ble_mesh: fix client model invalid address access

This commit is contained in:
lly
2019-09-27 20:28:25 +08:00
parent d1e064a34d
commit bd64e6f286
9 changed files with 113 additions and 270 deletions

View File

@@ -299,8 +299,6 @@ static void btc_ble_mesh_client_model_op_cb(struct bt_mesh_model *model,
struct net_buf_simple *buf)
{
esp_ble_mesh_model_cb_param_t mesh_param = {0};
bt_mesh_client_common_t *client_param = NULL;
bt_mesh_internal_data_t *data = NULL;
bt_mesh_client_node_t *node = NULL;
btc_msg_t msg = {0};
bt_status_t ret;
@@ -310,13 +308,6 @@ static void btc_ble_mesh_client_model_op_cb(struct bt_mesh_model *model,
return;
}
client_param = (bt_mesh_client_common_t *)model->user_data;
data = (bt_mesh_internal_data_t *)client_param->internal_data;
if (!data) {
LOG_ERROR("%s, Client internal_data is NULL", __func__);
return;
}
bt_mesh_client_model_lock();
node = bt_mesh_is_model_message_publish(model, ctx, buf, false);
@@ -346,7 +337,7 @@ static void btc_ble_mesh_client_model_op_cb(struct bt_mesh_model *model,
ret = btc_transfer_context(&msg, &mesh_param,
sizeof(esp_ble_mesh_model_cb_param_t), btc_ble_mesh_copy_req_data);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&data->queue, node);
bt_mesh_client_free_node(node);
} else {
ret = BT_STATUS_SUCCESS;
}
@@ -605,44 +596,35 @@ static void btc_prov_register_complete_cb(int err_code)
static void btc_client_model_timeout_cb(struct k_work *work)
{
esp_ble_mesh_model_cb_param_t mesh_param = {0};
bt_mesh_client_common_t *client_param = NULL;
bt_mesh_internal_data_t *data = NULL;
struct k_delayed_work *timer = NULL;
bt_mesh_client_node_t *node = NULL;
btc_msg_t msg = {0};
bt_status_t ret;
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (!node || !node->ctx.model || !node->ctx.model->user_data) {
LOG_ERROR("%s, Invalid parameter", __func__);
return;
}
client_param = (bt_mesh_client_common_t *)node->ctx.model->user_data;
data = (bt_mesh_internal_data_t *)client_param->internal_data;
if (!data) {
LOG_ERROR("%s, Client internal_data is NULL", __func__);
return;
}
bt_mesh_client_model_lock();
if (!k_delayed_work_free(&node->timer)) {
mesh_param.client_send_timeout.opcode = node->opcode;
mesh_param.client_send_timeout.model = (esp_ble_mesh_model_t *)node->ctx.model;
mesh_param.client_send_timeout.ctx = (esp_ble_mesh_msg_ctx_t *)&node->ctx;
timer = CONTAINER_OF(work, struct k_delayed_work, work);
msg.sig = BTC_SIG_API_CB;
msg.pid = BTC_PID_MODEL;
msg.act = ESP_BLE_MESH_CLIENT_MODEL_SEND_TIMEOUT_EVT;
if (timer && !k_delayed_work_free(timer)) {
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (node) {
mesh_param.client_send_timeout.opcode = node->opcode;
mesh_param.client_send_timeout.model = (esp_ble_mesh_model_t *)node->ctx.model;
mesh_param.client_send_timeout.ctx = (esp_ble_mesh_msg_ctx_t *)&node->ctx;
ret = btc_transfer_context(&msg, &mesh_param,
sizeof(esp_ble_mesh_model_cb_param_t), btc_ble_mesh_copy_req_data);
if (ret != BT_STATUS_SUCCESS) {
LOG_ERROR("%s btc_transfer_context failed", __func__);
msg.sig = BTC_SIG_API_CB;
msg.pid = BTC_PID_MODEL;
msg.act = ESP_BLE_MESH_CLIENT_MODEL_SEND_TIMEOUT_EVT;
ret = btc_transfer_context(&msg, &mesh_param,
sizeof(esp_ble_mesh_model_cb_param_t), btc_ble_mesh_copy_req_data);
if (ret != BT_STATUS_SUCCESS) {
LOG_ERROR("%s btc_transfer_context failed", __func__);
}
// Don't forget to release the node at the end.
bt_mesh_client_free_node(node);
}
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&data->queue, node);
}
bt_mesh_client_model_unlock();

