RDKEMW-12176: btrCore_PopulateListOfPairedDevCrash by PreethiLakshmi91 · Pull Request #60 · rdkcentral/bluetooth

PreethiLakshmi91 · 2026-03-24T16:46:01Z

Reason for change: Crash fix
Test Procedure: Device deepsleep causing the crash
Risks: Low
Priority: P2

Copilot

Pull request overview

This PR aims to prevent a crash (reported as a UAF during teardown/deepsleep) by gating btrCore_PopulateListOfPairedDevices() so it won’t run while BTRCore_DeInit() is in progress.

Changes:

Introduces a termination flag (gIsBtrCoreTerminating) intended to block btrCore_PopulateListOfPairedDevices() during teardown.
Sets/clears the termination flag in BTRCore_DeInit() / BTRCore_Init().
Expands deinit logging to include the termination flag value.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-24T16:51:41Z

+/* Prevent UAF during teardown */
+static volatile gint gIsBtrCoreTerminating = 0;
+


gIsBtrCoreTerminating is a module-global flag, so terminating/deinit of one BTRCore handle will affect all handles in the process. Most state in this file is kept per-stBTRCoreHdl, so this introduces cross-instance coupling and can cause hard-to-debug behavior if multiple cores are initialized (or re-initialized) in the same process.

Consider moving the terminating flag into stBTRCoreHdl (per-instance) or switching to an atomic “active handle” pointer check (e.g., g_atomic_pointer_set/get) so calls can be rejected based on which handle is tearing down, rather than globally.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-25T06:18:00Z

    MEMSET_S(pstlhBTRCore, sizeof(stBTRCoreHdl), 0, sizeof(stBTRCoreHdl));

+    /* Assign a new generation for this instance */
+    pstlhBTRCore->generation = g_atomic_int_add(&gBtrCoreGenerationCounter, 1);


g_atomic_int_add(&gBtrCoreGenerationCounter, 1) returns the previous value, but BTRCore_DeInit compares the instance’s generation against g_atomic_int_get(&gBtrCoreGenerationCounter). As written, the comparison will never match (counter is incremented past the stored generation), so gIsBtrCoreTerminating won’t be set and the teardown UAF protection won’t activate. Store the new generation value (e.g., add 1 to the return value) and/or track the active generation explicitly so the comparison is correct.

Suggested change

pstlhBTRCore->generation = g_atomic_int_add(&gBtrCoreGenerationCounter, 1);

{

gint prevGeneration = g_atomic_int_add(&gBtrCoreGenerationCounter, 1);

pstlhBTRCore->generation = prevGeneration + 1;

}

Copilot · 2026-03-25T06:18:00Z

+    /* Only end global teardown if this is the active generation */
+    if (pstlhBTRCore->generation == g_atomic_int_get(&gBtrCoreGenerationCounter)) {
+        g_atomic_int_set(&gIsBtrCoreTerminating, 1);
+    }
+
    pstlhBTRCore = (stBTRCoreHdl*)hBTRCore;



pstlhBTRCore is NULL at this point (it’s assigned from hBTRCore only at line 3712), but the new generation check dereferences pstlhBTRCore->generation, which is an immediate NULL deref/crash. Move this block to after pstlhBTRCore = (stBTRCoreHdl*)hBTRCore; (and ensure the generation/active-generation logic is correct).

Suggested change

/* Only end global teardown if this is the active generation */

if (pstlhBTRCore->generation == g_atomic_int_get(&gBtrCoreGenerationCounter)) {

g_atomic_int_set(&gIsBtrCoreTerminating, 1);

}

pstlhBTRCore = (stBTRCoreHdl*)hBTRCore;

pstlhBTRCore = (stBTRCoreHdl*)hBTRCore;

/* Only end global teardown if this is the active generation */

if (pstlhBTRCore->generation == g_atomic_int_get(&gBtrCoreGenerationCounter)) {

g_atomic_int_set(&gIsBtrCoreTerminating, 1);

}

Copilot · 2026-03-25T06:18:00Z

+static volatile gint gIsBtrCoreTerminating = 0;
+
+/* Track active instance generation */
+static gint gBtrCoreGenerationCounter = 1;


g_atomic_int_get/add/set() expects the atomic variable to be a volatile gint (per GLib API contract). gBtrCoreGenerationCounter is declared as plain gint, which can lead to undefined behavior / compiler reordering on some architectures. Declare it as static volatile gint gBtrCoreGenerationCounter = 1; (and keep all accesses via g_atomic_int_*).

Suggested change

static gint gBtrCoreGenerationCounter = 1;

static volatile gint gBtrCoreGenerationCounter = 1;

Copilot

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-25T09:15:02Z

+    BTRCORELOG_INFO ("Exit Status = %d, gIsBtrCoreTerminating = %d\n", lenBTRCoreRet,
+                      g_atomic_int_get(&gIsBtrCoreTerminating));


gIsBtrCoreTerminating is currently never set to 1 (the only setter in DeInit is commented out), so this log line will always print 0 and adds noise in normal operation. Either set/clear the flag as part of a real teardown guard or drop it from the exit status log.

