From 046e69d92538a3c8ef89acf47cab4b18b99314f8 Mon Sep 17 00:00:00 2001 From: Master Date: Tue, 4 Aug 2026 11:22:15 +0800 Subject: [PATCH] fix(ble_mesh): index last_param by inst_type, not controller inst_id last_param[] is sized by BLE_MESH_ADV_INST_TYPES_NUM (the number of mesh advertising instance types) but was indexed by inst_id, the controller advertising instance id (Kconfig range 0-3). With multi-adv disabled the type count is 1, so any non-zero CONFIG_BLE_MESH_ADV_INST_ID caused an out-of-bounds access into last_param[]. Map inst_id to inst_type with the new bt_mesh_get_adv_inst_type_by_inst_id() helper and index last_param by inst_type in both the nimble and bluedroid host adapters. Add a bounds check at bt_le_ext_adv_start() entry to guard against unmapped instance ids. --- components/bt/esp_ble_mesh/core/adv_common.c | 10 ++++++++++ components/bt/esp_ble_mesh/core/adv_common.h | 2 ++ .../esp_ble_mesh/core/bluedroid_host/adapter.c | 16 ++++++++++++---- .../bt/esp_ble_mesh/core/nimble_host/adapter.c | 16 ++++++++++++---- 4 files changed, 36 insertions(+), 8 deletions(-) diff --git a/components/bt/esp_ble_mesh/core/adv_common.c b/components/bt/esp_ble_mesh/core/adv_common.c index 37790fe10c3..a6fc0f57b33 100644 --- a/components/bt/esp_ble_mesh/core/adv_common.c +++ b/components/bt/esp_ble_mesh/core/adv_common.c @@ -146,6 +146,16 @@ static struct bt_mesh_adv_inst adv_insts[] = { #endif /* CONFIG_BLE_MESH_SUPPORT_MULTI_ADV */ }; +enum bt_mesh_adv_inst_type bt_mesh_get_adv_inst_idx_by_inst_id(uint8_t inst_id) +{ + for (int i = 0; i < ARRAY_SIZE(adv_insts); i++) { + if (adv_insts[i].id == inst_id) { + return i; + } + } + return BLE_MESH_ADV_INST_TYPES_NUM; +} + static struct bt_mesh_adv_inst *find_adv_inst_with_inst_id(uint8_t id) { BT_DBG("FindAdvInstWithID, InstID %u", id); diff --git a/components/bt/esp_ble_mesh/core/adv_common.h b/components/bt/esp_ble_mesh/core/adv_common.h index c52fc18cc3e..a7c3222e992 100644 --- a/components/bt/esp_ble_mesh/core/adv_common.h +++ b/components/bt/esp_ble_mesh/core/adv_common.h @@ -263,6 +263,8 @@ struct bt_mesh_adv_inst *bt_mesh_get_adv_insts_set(void); bool bt_mesh_is_adv_inst_used(uint8_t inst_id); +enum bt_mesh_adv_inst_type bt_mesh_get_adv_inst_idx_by_inst_id(uint8_t inst_id); + int bt_mesh_adv_inst_init(enum bt_mesh_adv_inst_type inst_type, uint8_t inst_id); int bt_mesh_adv_inst_deinit(enum bt_mesh_adv_inst_type inst_type); diff --git a/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c b/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c index 4586dec4f84..54b40d202e8 100644 --- a/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c +++ b/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c @@ -22,6 +22,7 @@ #include "mesh/common.h" #include "prov_pvnr.h" #include "scan.h" +#include "adv_common.h" #include "net.h" #include "beacon.h" #include "btc_ble_mesh_ble.h" @@ -671,6 +672,13 @@ int bt_le_ext_adv_start(const uint8_t inst_id, tBTA_DM_BLE_EXT_ADV ext_adv = {0}; uint16_t interval = 0U; int err = 0; + enum bt_mesh_adv_inst_type