View File

@@ -107,37 +107,23 @@ static void bt_mesh_cfg_client_unlock(void)
static void timeout_handler(struct k_work *work)
{
config_internal_data_t *internal = NULL;
bt_mesh_config_client_t *client = NULL;
struct k_delayed_work *timer = NULL;
bt_mesh_client_node_t *node = NULL;
BT_WARN("Receive configuration status message timeout");
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (!node || !node->ctx.model) {
BT_ERR("%s, Invalid parameter", __func__);
return;
}
client = (bt_mesh_config_client_t *)node->ctx.model->user_data;
if (!client) {
BT_ERR("%s, Config Client user_data is NULL", __func__);
return;
}
internal = (config_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Config Client internal_data is NULL", __func__);
return;
}
bt_mesh_cfg_client_lock();
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_config_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
timer = CONTAINER_OF(work, struct k_delayed_work, work);
if (timer && !k_delayed_work_free(timer)) {
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (node) {
bt_mesh_callback_config_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(node);
}
}
bt_mesh_cfg_client_unlock();
@@ -149,7 +135,6 @@ static void cfg_client_cancel(struct bt_mesh_model *model,
struct bt_mesh_msg_ctx *ctx,
void *status, size_t len)
{
config_internal_data_t *data = NULL;
bt_mesh_client_node_t *node = NULL;
struct net_buf_simple buf = {0};
u8_t evt_type = 0xFF;
@@ -159,12 +144,6 @@ static void cfg_client_cancel(struct bt_mesh_model *model,
return;
}
data = (config_internal_data_t *)cli->internal_data;
if (!data) {
BT_ERR("%s, Config Client internal_data is NULL", __func__);
return;
}
/* If it is a publish message, sent to the user directly. */
buf.data = (u8_t *)status;
buf.len = (u16_t)len;
@@ -235,7 +214,7 @@ static void cfg_client_cancel(struct bt_mesh_model *model,
bt_mesh_callback_config_status_to_btc(node->opcode, evt_type, model,
ctx, (const u8_t *)status, len);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&data->queue, node);
bt_mesh_client_free_node(node);
}
}

View File

@@ -63,37 +63,23 @@ static void bt_mesh_health_client_unlock(void)
static void timeout_handler(struct k_work *work)
{
health_internal_data_t *internal = NULL;
bt_mesh_health_client_t *client = NULL;
struct k_delayed_work *timer = NULL;
bt_mesh_client_node_t *node = NULL;
BT_WARN("Receive health status message timeout");
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (!node || !node->ctx.model) {
BT_ERR("%s, Invalid parameter", __func__);
return;
}
client = (bt_mesh_health_client_t *)node->ctx.model->user_data;
if (!client) {
BT_ERR("%s, Health Client user_data is NULL", __func__);
return;
}
internal = (health_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Health Client internal_data is NULL", __func__);
return;
}
bt_mesh_health_client_lock();
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_health_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
timer = CONTAINER_OF(work, struct k_delayed_work, work);
if (timer && !k_delayed_work_free(timer)) {
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (node) {
bt_mesh_callback_health_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(node);
}
}
bt_mesh_health_client_unlock();
@@ -105,7 +91,6 @@ static void health_client_cancel(struct bt_mesh_model *model,
struct bt_mesh_msg_ctx *ctx,
void *status, size_t len)
{
health_internal_data_t *data = NULL;
bt_mesh_client_node_t *node = NULL;
struct net_buf_simple buf = {0};
u8_t evt_type = 0xFF;
@@ -115,12 +100,6 @@ static void health_client_cancel(struct bt_mesh_model *model,
return;
}
data = (health_internal_data_t *)health_cli->internal_data;
if (!data) {
BT_ERR("%s, Health Client internal_data is NULL", __func__);
return;
}
/* If it is a publish message, sent to the user directly. */
buf.data = (u8_t *)status;
buf.len = (u16_t)len;
@@ -151,7 +130,7 @@ static void health_client_cancel(struct bt_mesh_model *model,
bt_mesh_callback_health_status_to_btc(node->opcode, evt_type, model,
ctx, (const u8_t *)status, len);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&data->queue, node);
bt_mesh_client_free_node(node);
}
}

