From b66fa4551ffb2dc0fe818082e9607eed3f51216f Mon Sep 17 00:00:00 2001
From: ShenWeilong <shenweilong@espressif.com>
Date: Wed, 26 Aug 2026 11:41:51 +0800
Subject: [PATCH] fix(bt): fixed mempool deinit crash issue

---
 components/bt/controller/CMakeLists.txt       |  2 +-
 components/bt/host/nimble/nimble              |  2 +-
 components/bt/porting/include/os/os_mempool.h | 23 +++++++++++++++++++
 components/bt/porting/mem/os_mempool.c        | 23 ++++++++++++++++++-
 4 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/components/bt/controller/CMakeLists.txt b/components/bt/controller/CMakeLists.txt
index a035fd7586e..1da8ffb796b 100644
--- a/components/bt/controller/CMakeLists.txt
+++ b/components/bt/controller/CMakeLists.txt
@@ -34,7 +34,7 @@ function(register_bt_ctrl_libs)
         set(lib_path "${CMAKE_CURRENT_FUNCTION_LIST_DIR}/lib_${TARGET_SRC_NAME}/${TARGET_SRC_NAME}-bt-lib")
         # BLE controller library
         if(NOT CONFIG_BT_DUAL_MODE_ARCH OR CONFIG_BT_CTRL_BLE_ENABLE)
-            if(EXISTS "${lib_path}/libble_app.a")
+            if(NOT EXISTS "${lib_path}/${idf_target}")
                 if(CONFIG_BT_CTRL_RUN_IN_FLASH_ONLY AND EXISTS "${lib_path}/libble_app_flash.a")
                     add_prebuilt_library(libble_app "${lib_path}/libble_app_flash.a" REQUIRES esp_phy bt)
                 else()
diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble
index 96ab0e4d864..8d18f6d4ac8 160000
--- a/components/bt/host/nimble/nimble
+++ b/components/bt/host/nimble/nimble
@@ -1 +1 @@
-Subproject commit 96ab0e4d864090777512cddbb4aa8609d598c000
+Subproject commit 8d18f6d4ac821e139bb0ffa72f3eddde9edac42f
diff --git a/components/bt/porting/include/os/os_mempool.h b/components/bt/porting/include/os/os_mempool.h
index 4363d7474c4..825018a7160 100644
--- a/components/bt/porting/include/os/os_mempool.h
+++ b/components/bt/porting/include/os/os_mempool.h
@@ -358,6 +358,29 @@ void os_mempool_flags_set(struct os_mempool *mp, uint8_t flags);
  */
 void os_mempool_flags_clear(struct os_mempool *mp, uint8_t flags);
 
+/**
+ * @brief Deinitialize a memory pool.
+ *
+ * @param mp Pointer to memory pool
+ */
+void os_mempool_deinit(struct os_mempool *mp);
+
+ /**
+ * @brief Deinitialize all of memory pools.
+ *
+ * @param is_controller Whether called from controller.
+ *
+ * @return OS_OK on success; OS_INVALID_PARM if not found corresponding memory pools.
+ */
+os_error_t os_mempool_deinit_all(bool is_controller);
+
+/**
+ * @brief Check if there are any live memory pools.
+ *
+ * @return true if there are any live memory pools; false otherwise.
+ */
+bool os_mempool_has_live_pool(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/components/bt/porting/mem/os_mempool.c b/components/bt/porting/mem/os_mempool.c
index 6f8314c69dc..03b2e599d0a 100644
--- a/components/bt/porting/mem/os_mempool.c
+++ b/components/bt/porting/mem/os_mempool.c
@@ -735,6 +735,11 @@ os_mempool_module_init(void)
 static os_error_t
 os_mempool_mem_free(struct os_mempool *mp)
 {
+    /*  Extended mempool has its own free logic */
+    if (mp->mp_flags & OS_MEMPOOL_F_EXT) {
+        return OS_OK;
+    }
+
     /* For runtime allocation mode, check whether all blocks have been freed */
     if (!(mp->mp_flags & OS_MEMPOOL_F_RUNTIME)) {
         return OS_EINVAL;
@@ -767,8 +772,15 @@ os_mempool_mem_free(struct os_mempool *mp)
 #endif
 
 void
-os_mempool_deinit(bool is_controller)
+os_mempool_deinit(struct os_mempool *mp)
 {
+    os_mempool_unregister(mp);
+}
+
+os_error_t
+os_mempool_deinit_all(bool is_controller)
+{
+    os_error_t err = OS_INVALID_PARM;
     struct os_mempool *mp = NULL;
     struct os_mempool *next = NULL;
 
@@ -780,8 +792,17 @@ os_mempool_deinit(bool is_controller)
             next = STAILQ_NEXT(mp, mp_list);
             os_mempool_unregister(mp);
             mp = next;
+            err = OS_OK;
         } else {
             mp = STAILQ_NEXT(mp, mp_list);
         }
     }
+
+    return err;
+}
+
+bool
+os_mempool_has_live_pool(void)
+{
+    return !STAILQ_EMPTY(&g_os_mempool_list);
 }