From: Wootak Jung <wootak.jung@samsung.com>
Date: Thu, 24 Apr 2025 06:48:25 +0000 (+0900)
Subject: Fix issue where crash occurred when client_s was freed during update service in multi... 
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fheads%2Ftizen;p=platform%2Fcore%2Fapi%2Fbluetooth.git

Fix issue where crash occurred when client_s was freed during update service in multi-thread situation

Change-Id: I5918a7f942d12e2da77c01efe27dc03caefdf9a6
Signed-off-by: Wootak Jung <wootak.jung@samsung.com>
---

diff --git a/src/bluetooth-common.c b/src/bluetooth-common.c
index cdff9ec..633265c 100644
--- a/src/bluetooth-common.c
+++ b/src/bluetooth-common.c
@@ -2644,6 +2644,8 @@ static void __bt_event_proxy(int event, bluetooth_event_param_t *param, void *us
 	case BLUETOOTH_EVENT_GATT_CLIENT_CONNECTED: {
 		bt_gatt_client_s *client_s;
 		bt_gatt_connection_state_changed_cb cb = NULL;
+		bool connected = TRUE;
+		int ret;
 		BT_INFO("BLUETOOTH_EVENT_GATT_CLIENT_CONNECTED");
 		_bt_convert_address_to_string(&device_addr,
 				(bluetooth_device_address_t *)(param->param_data));
@@ -2657,26 +2659,33 @@ static void __bt_event_proxy(int event, bluetooth_event_param_t *param, void *us
 				BT_INFO("GATT Client Connected address[%s]", device_addr);
 				if (client_s)
 					client_s->connected = true;
-				_bt_gatt_client_update_services(client_s);
+				ret = _bt_gatt_client_update_services(client_s);
+				if (ret != BT_ERROR_NONE && ret != BT_ERROR_ALREADY_DONE) {
+					BT_ERR("Update service requst failed. ret: %d", ret);
+					connected = FALSE;
+				}
 			}
 		}
 
 		/*HRP Server*/
-		__bt_hrp_le_connection_state_changed_cb(param->result, device_addr, TRUE);
+		__bt_hrp_le_connection_state_changed_cb(param->result, device_addr, connected);
 
 		/* TDS Seeker */
-		_bt_tds_update_seeker_connection_state_changed(param->result, device_addr, TRUE);
+		_bt_tds_update_seeker_connection_state_changed(param->result, device_addr, connected);
 
 		/* This callback is from bt_gatt_set_connection_state_changed_cb */
 		if (event_index >= 0)
 			cb = bt_event_slot_container[event_index].callback;
 		if (cb)
-			cb(_bt_get_error_code(param->result), TRUE, device_addr,
+			cb(_bt_get_error_code(param->result), connected, device_addr,
 				bt_event_slot_container[event_index].user_data);
 
+		/* To prevent client_s from being freed while update service is in progress */
+		client_s = (bt_gatt_client_s *)_bt_gatt_get_client(device_addr);
+
 		/* This callback is from bt_gatt_client_connect */
 		if (client_s && client_s->client_connection_change_cb)
-			client_s->client_connection_change_cb(_bt_get_error_code(param->result), TRUE, device_addr,
+			client_s->client_connection_change_cb(_bt_get_error_code(param->result), connected, device_addr,
 					client_s->connection_change_user_data);
 
 		g_free(device_addr);