Bluetooth: ATT: free current buffer when disconnected

`att_send_process` doesn't pass the errors up the stack, so if a disconnection happens during the allocation of a TX context, it will leak buffers. Fixes zephyrproject-rtos#43718 Signed-off-by: Jonathan Rico <[email protected]>
jori-nordic · Apr 29, 2022 · 2215bf0 · jori-nordic · Apr 29, 2022 · 2215bf0
1 parent 1b10f83
commit 2215bf0
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/subsys/bluetooth/host/att.c b/subsys/bluetooth/host/att.c
@@ -571,7 +571,11 @@ static void att_send_process(struct bt_att *att)
 		}
 	}
 
-	if (err < 0) {
+	if (err == -ENOTCONN) {
+		/* If we are not connected anymore, free the buffer */
+		BT_ERR("Freeing buf %p id %d", buf, net_buf_id(buf));
+		net_buf_unref(buf);
+	} else if (err < 0) {
 		/* Push it back if it could not be send */
 		k_queue_prepend(&att->tx_queue._queue, buf);
 	}