From 87241290e9b418d752e3092c94b596da6962c583 Mon Sep 17 00:00:00 2001 From: Zhi Wei Jian Date: Tue, 14 Jul 2026 12:03:43 +0800 Subject: [PATCH] fix(ble/bluedroid): re-lookup GATT TCB after enc-complete callback (cherry picked from commit 37562af0ea41d1243168edfef604e7caf7a954e6) Co-authored-by: zhiweijian --- .../bt/host/bluedroid/stack/gatt/gatt_auth.c | 58 ++++++++++--------- 1 file changed, 32 insertions(+), 26 deletions(-) diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_auth.c b/components/bt/host/bluedroid/stack/gatt/gatt_auth.c index 90340329dee..78478702a57 100644 --- a/components/bt/host/bluedroid/stack/gatt/gatt_auth.c +++ b/components/bt/host/bluedroid/stack/gatt/gatt_auth.c @@ -233,34 +233,40 @@ void gatt_notify_enc_cmpl(BD_ADDR bd_addr) tGATT_TCB *p_tcb; UINT8 i = 0; - if ((p_tcb = gatt_find_tcb_by_addr(bd_addr, BT_TRANSPORT_LE)) != NULL) { - for (i = 0; i < GATT_MAX_APPS; i++) { - if (gatt_cb.cl_rcb[i].in_use && gatt_cb.cl_rcb[i].app_cb.p_enc_cmpl_cb) { - (*gatt_cb.cl_rcb[i].app_cb.p_enc_cmpl_cb)(gatt_cb.cl_rcb[i].gatt_if, bd_addr); - } - } - - if (gatt_get_sec_act(p_tcb) == GATT_SEC_ENC_PENDING) { - gatt_set_sec_act(p_tcb, GATT_SEC_NONE); - - size_t count = fixed_queue_length(p_tcb->pending_enc_clcb); - for (; count > 0; count--) { - tGATT_PENDING_ENC_CLCB *p_buf = - (tGATT_PENDING_ENC_CLCB *)fixed_queue_dequeue(p_tcb->pending_enc_clcb, 0); - if (p_buf != NULL) { - gatt_security_check_start(p_buf->p_clcb); - osi_free(p_buf); - } else { - break; - } - } - } -#if (BLE_EATT_INCLUDED == TRUE) - gatt_eatt_on_encrypted(bd_addr); -#endif - } else { + if ((p_tcb = gatt_find_tcb_by_addr(bd_addr, BT_TRANSPORT_LE)) == NULL) { GATT_TRACE_DEBUG("notify GATT for encryption completion of unknown device"); + return; } + + for (i = 0; i < GATT_MAX_APPS; i++) { + if (gatt_cb.cl_rcb[i].in_use && gatt_cb.cl_rcb[i].app_cb.p_enc_cmpl_cb) { + (*gatt_cb.cl_rcb[i].app_cb.p_enc_cmpl_cb)(gatt_cb.cl_rcb[i].gatt_if, bd_addr); + } + } + + /* p_tcb may be removed in p_enc_cmpl_cb (e.g. disconnect); re-lookup before use */ + if ((p_tcb = gatt_find_tcb_by_addr(bd_addr, BT_TRANSPORT_LE)) == NULL) { + return; + } + + if (gatt_get_sec_act(p_tcb) == GATT_SEC_ENC_PENDING) { + gatt_set_sec_act(p_tcb, GATT_SEC_NONE); + + size_t count = fixed_queue_length(p_tcb->pending_enc_clcb); + for (; count > 0; count--) { + tGATT_PENDING_ENC_CLCB *p_buf = + (tGATT_PENDING_ENC_CLCB *)fixed_queue_dequeue(p_tcb->pending_enc_clcb, 0); + if (p_buf != NULL) { + gatt_security_check_start(p_buf->p_clcb); + osi_free(p_buf); + } else { + break; + } + } + } +#if (BLE_EATT_INCLUDED == TRUE) + gatt_eatt_on_encrypted(bd_addr); +#endif return; }