Merge branch 'bugfix/fix_hid_memory_leak_v5.5' into 'release/v5.5'

Jiang Jiang Jian · Jiang Jiang Jian · commit 2dc1a9bce6ef · 2025-11-14T10:23:21.000+08:00
fix(bt/bluedroid): Fixed HID memory leak (v5.5)

See merge request espressif/esp-idf!43331
diff --git a/components/bt/common/osi/allocator.c b/components/bt/common/osi/allocator.c
@@ -241,8 +241,5 @@ void *osi_calloc_func(size_t size)
 
 void osi_free_func(void *ptr)
 {
-#if HEAP_MEMORY_DEBUG
-    osi_mem_dbg_clean(ptr, __func__, __LINE__);
-#endif
-    free(ptr);
+    osi_free(ptr);
 }
diff --git a/components/bt/host/bluedroid/api/esp_hidd_api.c b/components/bt/host/bluedroid/api/esp_hidd_api.c
@@ -133,7 +133,7 @@ esp_err_t esp_bt_hid_device_send_report(esp_hidd_report_type_t type, uint8_t id,
     args.send_report.data = data;
 
     bt_status_t stat = btc_transfer_context(&msg, &args, sizeof(btc_hidd_args_t),
-                                                btc_hd_arg_deep_copy, btc_hd_cb_arg_deep_free);
+                                                btc_hd_arg_deep_copy, btc_hd_call_arg_deep_free);
     return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
 }
 
diff --git a/components/bt/host/bluedroid/api/esp_hidh_api.c b/components/bt/host/bluedroid/api/esp_hidh_api.c
@@ -117,7 +117,7 @@ esp_err_t esp_bt_hid_host_set_info(esp_bd_addr_t bd_addr, esp_hidh_hid_info_t *h
     arg.set_info.hid_info = hid_info;
 
     bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_hidh_args_t),
-                                                btc_hh_arg_deep_copy, btc_hh_cb_arg_deep_free);
+                                                btc_hh_arg_deep_copy, btc_hh_call_arg_deep_free);
     return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
 }
 
@@ -224,7 +224,7 @@ esp_err_t esp_bt_hid_host_set_report(esp_bd_addr_t bd_addr, esp_hidh_report_type
     arg.set_report.report = report;
 
     bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_hidh_args_t),
-                                                btc_hh_arg_deep_copy, btc_hh_cb_arg_deep_free);
+                                                btc_hh_arg_deep_copy, btc_hh_call_arg_deep_free);
     return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
 }
 
@@ -243,7 +243,7 @@ esp_err_t esp_bt_hid_host_send_data(esp_bd_addr_t bd_addr, uint8_t *data, size_t
     arg.send_data.data = data;
 
     bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_hidh_args_t),
-                                                btc_hh_arg_deep_copy, btc_hh_cb_arg_deep_free);
+                                                btc_hh_arg_deep_copy, btc_hh_call_arg_deep_free);
     return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;
 }
 
diff --git a/components/bt/host/bluedroid/btc/profile/std/hid/btc_hd.c b/components/bt/host/bluedroid/btc/profile/std/hid/btc_hd.c
@@ -75,6 +75,8 @@ btc_hd_cb_t btc_hd_cb = {0};
 
 typedef void (bt_hid_copy_cb_t)(btc_msg_t *msg, void *p_dest, void *p_src);
 
+static void btc_hd_cb_arg_deep_free(btc_msg_t *msg);
+
 static inline void btc_hd_cb_to_app(esp_hidd_cb_event_t event, esp_hidd_cb_param_t *param)
 {
     esp_hd_cb_t btc_hd_cb = (esp_hd_cb_t)btc_profile_cb_get(BTC_PID_HD);
@@ -705,7 +707,7 @@ static void btc_hd_virtual_cable_unplug(void)
     }
 }
 
-static void btc_hd_call_arg_deep_free(btc_msg_t *msg)
+void btc_hd_call_arg_deep_free(btc_msg_t *msg)
 {
     btc_hidd_args_t *arg = (btc_hidd_args_t *)msg->arg;
 