View File

@@ -144,37 +144,23 @@ static void bt_mesh_generic_client_unlock(void)
static void timeout_handler(struct k_work *work)
{
generic_internal_data_t *internal = NULL;
bt_mesh_generic_client_t *client = NULL;
struct k_delayed_work *timer = NULL;
bt_mesh_client_node_t *node = NULL;
BT_WARN("Receive generic status message timeout");
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (!node || !node->ctx.model) {
BT_ERR("%s, Invalid parameter", __func__);
return;
}
client = (bt_mesh_generic_client_t *)node->ctx.model->user_data;
if (!client) {
BT_ERR("%s, Generic Client user_data is NULL", __func__);
return;
}
internal = (generic_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Generic Client internal_data is NULL", __func__);
return;
}
bt_mesh_generic_client_lock();
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_generic_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
timer = CONTAINER_OF(work, struct k_delayed_work, work);
if (timer && !k_delayed_work_free(timer)) {
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (node) {
bt_mesh_callback_generic_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(node);
}
}
bt_mesh_generic_client_unlock();
@@ -186,8 +172,6 @@ static void generic_status(struct bt_mesh_model *model,
struct bt_mesh_msg_ctx *ctx,
struct net_buf_simple *buf)
{
generic_internal_data_t *internal = NULL;
bt_mesh_generic_client_t *client = NULL;
bt_mesh_client_node_t *node = NULL;
u8_t *val = NULL;
u8_t evt = 0xFF;
@@ -196,18 +180,6 @@ static void generic_status(struct bt_mesh_model *model,
BT_DBG("%s, len %d, bytes %s", __func__, buf->len, bt_hex(buf->data, buf->len));
client = (bt_mesh_generic_client_t *)model->user_data;
if (!client) {
BT_ERR("%s, Generic Client user_data is NULL", __func__);
return;
}
internal = (generic_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Generic Client internal_data is NULL", __func__);
return;
}
rsp = ctx->recv_op;
switch (rsp) {
@@ -622,7 +594,7 @@ static void generic_status(struct bt_mesh_model *model,
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_generic_status_to_btc(node->opcode, evt, model, ctx, val, len);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
bt_mesh_client_free_node(node);
}
}

View File

@@ -90,7 +90,7 @@ int bt_mesh_client_send_msg(struct bt_mesh_model *model,
s32_t timeout, bool need_ack,
const struct bt_mesh_send_cb *cb, void *cb_data);
int bt_mesh_client_free_node(sys_slist_t *queue, bt_mesh_client_node_t *node);
int bt_mesh_client_free_node(bt_mesh_client_node_t *node);
enum {
NODE = 0,

