Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 09e8b6a3 authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "L2CAP: Fix for infinite loop in LE Security Access" am: e0f21887 

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/1913451

Change-Id: Ic252b9f89f63e440f63436e6c810d6ec8985b868
parents 5f09cf43 e0f21887

system/stack/l2cap/l2c_ble.cc

+10 −5
Original line number Diff line number Diff line
@@ -1431,6 +1431,7 @@ void l2cble_sec_comp(const RawAddress* bda, tBT_TRANSPORT transport, 


    if (status != BTM_SUCCESS) {

      (*(p_buf->p_callback))(p_bda, BT_TRANSPORT_LE, p_buf->p_ref_data, status);

      osi_free(p_buf);

    } else {

      if (sec_act == BTM_SEC_ENCRYPT_MITM) {

        if (BTM_IsLinkKeyAuthed(p_bda, transport))
@@ -1448,24 +1449,28 @@ void l2cble_sec_comp(const RawAddress* bda, tBT_TRANSPORT transport, 
        (*(p_buf->p_callback))(p_bda, BT_TRANSPORT_LE, p_buf->p_ref_data,

                               status);

      }

      osi_free(p_buf);

    }

  } else {

    L2CAP_TRACE_WARNING(

        "%s Security complete for request not initiated from L2CAP", __func__);

    return;

  }

  osi_free(p_buf);



  while (!fixed_queue_is_empty(p_lcb->le_sec_pending_q)) {

    p_buf = (tL2CAP_SEC_DATA*)fixed_queue_dequeue(p_lcb->le_sec_pending_q);



    if (status != BTM_SUCCESS)

    if (status != BTM_SUCCESS) {

      (*(p_buf->p_callback))(p_bda, BT_TRANSPORT_LE, p_buf->p_ref_data, status);

    else

      osi_free(p_buf);

    }

    else {

      l2ble_sec_access_req(p_bda, p_buf->psm, p_buf->is_originator,

          p_buf->p_callback, p_buf->p_ref_data);



      osi_free(p_buf);

      break;

    }

  }

}