@@ -756,7 +758,7 @@ void btc_hd_call_handler(btc_msg_t *msg)
     btc_hd_call_arg_deep_free(msg);
 }
 
-void btc_hd_cb_arg_deep_free(btc_msg_t *msg)
+static void btc_hd_cb_arg_deep_free(btc_msg_t *msg)
 {
     tBTA_HD *arg = (tBTA_HD *)msg->arg;
 
diff --git a/components/bt/host/bluedroid/btc/profile/std/hid/btc_hh.c b/components/bt/host/bluedroid/btc/profile/std/hid/btc_hh.c
@@ -64,6 +64,8 @@ static bdstr_t bdstr;
 #define is_hidh_init() (btc_hh_cb.status > BTC_HH_DISABLED)
 #define BTC_TIMEOUT_VUP_MS (3 * 1000)
 
+static void btc_hh_cb_arg_deep_free(btc_msg_t *msg);
+
 static inline void btc_hh_cb_to_app(esp_hidh_cb_event_t event, esp_hidh_cb_param_t *param)
 {
     esp_hh_cb_t btc_hh_cb = (esp_hh_cb_t)btc_profile_cb_get(BTC_PID_HH);
@@ -1097,7 +1099,7 @@ static void btc_hh_set_idle_time(btc_hidh_args_t *arg)
     }
 }
 
-static void btc_hh_call_arg_deep_free(btc_msg_t *msg)
+void btc_hh_call_arg_deep_free(btc_msg_t *msg)
 {
     btc_hidh_args_t *arg = (btc_hidh_args_t *)msg->arg;
 
@@ -1166,7 +1168,7 @@ void btc_hh_call_handler(btc_msg_t *msg)
     btc_hh_call_arg_deep_free(msg);
 }
 
-void btc_hh_cb_arg_deep_free(btc_msg_t *msg)
+static void btc_hh_cb_arg_deep_free(btc_msg_t *msg)
 {
     tBTA_HH *arg = (tBTA_HH *)msg->arg;
 
diff --git a/components/bt/host/bluedroid/btc/profile/std/include/btc_hd.h b/components/bt/host/bluedroid/btc/profile/std/include/btc_hd.h
@@ -99,7 +99,7 @@ void btc_hd_call_handler(btc_msg_t *msg);
 void btc_hd_cb_handler(btc_msg_t *msg);
 
 void btc_hd_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
-void btc_hd_cb_arg_deep_free(btc_msg_t *msg);
+void btc_hd_call_arg_deep_free(btc_msg_t *msg);
 
 void btc_hd_get_profile_status(esp_hidd_profile_status_t *param);
 
diff --git a/components/bt/host/bluedroid/btc/profile/std/include/btc_hh.h b/components/bt/host/bluedroid/btc/profile/std/include/btc_hh.h
@@ -181,8 +181,7 @@ void btc_hh_call_handler(btc_msg_t *msg);
 void btc_hh_cb_handler(btc_msg_t *msg);
 
 void btc_hh_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src);
-
-void btc_hh_cb_arg_deep_free(btc_msg_t *msg);
+void btc_hh_call_arg_deep_free(btc_msg_t *msg);
 
 bool btc_hh_add_added_dev(BD_ADDR bd_addr, uint16_t attr_mask);
 
diff --git a/components/bt/host/bluedroid/stack/hid/hidd_conn.c b/components/bt/host/bluedroid/stack/hid/hidd_conn.c
@@ -775,6 +775,7 @@ tHID_STATUS hidd_conn_send_data(uint8_t channel, uint8_t msg_type, uint8_t param
             }
             return HID_SUCCESS;
         }
+        osi_free(p_buf);
         return HID_ERR_NO_CONNECTION;
     }
 #ifdef REPORT_TRANSFER_TIMESTAMP
diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c b/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c
@@ -25,7 +25,6 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "osi/allocator.h"
 #include "device/controller.h"
 #include "stack/bt_types.h"
 #include "stack/hcimsgs.h"
@@ -36,6 +35,7 @@
 #include "stack/btm_api.h"
 #include "btm_int.h"
 #include "stack/hcidefs.h"
+#include "bt_common.h"
 #include "osi/allocator.h"
 #include "osi/list.h"
 

