Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 35a9dc4e authored by Jakub Pawlowski's avatar Jakub Pawlowski Committed by android-build-merger
Browse files

Fix for infinite loop in gatt_enc_cmpl_cback am: 25ad8706 

am: 3f25cd53

Change-Id: Ic3bdc7b0ce9b9052fb94d60b86a722f84f0e33c7
parents 7c20d85c 3f25cd53

system/stack/gatt/gatt_api.cc

+2 −2
Original line number Diff line number Diff line
@@ -739,7 +739,7 @@ tGATT_STATUS GATTC_Read(uint16_t conn_id, tGATT_READ_TYPE type, 
  }



  /* start security check */

  gatt_security_check_start(p_clcb);

  if (gatt_security_check_start(p_clcb)) p_tcb->pending_enc_clcb.push(p_clcb);

  return GATT_SUCCESS;

}
@@ -793,7 +793,7 @@ tGATT_STATUS GATTC_Write(uint16_t conn_id, tGATT_WRITE_TYPE type, 
    p->offset = 0;

  }



  gatt_security_check_start(p_clcb);

  if (gatt_security_check_start(p_clcb)) p_tcb->pending_enc_clcb.push(p_clcb);

  return GATT_SUCCESS;

}

system/stack/gatt/gatt_auth.cc

+13 −9
Original line number Diff line number Diff line
@@ -188,11 +188,13 @@ void gatt_enc_cmpl_cback(const RawAddress* bd_addr, tBT_TRANSPORT transport, 
  gatt_sec_check_complete(status, p_clcb, p_tcb->sec_act);



  /* start all other pending operation in queue */

  std::queue<tGATT_CLCB*> new_pending_clcbs;

  while (!p_tcb->pending_enc_clcb.empty()) {

    tGATT_CLCB* p_clcb = p_tcb->pending_enc_clcb.front();

    p_tcb->pending_enc_clcb.pop();

    gatt_security_check_start(p_clcb);

    if (gatt_security_check_start(p_clcb)) new_pending_clcbs.push(p_clcb);

  }

  p_tcb->pending_enc_clcb = new_pending_clcbs;

}



/*******************************************************************************
@@ -223,11 +225,13 @@ void gatt_notify_enc_cmpl(const RawAddress& bd_addr) { 
  if (gatt_get_sec_act(p_tcb) == GATT_SEC_ENC_PENDING) {

    gatt_set_sec_act(p_tcb, GATT_SEC_NONE);



    std::queue<tGATT_CLCB*> new_pending_clcbs;

    while (!p_tcb->pending_enc_clcb.empty()) {

      tGATT_CLCB* p_clcb = p_tcb->pending_enc_clcb.front();

      p_tcb->pending_enc_clcb.pop();

      gatt_security_check_start(p_clcb);

      if (gatt_security_check_start(p_clcb)) new_pending_clcbs.push(p_clcb);

    }

    p_tcb->pending_enc_clcb = new_pending_clcbs;

  }

}

/*******************************************************************************
@@ -397,8 +401,8 @@ static bool gatt_convert_sec_action(tGATT_SEC_ACTION gatt_sec_act, 
  return status;

}



/** check link security */

void gatt_security_check_start(tGATT_CLCB* p_clcb) {

/** check link security, return true if p_clcb should be added back to queue */

bool gatt_security_check_start(tGATT_CLCB* p_clcb) {

  tGATT_TCB* p_tcb = p_clcb->p_tcb;

  tGATT_SEC_ACTION sec_act_old = gatt_get_sec_act(p_tcb);
@@ -430,17 +434,17 @@ void gatt_security_check_start(tGATT_CLCB* p_clcb) { 
          gatt_set_ch_state(p_tcb, GATT_CH_OPEN);



          gatt_end_operation(p_clcb, GATT_INSUF_ENCRYPTION, NULL);

          return;

          return false;

        }

      }

      p_tcb->pending_enc_clcb.push(p_clcb);

      break;

      return true;

    case GATT_SEC_ENC_PENDING:

      p_tcb->pending_enc_clcb.push(p_clcb);

      /* wait for link encrypotion to finish */

      break;

      return true;

    default:

      gatt_sec_check_complete(true, p_clcb, gatt_sec_act);

      break;

  }



  return false;

}

system/stack/gatt/gatt_int.h

+1 −1
Original line number Diff line number Diff line
@@ -536,7 +536,7 @@ extern void gatt_send_queue_write_cancel(tGATT_TCB& tcb, tGATT_CLCB* p_clcb, 
                                         tGATT_EXEC_FLAG flag);



/* gatt_auth.cc */

extern void gatt_security_check_start(tGATT_CLCB* p_clcb);

extern bool gatt_security_check_start(tGATT_CLCB* p_clcb);

extern void gatt_verify_signature(tGATT_TCB& tcb, BT_HDR* p_buf);

extern tGATT_STATUS gatt_get_link_encrypt_status(tGATT_TCB& tcb);

extern tGATT_SEC_ACTION gatt_get_sec_act(tGATT_TCB* p_tcb);