Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 23efd275 authored by William Escande's avatar William Escande Committed by Automerger Merge Worker
Browse files

Merge "Fix a race condition when creating rfcomm servers" am: 4137d4a9 

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/2499376



Change-Id: Ic4db1062bf7c5592181ca8ebb9482659e05c4fc8
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 00deed3c 4137d4a9

system/stack/btm/btm_int_types.h

+2 −0
Original line number Diff line number Diff line
@@ -363,6 +363,7 @@ typedef struct tBTM_CB { 
        kBtmLogHistoryBufferSize);

    CHECK(history_ != nullptr);

    history_->Push(std::string("Initialized btm history"));

    btm_available_index = 1;

  }



  void Free() {
@@ -396,6 +397,7 @@ typedef struct tBTM_CB { 
  friend bool BTM_TryAllocateSCN(uint8_t scn);

  friend bool BTM_FreeSCN(uint8_t scn);

  uint8_t btm_scn[BTM_MAX_SCN_];

  uint8_t btm_available_index;

} tBTM_CB;



/* security action for L2CAP COC channels */

system/stack/btm/btm_scn.cc

+16 −2
Original line number Diff line number Diff line
@@ -32,17 +32,31 @@ extern tBTM_CB btm_cb; 
 *

 ******************************************************************************/

uint8_t BTM_AllocateSCN(void) {

  uint8_t x;

  BTM_TRACE_DEBUG("BTM_AllocateSCN");



  // stack reserves scn 1 for HFP, HSP we still do the correct way

  for (x = 1; x < PORT_MAX_RFC_PORTS; x++) {

  for (uint8_t x = btm_cb.btm_available_index; x < PORT_MAX_RFC_PORTS; x++) {

    if (!btm_cb.btm_scn[x]) {

      btm_cb.btm_scn[x] = true;

      btm_cb.btm_available_index = (x + 1);

      return (x + 1);

    }

  }



  // In order to avoid OOB, btm_available_index must be less than or equal to

  // PORT_MAX_RFC_PORTS

  btm_cb.btm_available_index =

      std::min(btm_cb.btm_available_index, (uint8_t)PORT_MAX_RFC_PORTS);



  // If there's no empty SCN from _last_index to BTM_MAX_SCN.

  for (uint8_t y = 1; y < btm_cb.btm_available_index; y++) {

    if (!btm_cb.btm_scn[y]) {

      btm_cb.btm_scn[y] = true;

      btm_cb.btm_available_index = (y + 1);

      return (y + 1);

    }

  }



  return (0); /* No free ports */

}