Original file line number	Diff line number	Diff line change
`@@ -241,8 +241,5 @@ void *osi_calloc_func(size_t size)`
`241`	`241`
`242`	`242`	`void osi_free_func(void *ptr)`
`243`	`243`	`{`
`244`		`-#if HEAP_MEMORY_DEBUG`
`245`		`- osi_mem_dbg_clean(ptr, __func__, __LINE__);`
`246`		`-#endif`
`247`		`- free(ptr);`
	`244`	`+ osi_free(ptr);`
`248`	`245`	`}`
Original file line number	Diff line number	Diff line change
`@@ -133,7 +133,7 @@ esp_err_t esp_bt_hid_device_send_report(esp_hidd_report_type_t type, uint8_t id,`
`133`	`133`	`args.send_report.data = data;`
`134`	`134`
`135`	`135`	`bt_status_t stat = btc_transfer_context(&msg, &args, sizeof(btc_hidd_args_t),`
`136`		`- btc_hd_arg_deep_copy, btc_hd_cb_arg_deep_free);`
	`136`	`+ btc_hd_arg_deep_copy, btc_hd_call_arg_deep_free);`
`137`	`137`	`return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;`
`138`	`138`	`}`
`139`	`139`
Original file line number	Diff line number	Diff line change
`@@ -117,7 +117,7 @@ esp_err_t esp_bt_hid_host_set_info(esp_bd_addr_t bd_addr, esp_hidh_hid_info_t *h`
`117`	`117`	`arg.set_info.hid_info = hid_info;`
`118`	`118`
`119`	`119`	`bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_hidh_args_t),`
`120`		`- btc_hh_arg_deep_copy, btc_hh_cb_arg_deep_free);`
	`120`	`+ btc_hh_arg_deep_copy, btc_hh_call_arg_deep_free);`
`121`	`121`	`return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;`
`122`	`122`	`}`
`123`	`123`
`@@ -224,7 +224,7 @@ esp_err_t esp_bt_hid_host_set_report(esp_bd_addr_t bd_addr, esp_hidh_report_type`
`224`	`224`	`arg.set_report.report = report;`
`225`	`225`
`226`	`226`	`bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_hidh_args_t),`
`227`		`- btc_hh_arg_deep_copy, btc_hh_cb_arg_deep_free);`
	`227`	`+ btc_hh_arg_deep_copy, btc_hh_call_arg_deep_free);`
`228`	`228`	`return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;`
`229`	`229`	`}`
`230`	`230`
`@@ -243,7 +243,7 @@ esp_err_t esp_bt_hid_host_send_data(esp_bd_addr_t bd_addr, uint8_t *data, size_t`
`243`	`243`	`arg.send_data.data = data;`
`244`	`244`
`245`	`245`	`bt_status_t stat = btc_transfer_context(&msg, &arg, sizeof(btc_hidh_args_t),`
`246`		`- btc_hh_arg_deep_copy, btc_hh_cb_arg_deep_free);`
	`246`	`+ btc_hh_arg_deep_copy, btc_hh_call_arg_deep_free);`
`247`	`247`	`return (stat == BT_STATUS_SUCCESS) ? ESP_OK : ESP_FAIL;`
`248`	`248`	`}`
`249`	`249`
Original file line number	Diff line number	Diff line change
`@@ -75,6 +75,8 @@ btc_hd_cb_t btc_hd_cb = {0};`
`75`	`75`
`76`	`76`	`typedef void (bt_hid_copy_cb_t)(btc_msg_t msg, void p_dest, void *p_src);`