Suggested change

BTRCORELOG_INFO ("Exit Status = %d, gIsBtrCoreTerminating = %d\n", lenBTRCoreRet,

g_atomic_int_get(&gIsBtrCoreTerminating));

BTRCORELOG_INFO ("Exit Status = %d\n", lenBTRCoreRet);

Copilot · 2026-03-25T09:15:03Z

+    /* Prevent UAF when worker threads run during teardown */
+/*    if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
+        BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n");
+        return enBTRCoreFailure;
+    }*/
+


The intended teardown/UAF guard in btrCore_PopulateListOfPairedDevices is commented out, so this change does not actually prevent the function from running during termination. If this guard is needed, please re-enable it and ensure gIsBtrCoreTerminating is set early in BTRCore_DeInit; otherwise, remove the commented block to avoid dead code.

Suggested change

/* Prevent UAF when worker threads run during teardown */

/* if(g_atomic_int_get(&gIsBtrCoreTerminating)) {

BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n");

return enBTRCoreFailure;

}*/

Copilot · 2026-03-25T09:15:03Z

+    gint                            generation;
 } stBTRCoreHdl;


The new generation field is introduced and assigned, but it is never read/used anywhere in the codebase. Please either implement the intended generation-based teardown protection (and document the invariant) or remove this member to avoid confusing, unused state in the core handle struct.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T20:13:06Z

    BTRCORELOG_INFO ("hBTRCore   =   %8p\n", hBTRCore);
+    BTRCORELOG_WARN("gen: %d, g_gen: %d\n", pstlhBTRCore->generation, g_atomic_int_get(&gBtrCoreGenerationCounter));


BTRCORELOG_WARN("gen: ...") introduces a warning-level log on every BTRCore_DeInit call. This looks like debug instrumentation and may be noisy in production logs; consider lowering this to DEBUG/TRACE or removing it once the issue is validated.

Suggested change

BTRCORELOG_INFO ("hBTRCore = %8p\n", hBTRCore);

BTRCORELOG_WARN("gen: %d, g_gen: %d\n", pstlhBTRCore->generation, g_atomic_int_get(&gBtrCoreGenerationCounter));

BTRCORELOG_INFO ("hBTRCore = %8p\n", hBTRCore);

BTRCORELOG_DEBUG("gen: %d, g_gen: %d\n", pstlhBTRCore->generation, g_atomic_int_get(&gBtrCoreGenerationCounter));

Copilot · 2026-03-27T20:13:07Z

+
+    enBTRCoreRet result = BTRCore_Init(&hBTRCore);
+
+    // Assert
+    TEST_ASSERT_EQUAL(enBTRCoreSuccess, result);
+    TEST_ASSERT_NOT_NULL(hBTRCore);
+
+    // Cleanup
+    BTRCore_DeInit(hBTRCore); // Ensure proper deinitialization
+


test_DeInit_LatestHandle_SetsTermination calls BTRCore_Init without setting up the required mocks/Ignore returns used by the other BTRCore_Init tests. Under CMock this will typically fail due to unexpected calls, or it may attempt real Bluetooth initialization in the unit-test environment. Please stub/Ignore the required BtrCore_* and subsystem calls (similar to test_BTRCore_Init_ValidParameters) and consider resetting the terminator state (btrCore_ResetTerminatorForTest) at the start of the test to avoid cross-test coupling.

Suggested change

enBTRCoreRet result = BTRCore_Init(&hBTRCore);

// Assert

TEST_ASSERT_EQUAL(enBTRCoreSuccess, result);

TEST_ASSERT_NOT_NULL(hBTRCore);

// Cleanup

BTRCore_DeInit(hBTRCore); // Ensure proper deinitialization

stBTRCoreHdl* mockHandle = (stBTRCoreHdl*)malloc(sizeof(stBTRCoreHdl));

/* Ensure terminator state is clean before this test runs */

btrCore_ResetTerminatorForTest();

/* Stub out all dependencies used by BTRCore_Init to avoid real I/O

* and unexpected calls under CMock. This mirrors the setup used

* in other BTRCore_Init tests.

