Skip to content
Browse files

Bluetooth: Make it safe to allocate buffers from TX callback

This makes it safe to allocate buffer from the TX callback by freeing
the context before calling the callback which should wake up the TX
thread had it be pending on add_pending_tx.

Signed-off-by: Luiz Augusto von Dentz <>
  • Loading branch information...
Vudentz authored and jhedberg committed Jun 17, 2019
1 parent 591b0e1 commit db7b9a988b9a46dd97bd573543f1418ba5f1db55
Showing with 13 additions and 1 deletion.
  1. +13 −1 subsys/bluetooth/host/conn.c
@@ -302,13 +302,25 @@ static void tx_free(struct bt_conn_tx *tx)
static void tx_notify_cb(struct k_work *work)
struct bt_conn_tx *tx = CONTAINER_OF(work, struct bt_conn_tx, work);
struct bt_conn *conn;
struct bt_conn_tx_data data;

BT_DBG("tx %p conn %p cb %p user_data %p", tx, tx->conn, tx->data.cb,

tx->data.cb(tx->conn, tx->data.user_data);
/* Copy over the params */
conn = bt_conn_ref(tx->conn);
data = tx->data;

/* Free up TX notify since there may be user waiting */

/* Run the callback, at this point it should be safe to allocate new
* buffers since the TX should have been unblocked by tx_free.
data.cb(conn, data.user_data);


static struct bt_conn *conn_new(void)

0 comments on commit db7b9a9

Please sign in to comment.
You can’t perform that action at this time.