`77`	`77`
	`78`	`+static void btc_hd_cb_arg_deep_free(btc_msg_t *msg);`
	`79`	`+`
`78`	`80`	`static inline void btc_hd_cb_to_app(esp_hidd_cb_event_t event, esp_hidd_cb_param_t *param)`
`79`	`81`	`{`
`80`	`82`	`esp_hd_cb_t btc_hd_cb = (esp_hd_cb_t)btc_profile_cb_get(BTC_PID_HD);`
`@@ -705,7 +707,7 @@ static void btc_hd_virtual_cable_unplug(void)`
`705`	`707`	`}`
`706`	`708`	`}`
`707`	`709`
`708`		`-static void btc_hd_call_arg_deep_free(btc_msg_t *msg)`
	`710`	`+void btc_hd_call_arg_deep_free(btc_msg_t *msg)`
`709`	`711`	`{`
`710`	`712`	`btc_hidd_args_t arg = (btc_hidd_args_t )msg->arg;`
`711`	`713`
`@@ -756,7 +758,7 @@ void btc_hd_call_handler(btc_msg_t *msg)`
`756`	`758`	`btc_hd_call_arg_deep_free(msg);`
`757`	`759`	`}`
`758`	`760`
`759`		`-void btc_hd_cb_arg_deep_free(btc_msg_t *msg)`
	`761`	`+static void btc_hd_cb_arg_deep_free(btc_msg_t *msg)`
`760`	`762`	`{`
`761`	`763`	`tBTA_HD arg = (tBTA_HD )msg->arg;`
`762`	`764`
Original file line number	Diff line number	Diff line change
`@@ -64,6 +64,8 @@ static bdstr_t bdstr;`
`64`	`64`	`#define is_hidh_init() (btc_hh_cb.status > BTC_HH_DISABLED)`
`65`	`65`	`#define BTC_TIMEOUT_VUP_MS (3 * 1000)`
`66`	`66`
	`67`	`+static void btc_hh_cb_arg_deep_free(btc_msg_t *msg);`
	`68`	`+`
`67`	`69`	`static inline void btc_hh_cb_to_app(esp_hidh_cb_event_t event, esp_hidh_cb_param_t *param)`
`68`	`70`	`{`
`69`	`71`	`esp_hh_cb_t btc_hh_cb = (esp_hh_cb_t)btc_profile_cb_get(BTC_PID_HH);`
`@@ -1097,7 +1099,7 @@ static void btc_hh_set_idle_time(btc_hidh_args_t *arg)`
`1097`	`1099`	`}`
`1098`	`1100`	`}`
`1099`	`1101`
`1100`		`-static void btc_hh_call_arg_deep_free(btc_msg_t *msg)`
	`1102`	`+void btc_hh_call_arg_deep_free(btc_msg_t *msg)`
`1101`	`1103`	`{`
`1102`	`1104`	`btc_hidh_args_t arg = (btc_hidh_args_t )msg->arg;`
`1103`	`1105`
`@@ -1166,7 +1168,7 @@ void btc_hh_call_handler(btc_msg_t *msg)`
`1166`	`1168`	`btc_hh_call_arg_deep_free(msg);`
`1167`	`1169`	`}`
`1168`	`1170`
`1169`		`-void btc_hh_cb_arg_deep_free(btc_msg_t *msg)`
	`1171`	`+static void btc_hh_cb_arg_deep_free(btc_msg_t *msg)`
`1170`	`1172`	`{`
`1171`	`1173`	`tBTA_HH arg = (tBTA_HH )msg->arg;`
`1172`	`1174`
Original file line number	Diff line number	Diff line change
`@@ -775,6 +775,7 @@ tHID_STATUS hidd_conn_send_data(uint8_t channel, uint8_t msg_type, uint8_t param`
`775`	`775`	`}`
`776`	`776`	`return HID_SUCCESS;`
`777`	`777`	`}`
	`778`	`+ osi_free(p_buf);`
`778`	`779`	`return HID_ERR_NO_CONNECTION;`
`779`	`780`	`}`
`780`	`781`	`#ifdef REPORT_TRANSFER_TIMESTAMP`