View File

@@ -153,37 +153,23 @@ static void bt_mesh_light_client_unlock(void)
static void timeout_handler(struct k_work *work)
{
light_internal_data_t *internal = NULL;
bt_mesh_light_client_t *client = NULL;
struct k_delayed_work *timer = NULL;
bt_mesh_client_node_t *node = NULL;
BT_WARN("Receive light status message timeout");
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (!node || !node->ctx.model) {
BT_ERR("%s, Invalid parameter", __func__);
return;
}
client = (bt_mesh_light_client_t *)node->ctx.model->user_data;
if (!client) {
BT_ERR("%s, Lighting Client user_data is NULL", __func__);
return;
}
internal = (light_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Lighting Client internal_data is NULL", __func__);
return;
}
bt_mesh_light_client_lock();
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_light_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
timer = CONTAINER_OF(work, struct k_delayed_work, work);
if (timer && !k_delayed_work_free(timer)) {
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (node) {
bt_mesh_callback_light_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(node);
}
}
bt_mesh_light_client_unlock();
@@ -195,8 +181,6 @@ static void light_status(struct bt_mesh_model *model,
struct bt_mesh_msg_ctx *ctx,
struct net_buf_simple *buf)
{
light_internal_data_t *internal = NULL;
bt_mesh_light_client_t *client = NULL;
bt_mesh_client_node_t *node = NULL;
u8_t *val = NULL;
u8_t evt = 0xFF;
@@ -205,18 +189,6 @@ static void light_status(struct bt_mesh_model *model,
BT_DBG("%s, len %d, bytes %s", __func__, buf->len, bt_hex(buf->data, buf->len));
client = (bt_mesh_light_client_t *)model->user_data;
if (!client) {
BT_ERR("%s, Lighting Client user_data is NULL", __func__);
return;
}
internal = (light_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Lighting Client internal_data is NULL", __func__);
return;
}
rsp = ctx->recv_op;
switch (rsp) {
@@ -742,7 +714,7 @@ static void light_status(struct bt_mesh_model *model,
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_light_status_to_btc(node->opcode, evt, model, ctx, val, len);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
bt_mesh_client_free_node(node);
}
}

View File

@@ -284,15 +284,30 @@ int bt_mesh_client_init(struct bt_mesh_model *model)
return 0;
}
int bt_mesh_client_free_node(sys_slist_t *queue, bt_mesh_client_node_t *node)
int bt_mesh_client_free_node(bt_mesh_client_node_t *node)
{
if (!queue || !node) {
BT_ERR("%s, Invalid parameter", __func__);
bt_mesh_internal_data_t *internal = NULL;
bt_mesh_client_common_t *client = NULL;
if (!node || !node->ctx.model) {
BT_ERR("%s, Client model list item is NULL", __func__);
return -EINVAL;
}
client = (bt_mesh_client_common_t *)node->ctx.model->user_data;
if (!client) {
BT_ERR("%s, Client model user data is NULL", __func__);
return -EINVAL;
}
internal = (bt_mesh_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Client model internal data is NULL", __func__);
return -EINVAL;
}
// Release the client node from the queue
sys_slist_find_and_remove(queue, &node->client_node);
sys_slist_find_and_remove(&internal->queue, &node->client_node);
// Free the node
osi_free(node);

View File

@@ -82,37 +82,23 @@ static void bt_mesh_sensor_client_unlock(void)
static void timeout_handler(struct k_work *work)
{
sensor_internal_data_t *internal = NULL;
bt_mesh_sensor_client_t *client = NULL;
struct k_delayed_work *timer = NULL;
bt_mesh_client_node_t *node = NULL;
BT_WARN("Receive sensor status message timeout");
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (!node || !node->ctx.model) {
BT_ERR("%s, Invalid parameter", __func__);
return;
}
client = (bt_mesh_sensor_client_t *)node->ctx.model->user_data;
if (!client) {
BT_ERR("%s, Sensor Client user_data is NULL", __func__);
return;
}
internal = (sensor_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Sensor Client internal_data is NULL", __func__);
return;
}
bt_mesh_sensor_client_lock();
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_sensor_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
timer = CONTAINER_OF(work, struct k_delayed_work, work);
if (timer && !k_delayed_work_free(timer)) {
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (node) {
bt_mesh_callback_sensor_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(node);
}
}
bt_mesh_sensor_client_unlock();
@@ -124,8 +110,6 @@ static void sensor_status(struct bt_mesh_model *model,
struct bt_mesh_msg_ctx *ctx,
struct net_buf_simple *buf)
{
sensor_internal_data_t *internal = NULL;
bt_mesh_sensor_client_t *client = NULL;
bt_mesh_client_node_t *node = NULL;
u8_t *val = NULL;
u8_t evt = 0xFF;
@@ -134,18 +118,6 @@ static void sensor_status(struct bt_mesh_model *model,
BT_DBG("%s, len %d, bytes %s", __func__, buf->len, bt_hex(buf->data, buf->len));
client = (bt_mesh_sensor_client_t *)model->user_data;
if (!client) {
BT_ERR("%s, Sensor Client user_data is NULL", __func__);
return;
}
internal = (sensor_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Sensor Client internal_data is NULL", __func__);
return;
}
rsp = ctx->recv_op;
switch (rsp) {
case BLE_MESH_MODEL_OP_SENSOR_DESCRIPTOR_STATUS: {
@@ -326,7 +298,7 @@ static void sensor_status(struct bt_mesh_model *model,
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_sensor_status_to_btc(node->opcode, evt, model, ctx, val, len);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
bt_mesh_client_free_node(node);
}
}