*/

BtrCore_BTInitGetConnection_IgnoreAndReturn((void *)mockHandle);

BtrCore_BTGetAgentPath_IgnoreAndReturn("Agent Path");

BtrCore_BTSendReceiveMessages_IgnoreAndReturn(0);

BtrCore_BTGetAdapterPath_IgnoreAndReturn("Adapter Path");

BtrCore_BTGetProp_IgnoreAndReturn(0);

BTRCore_AVMedia_Init_IgnoreAndReturn(enBTRCoreSuccess);

BTRCore_LE_Init_IgnoreAndReturn(enBTRCoreSuccess);

BtrCore_BTRegisterAdapterStatusUpdateCb_IgnoreAndReturn(0);

BtrCore_BTRegisterDevStatusUpdateCb_IgnoreAndReturn(0);

BtrCore_BTRegisterConnIntimationCb_IgnoreAndReturn(0);

BtrCore_BTRegisterConnAuthCb_IgnoreAndReturn(0);

BTRCore_AVMedia_RegisterMediaStatusUpdateCb_IgnoreAndReturn(enBTRCoreSuccess);

BTRCore_LE_RegisterStatusUpdateCb_IgnoreAndReturn(enBTRCoreSuccess);

BtrCore_BTRegisterMediaStatusUpdateCb_IgnoreAndReturn(0);

BtrCore_BTRegisterNegotiateMediaCb_IgnoreAndReturn(0);

BtrCore_BTRegisterTransportPathMediaCb_IgnoreAndReturn(0);

BtrCore_BTRegisterMediaPlayerPathCb_IgnoreAndReturn(0);

BtrCore_BTRegisterMediaBrowserUpdateCb_IgnoreAndReturn(0);

BtrCore_BTRegisterLEAdvInfoCb_IgnoreAndReturn(0);

BtrCore_BTRegisterLEGattInfoCb_IgnoreAndReturn(0);

BtrCore_BTGetPairedDeviceInfo_IgnoreAndReturn(0);

BtrCore_BTReleaseAdapterPath_IgnoreAndReturn(0);

BtrCore_BTReleaseAgentPath_IgnoreAndReturn(0);

BtrCore_BTDeInitReleaseConnection_IgnoreAndReturn(0);

enBTRCoreRet result = BTRCore_Init(&hBTRCore);

/* Assert that initialization succeeded and returned a valid handle */

TEST_ASSERT_EQUAL(enBTRCoreSuccess, result);

TEST_ASSERT_NOT_NULL(hBTRCore);

/* Cleanup */

free(mockHandle);

BTRCore_DeInit(hBTRCore); /* Ensure proper deinitialization */

/* After deinitialization, the terminator should be set */

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T21:06:28Z

+gint btrCore_AddAndGetCurrGenForTest(void) {
+    /* Return the incremented (current) generation */
+    return g_atomic_int_add(&gBtrCoreGenerationCounter, 1) + 1;
+}
+
+gint btrCore_GetTerminatorForTest(void) {
+    return g_atomic_int_get(&gIsBtrCoreTerminating);
+}


The test helper functions btrCore_AddAndGetCurrGenForTest / btrCore_GetTerminatorForTest are compiled into the main library and exported (not STATIC, not guarded by #ifdef UNIT_TEST). This increases the production ABI surface area and can create accidental dependencies.

Wrap these in #ifdef UNIT_TEST (or similar) and keep them out of non-test builds, or move them to a dedicated test-only compilation unit.

Copilot · 2026-03-27T21:06:28Z

@@ -1740,6 +1820,7 @@ void test_BTRCore_IsDeviceConnectable_pDeviceMac_empty(void) {
    stBTRCoreHdl hBTRCore;
    hBTRCore.numOfPairedDevices = 1;
    hBTRCore.stKnownDevicesArr[0].pcDeviceAddress[0] = "";
+    hBTRCore.generation = btrCore_AddAndGetCurrGenForTest();
    BtrCore_BTIsDeviceConnectable_IgnoreAndReturn(1);


These tests attempt to set a device address by assigning a string literal to a single char element (e.g., pcDeviceAddress[0] = ""). Since pcDeviceAddress is a char[], this assigns a pointer value (implementation-defined truncation) rather than setting the string, making the test setup incorrect and potentially flaky.

Use pcDeviceAddress[0] = '\0' for an empty string, or strncpy/strcpy into pcDeviceAddress for a real address value.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T21:53:11Z


+gint btrCore_AddAndGetCurrGenForTest(void);
+gint btrCore_GetTerminatorForTest(void);
+void btrCore_SetTerminatorForTest(void);
+void btrCore_ResetTerminatorForTest(void);


These *ForTest symbols are being added to the public API surface (include/btrCore.h). This makes test-only hooks available to production consumers and also couples production code (BTRCore_DeInit) to a test-named function. Prefer gating these declarations/definitions behind a unit-test compile flag (e.g., #ifdef UNIT_TEST) or moving them to a dedicated test header, and keep production teardown helpers internal with non-test naming.

Suggested change

gint btrCore_AddAndGetCurrGenForTest(void);

gint btrCore_GetTerminatorForTest(void);

void btrCore_SetTerminatorForTest(void);

void btrCore_ResetTerminatorForTest(void);

#ifdef UNIT_TEST

gint btrCore_AddAndGetCurrGenForTest(void);

gint btrCore_GetTerminatorForTest(void);

void btrCore_SetTerminatorForTest(void);

void btrCore_ResetTerminatorForTest(void);

#endif /* UNIT_TEST */

Copilot · 2026-03-27T21:53:12Z

+    /* Prevent UAF when worker threads run during teardown */
+    if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
+        BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n");


The termination guard is global (gIsBtrCoreTerminating) but does not account for the handle’s generation. Since BTRCore_Init unconditionally resets gIsBtrCoreTerminating back to 0, a new Init happening while an old instance is still tearing down can re-enable work in old threads, reintroducing the UAF scenario. A more robust approach is to validate the handle generation at call sites (e.g., treat a handle as invalid if apsthBTRCore->generation != g_atomic_int_get(&gBtrCoreGenerationCounter)), or use a per-instance termination flag/token rather than a resettable global boolean.

