Bluetooth: Controller: Fix isoal_tx_pdu_emit/source_deallocate race
Fix race between isoal_source_deallocate() and
isoal_tx_pdu_emit(). Initiating a local initiated terminate
triggers NULL pointer dereference.
@@ -1429,6 +1429,11 @@ static isoal_status_t isoal_tx_pdu_emit(const struct isoal_source *source_ctx,
/* Retrieve Node handle */
node_tx = produced_pdu->contents.handle;
+ /* Under race condition with isoal_source_deallocate() */
+ if (!node_tx) {
+ return ISOAL_STATUS_ERR_PDU_EMIT;
+ }
+
/* Set payload number */
node_tx->payload_count = payload_number & 0x7fffffffff;
node_tx->sdu_fragments = sdu_fragments;
