Gattserver crashes during discovery when more than 20 writable characteristics added

[cy-kishore]

When more than 20 writable characteristics are added then while adding 21st characteristic it is returning from following code in function insert_characteristic_value_attribute().

if ( _auth_char_count >= MAX_CHARACTERISTIC_AUTHORIZATION_CNT) {
printf(" BLE_ERROR_NO_MEM\n");
return BLE_ERROR_NO_MEM;
}

This error is not getting handled and the subsequent characteristics are getting added with same attribute_it.

This error causes crash during discovery in the following function attsFindServiceGroupEnd().

This issue is found while porting homekit adk and issue is resolved by incrementing MAX_CHARACTERISTIC_AUTHORIZATION_CNT to 25 from 20.

Issue request type

[ ] Question
[ ] Enhancement
[ x] Bug

[ciarmcom]

Internal Jira reference: https://jira.arm.com/browse/MBOCUSTRIA-928

[desmond-blue]

#9921

[cy-kishore]

Hi,
I have looked at the fix. Returning error is fine but this will not solve the actual error we are facing. In Homekit ADK there are more than 20 writable characteristics. So we will not be able to add those characteristics with this fix. As a work around I have increased MAX_CHARACTERISTIC_AUTHORIZATION_CNT to 25 from 20.

Also looking at the code I think there is one more bug in the code which actually causing the issue even though characteristics are only writable characteristics and not authorization characteristics.
I think there is overlap between bitfields of UPDATE_PROPERTIES which is BLE_GATT_CHAR_PROPERTIES_NOTIFY | BLE_GATT_CHAR_PROPERTIES_INDICATE which is 0x30 and ATTS_PERMIT_WRITE which is 0x10. I think this is what is causing it to enter the below condition in the first place.

if ( _auth_char_count >= MAX_CHARACTERISTIC_AUTHORIZATION_CNT) {
printf(" BLE_ERROR_NO_MEM\n");
return BLE_ERROR_NO_MEM;
}

[desmond-blue]

@pan- Would you help on this, why does UPDATE_PROPERTIES be checked for registering authorisation list?

[pan-]

@paul-szczepanek-arm Could you introduce a new configuration parameter for MAX_CHARACTERISTIC_AUTHORIZATION_CNT ?

[paul-szczepanek-arm]

Sure. IOTPAN-405

[cy-kishore]

Fixed in Master branch of mbed. Verified the same