Suggested change

/* Prevent UAF when worker threads run during teardown */

if(g_atomic_int_get(&gIsBtrCoreTerminating)) {

BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n");

/* Prevent UAF when worker threads run during teardown or using stale handles */

if (g_atomic_int_get(&gIsBtrCoreTerminating) ||

(apsthBTRCore->generation != g_atomic_int_get(&gBtrCoreGenerationCounter))) {

BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination or generation mismatch\n");

Copilot · 2026-03-27T21:53:12Z

+    g_atomic_int_set(&gIsBtrCoreTerminating, 0);



Resetting gIsBtrCoreTerminating to 0 during BTRCore_Init can race with an in-progress teardown from a previous instance (or concurrent deinit), potentially allowing worker threads from the previous instance to proceed again. Consider removing this global reset and instead deriving ‘terminating’ from a generation/token check (or store a terminating_generation value) so that a new init cannot clear termination state for older generations.

Suggested change

g_atomic_int_set(&gIsBtrCoreTerminating, 0);

Copilot · 2026-03-27T21:53:12Z

+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);
+    BTRCORELOG_ERROR ("TerminatingIsSetNow to 0, for : gBtrCoreGenerationCounter: %d\n", gBtrCoreGenerationCounter);
+}
+
+void btrCore_SetTerminatorForTest(void) {
+    g_atomic_int_set(&gIsBtrCoreTerminating, 1);
+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);
+    BTRCORELOG_ERROR ("TerminatingIsSetNow to 1, for : gBtrCoreGenerationCounter: %d\n", gBtrCoreGenerationCounter);


Local variable val is unused (same pattern also appears in btrCore_SetTerminatorForTest). This will trigger compiler warnings in many configurations. Remove the unused variable, and consider lowering the log level from BTRCORELOG_ERROR since this is normal test/control flow rather than an error.

Suggested change

gint val = g_atomic_int_get(&gIsBtrCoreTerminating);

BTRCORELOG_ERROR ("TerminatingIsSetNow to 0, for : gBtrCoreGenerationCounter: %d\n", gBtrCoreGenerationCounter);

}

void btrCore_SetTerminatorForTest(void) {

g_atomic_int_set(&gIsBtrCoreTerminating, 1);

gint val = g_atomic_int_get(&gIsBtrCoreTerminating);

BTRCORELOG_ERROR ("TerminatingIsSetNow to 1, for : gBtrCoreGenerationCounter: %d\n", gBtrCoreGenerationCounter);

BTRCORELOG_INFO ("TerminatingIsSetNow to 0, for : gBtrCoreGenerationCounter: %d\n", gBtrCoreGenerationCounter);

}

void btrCore_SetTerminatorForTest(void) {

g_atomic_int_set(&gIsBtrCoreTerminating, 1);

BTRCORELOG_INFO ("TerminatingIsSetNow to 1, for : gBtrCoreGenerationCounter: %d\n", gBtrCoreGenerationCounter);

Copilot · 2026-03-27T21:53:13Z

@@ -4528,6 +4731,7 @@ void test_BTRCore_RegisterStatusCb_hBTRCore_NULL(void) {
 void test_BTRCore_RegisterStatusCb_hBTRCore_Not_NULL_fpcBBTRCoreStatus_NULL(void) {
    stBTRCoreHdl* hBTRCore = malloc(sizeof(hBTRCore));


This allocates only sizeof(pointer) bytes rather than sizeof(stBTRCoreHdl), which can cause heap corruption when the test writes into the struct. Allocate using malloc(sizeof(*hBTRCore)) or malloc(sizeof(stBTRCoreHdl)).

Suggested change

stBTRCoreHdl* hBTRCore = malloc(sizeof(hBTRCore));

stBTRCoreHdl* hBTRCore = malloc(sizeof(*hBTRCore));

Copilot · 2026-03-27T21:53:13Z

    mockProfileList.numberOfService = 2;
    BtrCore_BTGetPairedDeviceInfo_StubWithCallback(_mockgetsupported);
   // btrCore_GetDeviceInfoKnown_ExpectAndReturn(&coreHandle, 1, enBTRCoreUnknown, enBTRCoreSuccess);
   BtrCore_BTDiscoverDeviceServices_StubWithCallback(mock_BTDiscoverDevice);
   // BtrCore_BTDiscoverDeviceServices_ExpectAndReturn(coreHandle.connHdl,coreHandle.curAdapterPath, &mockProfileList, 0);

+   BTRCORELOG_ERROR("Preethi generation: %d\n", coreHandle.generation);


This appears to be ad-hoc debug logging (including a personal name) left in a unit test. It adds noise to test output and can make CI logs harder to interpret. Please remove it or replace with a test assertion if it’s intended to validate behavior.

