Commit 0f335669 authored Jun 03, 2022 by Łukasz Rymanowski

l2cap: Fix handling Enhanced Credit Connection response

This is a regression after
l2cap: Fix for REF responds with same DCIDs for different connections from IUT

The mentioned patch should check rcids which are different than 0.
Otherwise we might end up sending L2CAP Disconnection Request on 0:

> ACL Data RX: Handle 64 flags 0x02 dlen 26
      LE L2CAP: Enhanced Credit Connection Response (0x18) ident 2 len 18
        MTU: 64
        MPS: 247
        Credits: 2
        Result: Some connections refused – not enough resources available (0x0004)
        Destination CID: 66, Source CID: 68
        Destination CID: 0
        Destination CID: 0
        Destination CID: 0
        Destination CID: 0
> HCI Event: Number of Completed Packets (0x13) plen 5
        Num handles: 1
        Handle: 64
        Count: 2

< ACL Data TX: Handle 64 flags 0x00 dlen 12
      LE L2CAP: Disconnection Request (0x06) ident 3 len 4
        Destination CID: 0
        Source CID: 69
< ACL Data TX: Handle 64 flags 0x00 dlen 12
      LE L2CAP: Disconnection Request (0x06) ident 4 len 4
        Destination CID: 0
        Source CID: 70
< ACL Data TX: Handle 64 flags 0x00 dlen 12
      LE L2CAP: Disconnection Request (0x06) ident 5 len 4
        Destination CID: 0
        Source CID: 71
< ACL Data TX: Handle 64 flags 0x00 dlen 12
      LE L2CAP: Disconnection Request (0x06) ident 6 len 4
        Destination CID: 0
        Source CID: 72

Bug: 234817072
Test: Connect with remote supporting 1 EATT only
Change-Id: I9ad7993729d74918b8b2751a036d44a5ddd7fee7

parent d4fb5c4f

system/stack/l2cap/l2c_ble.cc

+21 −15

Original line number	Diff line number	Diff line
		@@ -705,23 +705,29 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) {
		for (int i = 0; i < p_lcb->pending_ecoc_conn_cnt; i++) {
		uint16_t cid = p_lcb->pending_ecoc_connection_cids[i];
		STREAM_TO_UINT16(rcid, p);
		/* if duplicated remote cid then disconnect original channel
		* and current channel by sending event to upper layer */

		if (rcid != 0) {
		/* If remote cid is duplicated then disconnect original channel
		* and current channel by sending event to upper layer
		*/
		temp_p_ccb = l2cu_find_ccb_by_remote_cid(p_lcb, rcid);
		if (temp_p_ccb != nullptr) {
		L2CAP_TRACE_ERROR(
		"Already Allocated Destination cid. "
		"rcid = %d "
		"send peer_disc_req", rcid);
		"send peer_disc_req",
		rcid);

		l2cu_send_peer_disc_req(temp_p_ccb);

		temp_p_ccb = l2cu_find_ccb_by_cid(p_lcb, cid);
		con_info.l2cap_result = L2CAP_LE_RESULT_UNACCEPTABLE_PARAMETERS;
		l2c_csm_execute(temp_p_ccb, L2CEVT_L2CAP_CREDIT_BASED_CONNECT_RSP_NEG,
		l2c_csm_execute(temp_p_ccb,
		L2CEVT_L2CAP_CREDIT_BASED_CONNECT_RSP_NEG,
		&con_info);
		continue;
		}
		}

		temp_p_ccb = l2cu_find_ccb_by_cid(p_lcb, cid);
		temp_p_ccb->remote_cid = rcid;