inst_type = + bt_mesh_get_adv_inst_idx_by_inst_id(inst_id); + + if (inst_type >= BLE_MESH_ADV_INST_TYPES_NUM) { + BT_ERR("Invalid adv inst id %u", inst_id); + return -EINVAL; + } assert(param); @@ -746,17 +754,17 @@ int bt_le_ext_adv_start(const uint8_t inst_id, ext_adv_params.interval_min = interval; ext_adv_params.interval_max = interval; - if (memcmp(&ext_adv_params, &last_param[inst_id].param, sizeof(tBTA_DM_BLE_GAP_EXT_ADV_PARAMS))) { - if (last_param[inst_id].set) { + if (memcmp(&ext_adv_params, &last_param[inst_type].param, sizeof(tBTA_DM_BLE_GAP_EXT_ADV_PARAMS))) { + if (last_param[inst_type].set) { BTA_DmBleGapExtAdvSetRemove(inst_id); } - last_param[inst_id].set = true; + last_param[inst_type].set = true; /* Check if we can start adv using BTM_BleSetAdvParamsStartAdvCheck */ BTA_DmBleGapExtAdvSetParams(inst_id, &ext_adv_params); - memcpy(&last_param[inst_id].param, &ext_adv_params, sizeof(tBTA_DM_BLE_GAP_EXT_ADV_PARAMS)); + memcpy(&last_param[inst_type].param, &ext_adv_params, sizeof(tBTA_DM_BLE_GAP_EXT_ADV_PARAMS)); } err = set_adv_data(BLE_MESH_HCI_OP_SET_ADV_DATA, inst_id, ad, ad_len); diff --git a/components/bt/esp_ble_mesh/core/nimble_host/adapter.c b/components/bt/esp_ble_mesh/core/nimble_host/adapter.c index 6e1cda17b56..96da8f1643c 100644 --- a/components/bt/esp_ble_mesh/core/nimble_host/adapter.c +++ b/components/bt/esp_ble_mesh/core/nimble_host/adapter.c @@ -20,6 +20,7 @@ #include "mesh/common.h" #include "prov_pvnr.h" #include "scan.h" +#include "adv_common.h" #include "btc_ble_mesh_ble.h" /** @def BT_UUID_MESH_PROV @@ -1184,6 +1185,13 @@ int bt_le_ext_adv_start(const uint8_t inst_id, uint16_t interval = 0; uint8_t buf_len = 0; int err = 0; + enum bt_mesh_adv_inst_type inst_type = + bt_mesh_get_adv_inst_idx_by_inst_id(inst_id); + + if (inst_type >= BLE_MESH_ADV_INST_TYPES_NUM) { + BT_ERR("Invalid adv inst id %u", inst_id); + return -EINVAL; + } err = ble_gap_ext_adv_active(inst_id); if (err) { @@ -1310,9 +1318,9 @@ int bt_le_ext_adv_start(const uint8_t inst_id, adv_params.itvl_min = interval; adv_params.itvl_max = interval; - if (memcmp(&adv_params, &last_param[inst_id].param, + if (memcmp(&adv_params, &last_param[inst_type].param, sizeof(struct ble_gap_ext_adv_params))) { - if (last_param[inst_id].set) { + if (last_param[inst_type].set) { err = ble_gap_ext_adv_remove(inst_id); if (err != 0 && err != BLE_HS_EALREADY) { BT_ERR("Advertising rm failed: err %d", err); @@ -1323,7 +1331,7 @@ int bt_le_ext_adv_start(const uint8_t inst_id, return err; } } - last_param[inst_id].set = true; + last_param[inst_type].set = true; err = ble_gap_ext_adv_configure(inst_id, &adv_params, NULL, gap_event_cb, NULL); if (err != 0) { BT_ERR("Advertising config failed: err %d", err); @@ -1334,7 +1342,7 @@ int bt_le_ext_adv_start(const uint8_t inst_id, return err; } - memcpy(&last_param[inst_id].param, &adv_params, sizeof(struct ble_gap_ext_adv_params)); + memcpy(&last_param[inst_type].param, &adv_params, sizeof(struct ble_gap_ext_adv_params)); } err = ble_gap_ext_adv_set_data(inst_id, data);