Suggested change

BTRCORELOG_ERROR("Preethi generation: %d\n", coreHandle.generation);

Copilot · 2026-03-27T21:53:13Z

+#if 0
+void test_DeInit_LatestHandle_SetsTermination(void)
+{


A large block of disabled test code is checked in under #if 0 (and it contains structural issues like extra braces/duplicate blocks). This increases maintenance burden and makes it harder to understand the active test suite. Prefer either removing it, or converting it into proper, enabled unit tests with correct structure—especially since it relates directly to the new termination/generation behavior.

Copilot · 2026-03-27T21:53:13Z

+    if(g_atomic_int_get(&gIsBtrCoreTerminating)) {
+        BTRCORELOG_WARN("btrCore: Ignoring PopulateListOfPairedDevices during termination\n");
        return enBTRCoreFailure;
+    }


New behavior is introduced here (short-circuiting paired-device population during termination), but the diff doesn’t add a focused unit test that sets termination and asserts btrCore_PopulateListOfPairedDevices (or a public wrapper that triggers it) returns enBTRCoreFailure and does not touch freed state. Adding a small targeted test would help prevent regressions of the crash fix.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T22:02:29Z

+#if 0
+{
+    tBTRCoreHandle hBTRCore = NULL;
+    stBTRCoreHdl* mockHandle = (stBTRCoreHdl*)malloc(sizeof(stBTRCoreHdl));
+
+    BtrCore_BTInitGetConnection_IgnoreAndReturn((void *)mockHandle);
+    BtrCore_BTGetAgentPath_IgnoreAndReturn("Agent Path");
+    BtrCore_BTSendReceiveMessages_IgnoreAndReturn(0);
+    BtrCore_BTGetAdapterPath_IgnoreAndReturn("Adapter Path");
+    BtrCore_BTGetProp_IgnoreAndReturn(0);
+    BTRCore_AVMedia_Init_IgnoreAndReturn(enBTRCoreSuccess);
+    BTRCore_LE_Init_IgnoreAndReturn(enBTRCoreSuccess);
+    BtrCore_BTRegisterAdapterStatusUpdateCb_IgnoreAndReturn(0);
+    BtrCore_BTRegisterDevStatusUpdateCb_IgnoreAndReturn(0);
+    BtrCore_BTRegisterConnIntimationCb_IgnoreAndReturn(0);
+    BtrCore_BTRegisterConnAuthCb_IgnoreAndReturn(0);
+    BTRCore_AVMedia_RegisterMediaStatusUpdateCb_IgnoreAndReturn(enBTRCoreSuccess);
+    BTRCore_LE_RegisterStatusUpdateCb_IgnoreAndReturn(enBTRCoreSuccess);
+    BtrCore_BTRegisterMediaStatusUpdateCb_IgnoreAndReturn(0);
+    BtrCore_BTRegisterNegotiateMediaCb_IgnoreAndReturn(0);
+    BtrCore_BTRegisterTransportPathMediaCb_IgnoreAndReturn(0);
+    BtrCore_BTRegisterMediaPlayerPathCb_IgnoreAndReturn(0);
+    BtrCore_BTRegisterMediaBrowserUpdateCb_IgnoreAndReturn(0);
+    BtrCore_BTRegisterLEAdvInfoCb_IgnoreAndReturn(0);
+    BtrCore_BTRegisterLEGattInfoCb_IgnoreAndReturn(0);
+    BtrCore_BTGetPairedDeviceInfo_IgnoreAndReturn(0);
+    BtrCore_BTReleaseAdapterPath_IgnoreAndReturn(0);
+    BtrCore_BTReleaseAgentPath_IgnoreAndReturn(0);
+    BtrCore_BTDeInitReleaseConnection_IgnoreAndReturn(0);
+
+    enBTRCoreRet result = BTRCore_Init(&hBTRCore);
+
+    // Assert
+    TEST_ASSERT_EQUAL(enBTRCoreSuccess, result);
+    TEST_ASSERT_NOT_NULL(hBTRCore);
+
+    // Cleanup
+    free(mockHandle);
+    BTRCore_DeInit(hBTRCore); // Ensure proper deinitialization
+
+    TEST_ASSERT_EQUAL(1, btrCore_GetTerminatorForTest());
+}
+


There is a large #if 0 block with what looks like alternative versions of the DeInit termination tests. Keeping disabled code in the test source makes maintenance harder and can drift out of sync. Please either remove this block or convert the intended scenarios into active tests (with proper mock setup).

