAX_APPS; i++) { if (p_tcb->prep_cnt[i]) { gatt_if = (tGATT_IF) (i + 1); @@ -657,6 +684,11 @@ void gatt_process_exec_write_req (tGATT_TCB *p_tcb, UINT8 op_code, UINT16 len, U gatt_sr_copy_prep_cnt_to_cback_cnt(p_tcb); } + /* Record trans_id if stack already sent response, to prevent app from sending duplicate */ + if (response_sent) { + p_tcb->exec_write_rsp_trans_id = trans_id; + } + for (i = 0; i < GATT_MAX_APPS; i++) { if (p_tcb->prep_cnt[i]) { gatt_if = (tGATT_IF) (i + 1); diff --git a/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h b/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h index 76432c4f1b6..44af16eec70 100644 --- a/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h +++ b/components/bt/host/bluedroid/stack/gatt/include/gatt_int.h @@ -421,6 +421,7 @@ typedef struct { UINT8 tcb_idx; #if (GATTS_INCLUDED == TRUE) tGATT_PREPARE_WRITE_RECORD prepare_write_record; /* prepare write packets record */ + UINT32 exec_write_rsp_trans_id; /* trans_id of auto-responded execute write */ #endif // (GATTS_INCLUDED == TRUE) } tGATT_TCB;