GATTServer crash on late ATT access after disconnect

[stc1988]

Build environment: macOS
Moddable SDK version: 8.3.0
Target device: M5Atom Matrix

Steps to Reproduce

When I modify the AppleMediaService attached to #1633 to use connection.disconnect() and run it, a Guru Meditation Error occurs after connection.disconnect().

instruments: 0,0,0,0,0,0,0,0,0,0,32,56628,3,2,6288,8216,26272,98288,2048,8192,0,3,4,0,6,0
[apple-media-service/client] remote command subscribed
Guru Meditation Error: Core  0 panic'ed (LoadProhibited). Exception was unhandled.

Core  0 register dump:
PC      : 0x400fbf8f  PS      : 0x00060030  A0      : 0x8013e0f9  A1      : 0x3ffd8da0
--- 0x400fbf8f: accessCharacteristic at /Users/satoshi/Projects/moddable/modules/io/ble/server/esp32/bleserver.c:712
A2      : 0x3ffd8e20  A3      : 0x00000008  A4      : 0x3ffbad08  A5      : 0x3ffd92a8
A6      : 0x3ffc8e98  A7      : 0x00060423  A8      : 0x3fff82cc  A9      : 0x00000000
A10     : 0x3ffd5154  A11     : 0x00000000  A12     : 0x00000000  A13     : 0x400fb1a4
--- 0x400fb1a4: readCharacteristic at /Users/satoshi/Projects/moddable/modules/io/ble/server/esp32/bleserver.c:668
A14     : 0x3ffd8da0  A15     : 0x00000003  SAR     : 0x00000007  EXCCAUSE: 0x0000001c
EXCVADDR: 0x00000008  LBEG    : 0x4013755c  LEND    : 0x40137564  LCOUNT  : 0x0000000a
--- 0x4013755c: ble_att_rx_dispatch_entry_find at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att.c:156
--- (inlined by) ble_att_rx_extended at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att.c:562
--- (inlined by) ble_att_rx at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att.c:596
--- 0x40137564: ble_att_rx_extended at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att.c:564
--- (inlined by) ble_att_rx at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att.c:596


Backtrace: 0x400fbf8c:0x3ffd8da0 0x4013e0f6:0x3ffd8de0 0x4013e18e:0x3ffd8e10 0x40143cf8:0x3ffd8e50 0x4014402a:0x3ffd8e90 0x40144704:0x3ffd8ec0 0x401375bc:0x3ffd8f00 0x4013d555:0x3ffd8f40 0x401372d4:0x3ffd8f70 0x401368a5:0x3ffd8fa0 0x401368af:0x3ffd8fc0 0x401d5f17:0x3ffd8fe0 0x40083517:0x3ffd9000 0x400fafea:0x3ffd9030 0x401e6d3a:0x3ffd9050
--- 0x400fbf8c: accessCharacteristic at /Users/satoshi/Projects/moddable/modules/io/ble/server/esp32/bleserver.c:720
--- 0x4013e0f6: ble_gatts_val_access at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_gatts.c:599
--- 0x4013e18e: ble_gatts_chr_val_access at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_gatts.c:646
--- 0x40143cf8: ble_att_svr_read at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att_svr.c:518
--- 0x4014402a: ble_att_svr_read_handle at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att_svr.c:596
--- 0x40144704: ble_att_svr_rx_read at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att_svr.c:1694
--- 0x401375bc: ble_att_rx_extended at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att.c:575
--- (inlined by) ble_att_rx at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_att.c:596
--- 0x4013d555: ble_l2cap_rx at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_l2cap.c:451
--- 0x401372d4: ble_hs_hci_evt_acl_process at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_hs_hci_evt.c:1890
--- 0x401368a5: ble_hs_process_rx_data_queue at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_hs.c:368
--- 0x401368af: ble_hs_event_rx_data at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/nimble/host/src/ble_hs.c:670
--- 0x401d5f17: npl_freertos_event_run at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/porting/npl/freertos/src/npl_os_freertos.c:536
--- 0x40083517: ble_npl_event_run at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/porting/npl/freertos/include/nimble/nimble_npl_os.h:185
--- (inlined by) nimble_port_run at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/bt/host/nimble/nimble/porting/nimble/src/nimble_port.c:422
--- 0x400fafea: xs_ble_nimble_task at /Users/satoshi/Projects/moddable/modules/io/ble/server/esp32/bleserver.c:1224
--- 0x401e6d3a: vPortTaskWrapper at /Users/satoshi/.local/share/esp32/esp-idf-v6.0/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:143

Other information

I’m not sure if this is the fundamental fix, but by adding a NULL check like below, it no longer crashes and the AMS sequence works.

int accessCharacteristic(uint16_t conn_handle, uint16_t attr_handle, struct ble_gatt_access_ctxt *ctxt, void *arg)
{
	BLEGATTServerConnection connection = findConnection(gServer, conn_handle);		//@@ gServer
	if (C_NULL == connection)
		return BLE_ATT_ERR_UNLIKELY;

[phoddie]

The implementation didn't except to be invoked here after disconnect is issued. But, clearly it is possible. The change you propose is reasonable. I applied that and also added checks for the other callers of findConnection() and findCharacteristic() in hope of avoiding future surprises.

Very cool that you have AMS working with the new APIs. That would make a great PR (hint hint). ;)