Suggested change

#if 0

{

tBTRCoreHandle hBTRCore = NULL;

stBTRCoreHdl* mockHandle = (stBTRCoreHdl*)malloc(sizeof(stBTRCoreHdl));

BtrCore_BTInitGetConnection_IgnoreAndReturn((void *)mockHandle);

BtrCore_BTGetAgentPath_IgnoreAndReturn("Agent Path");

BtrCore_BTSendReceiveMessages_IgnoreAndReturn(0);

BtrCore_BTGetAdapterPath_IgnoreAndReturn("Adapter Path");

BtrCore_BTGetProp_IgnoreAndReturn(0);

BTRCore_AVMedia_Init_IgnoreAndReturn(enBTRCoreSuccess);

BTRCore_LE_Init_IgnoreAndReturn(enBTRCoreSuccess);

BtrCore_BTRegisterAdapterStatusUpdateCb_IgnoreAndReturn(0);

BtrCore_BTRegisterDevStatusUpdateCb_IgnoreAndReturn(0);

BtrCore_BTRegisterConnIntimationCb_IgnoreAndReturn(0);

BtrCore_BTRegisterConnAuthCb_IgnoreAndReturn(0);

BTRCore_AVMedia_RegisterMediaStatusUpdateCb_IgnoreAndReturn(enBTRCoreSuccess);

BTRCore_LE_RegisterStatusUpdateCb_IgnoreAndReturn(enBTRCoreSuccess);

BtrCore_BTRegisterMediaStatusUpdateCb_IgnoreAndReturn(0);

BtrCore_BTRegisterNegotiateMediaCb_IgnoreAndReturn(0);

BtrCore_BTRegisterTransportPathMediaCb_IgnoreAndReturn(0);

BtrCore_BTRegisterMediaPlayerPathCb_IgnoreAndReturn(0);

BtrCore_BTRegisterMediaBrowserUpdateCb_IgnoreAndReturn(0);

BtrCore_BTRegisterLEAdvInfoCb_IgnoreAndReturn(0);

BtrCore_BTRegisterLEGattInfoCb_IgnoreAndReturn(0);

BtrCore_BTGetPairedDeviceInfo_IgnoreAndReturn(0);

BtrCore_BTReleaseAdapterPath_IgnoreAndReturn(0);

BtrCore_BTReleaseAgentPath_IgnoreAndReturn(0);

BtrCore_BTDeInitReleaseConnection_IgnoreAndReturn(0);

enBTRCoreRet result = BTRCore_Init(&hBTRCore);

// Assert

TEST_ASSERT_EQUAL(enBTRCoreSuccess, result);

TEST_ASSERT_NOT_NULL(hBTRCore);

// Cleanup

free(mockHandle);

BTRCore_DeInit(hBTRCore); // Ensure proper deinitialization

TEST_ASSERT_EQUAL(1, btrCore_GetTerminatorForTest());

}

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T22:13:00Z

@@ -4180,6 +4361,7 @@ void test_BTRCore_SetAdvertisementInfo_NullAdvtBeaconName(void) {
    tBTRCoreHandle hBTRCore = (tBTRCoreHandle)1; // Mock handle
    char advtType[] = "Type";

+    /* Invalid handle value - should never be deferenced */
    enBTRCoreRet result = BTRCore_SetAdvertisementInfo(hBTRCore, advtType, NULL);


Typo in comment: “deferenced” should be “dereferenced”.

Copilot · 2026-03-27T22:13:01Z

+    // Cleanup
+    free(mockHandle);


The test frees mockHandle (used as the mocked connHdl) before calling BTRCore_DeInit. In real teardown, BTRCore_DeInit is responsible for releasing connHdl and may pass it to other functions; freeing it first can make the test inconsistent with production behavior and can mask UAF issues. Prefer letting BTRCore_DeInit run first, then free only what it doesn’t own.

Suggested change

// Cleanup

free(mockHandle);

// Cleanup: let BTRCore_DeInit release resources associated with mockHandle

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T22:34:40Z

+    BTRCORELOG_ERROR("Preethi first init completed: %d\n", ((stBTRCoreHdl*)hBTRCore)->generation);
+    tBTRCoreHandle newHBTRCore = NULL;


The added BTRCORELOG_ERROR debug prints containing personal identifiers (e.g., "Preethi ...") are noisy and make test output harder to interpret. Please remove these ad-hoc debug logs or replace them with assertions/comments describing the intent of the test.

Copilot · 2026-03-27T22:34:40Z

+    BTRCORELOG_WARN("gen: %d, g_gen: %d\n", pstlhBTRCore->generation, g_atomic_int_get(&gBtrCoreGenerationCounter));
+
+    /* Only end global teardown if this is the active generation */
+    if (pstlhBTRCore->generation == g_atomic_int_get(&gBtrCoreGenerationCounter)) {
+//        g_atomic_int_set(&gIsBtrCoreTerminating, 1);
+        btrCore_SetTerminatorForTest();
+    }


btrCore_SetTerminatorForTest() is called from production BTRCore_DeInit, but the name/behavior implies a test hook and it logs at ERROR level. Consider replacing this with an internal (static) helper with production-appropriate naming/log level, and keep the test accessor separate/guarded so production teardown doesn't depend on a *ForTest API.