View File

@@ -98,37 +98,23 @@ static void bt_mesh_time_scene_client_unlock(void)
static void timeout_handler(struct k_work *work)
{
time_scene_internal_data_t *internal = NULL;
bt_mesh_time_scene_client_t *client = NULL;
struct k_delayed_work *timer = NULL;
bt_mesh_client_node_t *node = NULL;
BT_WARN("Receive time scene status message timeout");
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (!node || !node->ctx.model) {
BT_ERR("%s, Invalid parameter", __func__);
return;
}
client = (bt_mesh_time_scene_client_t *)node->ctx.model->user_data;
if (!client) {
BT_ERR("%s, Time Scene Client user_data is NULL", __func__);
return;
}
internal = (time_scene_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Time Scene Client internal_data is NULL", __func__);
return;
}
bt_mesh_time_scene_client_lock();
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_time_scene_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
timer = CONTAINER_OF(work, struct k_delayed_work, work);
if (timer && !k_delayed_work_free(timer)) {
node = CONTAINER_OF(work, bt_mesh_client_node_t, timer.work);
if (node) {
bt_mesh_callback_time_scene_status_to_btc(node->opcode, 0x03, node->ctx.model,
&node->ctx, NULL, 0);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(node);
}
}
bt_mesh_time_scene_client_unlock();
@@ -140,8 +126,6 @@ static void time_scene_status(struct bt_mesh_model *model,
struct bt_mesh_msg_ctx *ctx,
struct net_buf_simple *buf)
{
time_scene_internal_data_t *internal = NULL;
bt_mesh_time_scene_client_t *client = NULL;
bt_mesh_client_node_t *node = NULL;
u8_t *val = NULL;
u8_t evt = 0xFF;
@@ -150,18 +134,6 @@ static void time_scene_status(struct bt_mesh_model *model,
BT_DBG("%s, len %d, bytes %s", __func__, buf->len, bt_hex(buf->data, buf->len));
client = (bt_mesh_time_scene_client_t *)model->user_data;
if (!client) {
BT_ERR("%s, Time Scene Client user_data is NULL", __func__);
return;
}
internal = (time_scene_internal_data_t *)client->internal_data;
if (!internal) {
BT_ERR("%s, Time Scene Client internal_data is NULL", __func__);
return;
}
rsp = ctx->recv_op;
switch (rsp) {
case BLE_MESH_MODEL_OP_TIME_STATUS: {
@@ -364,7 +336,7 @@ static void time_scene_status(struct bt_mesh_model *model,
if (!k_delayed_work_free(&node->timer)) {
bt_mesh_callback_time_scene_status_to_btc(node->opcode, evt, model, ctx, val, len);
// Don't forget to release the node at the end.
bt_mesh_client_free_node(&internal->queue, node);
bt_mesh_client_free_node(node);
}
}