Copilot · 2026-03-27T22:34:40Z

+    free(mockHandle);
+    BTRCore_DeInit(hBTRCore); // Ensure proper deinitialization


This test frees mockHandle before calling BTRCore_DeInit(hBTRCore), but mockHandle is used as connHdl (via BtrCore_BTInitGetConnection_IgnoreAndReturn) and will be passed into BtrCore_BTDeInitReleaseConnection during deinit. Freeing it first can create a dangling pointer and mask/introduce UAF issues in the test. Free mockHandle after BTRCore_DeInit (or let the mock deinit function own it).

Suggested change

free(mockHandle);

BTRCore_DeInit(hBTRCore); // Ensure proper deinitialization

BTRCore_DeInit(hBTRCore); // Ensure proper deinitialization

free(mockHandle);

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T23:00:13Z

+//        g_atomic_int_set(&gIsBtrCoreTerminating, 1);
+        btrCore_SetTerminatorForTest();
+    }



BTRCore_DeInit calls btrCore_SetTerminatorForTest() (and leaves the direct g_atomic_int_set commented out). This ties production teardown behavior to a test-named function and adds error-level logging in a hot path. Please replace this with a production/internal helper (or inline the atomic set) and keep test utilities out of the main DeInit logic.

Suggested change

// g_atomic_int_set(&gIsBtrCoreTerminating, 1);

btrCore_SetTerminatorForTest();

}

g_atomic_int_set(&gIsBtrCoreTerminating, 1);

}

Copilot · 2026-03-27T23:00:14Z

 #define BTCORE_DEFAULT_CONTROLLER_NAME "Game Controller"

+/* Prevent UAF during teardown */
+static volatile gint gIsBtrCoreTerminating = 0;


gIsBtrCoreTerminating is declared volatile but is only accessed via g_atomic_int_* APIs. Mixing volatile with atomic operations is unnecessary and can be misleading; prefer a plain gint (or a dedicated atomic type if available) and rely on the atomic accessors for ordering/visibility.

Suggested change

static volatile gint gIsBtrCoreTerminating = 0;

static gint gIsBtrCoreTerminating = 0;

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T23:20:13Z

+    /* Invalid handle value - should never be deferenced */
    enBTRCoreRet result = BTRCore_SetAdvertisementInfo(hBTRCore, NULL, advtBeaconName);


Typo in comment: "deferenced" should be "dereferenced".

Copilot · 2026-03-27T23:20:14Z

@@ -2890,6 +3008,7 @@ void test_BTRCore_BatteryWriteOTAControl_NullArguments(void) {
    ret = BTRCore_BatteryWriteOTAControl(NULL, 0, "some_uuid", 0);
    TEST_ASSERT_EQUAL(enBTRCoreInvalidArg, ret);

+    /* here, even before unrefering btrCoreHandle, it will return enBTRCoreInvalidArg */


Typo in comment: "unrefering" is misspelled/unclear here; it looks like the intent is "dereferencing" (or "referencing"). Please fix to improve readability.

Suggested change

/* here, even before unrefering btrCoreHandle, it will return enBTRCoreInvalidArg */

/* here, even before dereferencing btrCoreHandle, it will return enBTRCoreInvalidArg */

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+            MEMCPY_S(lstFoundDevice.stAdServiceData[count].pcData, BTRCORE_MAX_SERVICE_DATA_LEN, apstBTDeviceInfo->saServices[count].pcData, lstFoundDevice.stAdServiceData[count].len);

            BTRCORELOG_TRACE ("ServiceData from %s\n", __FUNCTION__);
            for (int i =0; i < apstBTDeviceInfo->saServices[count].len; i++){


+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);
+}
+
+void btrCore_SetTerminatorForTest(void) {
+    g_atomic_int_set(&gIsBtrCoreTerminating, 1);
+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);


+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);
+}
+
+void btrCore_SetTerminatorForTest(void) {
+    g_atomic_int_set(&gIsBtrCoreTerminating, 1);
+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);


Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/btrCore.c:1226

The service-data logging loop iterates using apstBTDeviceInfo->saServices[count].len, but the copied length is now clamped to BTRCORE_MAX_SERVICE_DATA_LEN. If the incoming len exceeds BTRCORE_MAX_SERVICE_DATA_LEN, this loop will read past stAdServiceData[count].pcData. Iterate using the clamped length (e.g., stAdServiceData[count].len) to avoid out-of-bounds reads.

            lstFoundDevice.stAdServiceData[count].len = (apstBTDeviceInfo->saServices[count].len < BTRCORE_MAX_SERVICE_DATA_LEN) ? apstBTDeviceInfo->saServices[count].len : BTRCORE_MAX_SERVICE_DATA_LEN;
            MEMCPY_S(lstFoundDevice.stAdServiceData[count].pcData, BTRCORE_MAX_SERVICE_DATA_LEN, apstBTDeviceInfo->saServices[count].pcData, lstFoundDevice.stAdServiceData[count].len);

            BTRCORELOG_TRACE ("ServiceData from %s\n", __FUNCTION__);
            for (int i =0; i < apstBTDeviceInfo->saServices[count].len; i++){
                BTRCORELOG_TRACE ("ServiceData[%d] = [%x]\n ", i, lstFoundDevice.stAdServiceData[count].pcData[i]);
            }

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);
+}
+
+void btrCore_SetTerminatorForTest(void) {
+    g_atomic_int_set(&gIsBtrCoreTerminating, 1);
+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);


+    - name: Fix Ruby Rake compatibility for Ceedling
+      run: |
+        gem uninstall rake -a -x || true
+        gem install rake -v 13.3.0
+        gem install ceedling -v 0.31.1
+        ruby -v
+        rake -v
+        ceedling version


Copilot

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/btrCore.c:1226

The trace loop uses the unclamped service-data length (apstBTDeviceInfo->saServices[count].len) but indexes into the destination buffer (lstFoundDevice.stAdServiceData[count].pcData). When the incoming length exceeds BTRCORE_MAX_SERVICE_DATA_LEN, this will read past pcData and can crash. Iterate up to lstFoundDevice.stAdServiceData[count].len (the clamped length) or clamp the loop bound the same way.

            BTRCORELOG_TRACE ("ServiceData from %s\n", __FUNCTION__);
            for (int i =0; i < apstBTDeviceInfo->saServices[count].len; i++){
                BTRCORELOG_TRACE ("ServiceData[%d] = [%x]\n ", i, lstFoundDevice.stAdServiceData[count].pcData[i]);
            }

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);
+}
+
+void btrCore_SetTerminatorForTest(void) {
+    g_atomic_int_set(&gIsBtrCoreTerminating, 1);
+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);


+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);
+}
+
+void btrCore_SetTerminatorForTest(void) {
+    g_atomic_int_set(&gIsBtrCoreTerminating, 1);
+    gint val = g_atomic_int_get(&gIsBtrCoreTerminating);


Reason for change: Crash fix Test Procedure: Device deepsleep causing the crash Risks: Low Priority: P2 Signed-off-by: ppalan289 <preethi_palanisamy@comcast.com>

PreethiLakshmi91 requested a review from a team as a code owner March 24, 2026 16:46

Copilot AI review requested due to automatic review settings March 24, 2026 16:46

Copilot started reviewing on behalf of PreethiLakshmi91 March 24, 2026 16:46 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

PreethiLakshmi91 force-pushed the RDKEMW-12176_f branch 2 times, most recently from ba310cd to b58b3be Compare March 25, 2026 06:14

Copilot AI review requested due to automatic review settings March 25, 2026 06:14

Copilot started reviewing on behalf of PreethiLakshmi91 March 25, 2026 06:15 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

PreethiLakshmi91 force-pushed the RDKEMW-12176_f branch from b58b3be to 8099e5a Compare March 25, 2026 06:22

Copilot AI review requested due to automatic review settings March 25, 2026 06:34

PreethiLakshmi91 force-pushed the RDKEMW-12176_f branch from 8099e5a to 1385761 Compare March 25, 2026 06:34

Copilot started reviewing on behalf of PreethiLakshmi91 March 25, 2026 06:35 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

PreethiLakshmi91 force-pushed the RDKEMW-12176_f branch 2 times, most recently from 9ebe22a to 23b1577 Compare March 25, 2026 09:10

Copilot AI review requested due to automatic review settings March 25, 2026 09:10

Copilot started reviewing on behalf of PreethiLakshmi91 March 25, 2026 09:11 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

PreethiLakshmi91 force-pushed the RDKEMW-12176_f branch from 23b1577 to a6dea1a Compare March 25, 2026 09:21

Copilot AI review requested due to automatic review settings March 25, 2026 09:30

PreethiLakshmi91 force-pushed the RDKEMW-12176_f branch from a6dea1a to 3d3c000 Compare March 25, 2026 09:30

Copilot started reviewing on behalf of PreethiLakshmi91 March 25, 2026 09:31 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

PreethiLakshmi91 force-pushed the RDKEMW-12176_f branch from 3d3c000 to 8866a00 Compare March 25, 2026 09:51

Copilot AI review requested due to automatic review settings March 25, 2026 10:21

PreethiLakshmi91 force-pushed the RDKEMW-12176_f branch from 8866a00 to 395cd18 Compare March 25, 2026 10:21

Copilot started reviewing on behalf of PreethiLakshmi91 March 25, 2026 10:22 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Comment thread src/btrCore.c

PreethiLakshmi91 force-pushed the RDKEMW-12176_f branch from 395cd18 to f2235cb Compare March 25, 2026 12:23