Use Bind in BTA_JvL2capWrite (66c7584d) · Commits · e / os / android_packages_modules_Bluetooth

system/bta/jv/bta_jv_act.cc

+36 −54

Original line number	Diff line number	Diff line
		@@ -1184,65 +1184,47 @@ void bta_jv_l2cap_read(tBTA_JV_MSG* p_data) {
		rc->p_cback(BTA_JV_L2CAP_READ_EVT, &bta_jv, rc->l2cap_socket_id);
		}

		/*******************************************************************************
		*
		* Function bta_jv_l2cap_write
		*
		* Description Write data to an L2CAP connection
		*
		* Returns void
		*
		******************************************************************************/
		void bta_jv_l2cap_write(tBTA_JV_MSG* p_data) {
		tBTA_JV_L2CAP_WRITE evt_data;
		tBTA_JV_API_L2CAP_WRITE* ls = &(p_data->l2cap_write);

		/* Write data to an L2CAP connection */
		void bta_jv_l2cap_write(uint32_t handle, uint32_t req_id, uint8_t* p_data,
		uint16_t len, uint32_t user_id, tBTA_JV_L2C_CB* p_cb) {
		/* As we check this callback exists before the tBTA_JV_API_L2CAP_WRITE can be
		* send through the
		* API this check should not be needed.
		* But the API is not designed to be used (safely at least) in a
		* multi-threaded scheduler, hence
		* send through the API this check should not be needed. But the API is not
		* designed to be used (safely at least) in a multi-threaded scheduler, hence
		* if the peer device disconnects the l2cap link after the API is called, but
		* before this
		* message is handled, the ->p_cback will be cleared at this point. At first
		* glanch this seems
		* highly unlikely, but for all obex-profiles with two channels connected -
		* e.g. MAP, this
		* happens around 1 of 4 disconnects, as a disconnect on the server channel
		* causes a disconnect
		* before this message is handled, the ->p_cback will be cleared at this
		* point. At first glanch this seems highly unlikely, but for all
		* obex-profiles with two channels connected - e.g. MAP, this happens around 1
		* of 4 disconnects, as a disconnect on the server channel causes a disconnect
		* to be send on the client (notification) channel, but at the peer typically
		* disconnects both
		* the OBEX disconnect request crosses the incoming l2cap disconnect.
		* If p_cback is cleared, we simply discard the data.
		* RISK: The caller must handle any cleanup based on another signal than
		* BTA_JV_L2CAP_WRITE_EVT,
		* which is typically not possible, as the pointer to the allocated
		* buffer is stored
		* in this message, and can therefore not be freed, hence we have a
		* mem-leak-by-design.*/
		if (ls->p_cb->p_cback != NULL) {
		* disconnects both the OBEX disconnect request crosses the incoming l2cap
		* disconnect. If p_cback is cleared, we simply discard the data. RISK: The
		* caller must handle any cleanup based on another signal than
		* BTA_JV_L2CAP_WRITE_EVT, which is typically not possible, as the pointer to
		* the allocated buffer is stored in this message, and can therefore not be
		* freed, hence we have a mem-leak-by-design.*/
		if (!p_cb->p_cback) {
		/* As this pointer is checked in the API function, this occurs only when the
		* channel is disconnected after the API function is called, but before the
		* message is handled. */
		APPL_TRACE_ERROR("%s() p_cb->p_cback == NULL", __func__);
		return;
		}

		tBTA_JV_L2CAP_WRITE evt_data;
		evt_data.status = BTA_JV_FAILURE;
		evt_data.handle = ls->handle;
		evt_data.req_id = ls->req_id;
		evt_data.p_data = ls->p_data;
		evt_data.cong = ls->p_cb->cong;
		evt_data.handle = handle;
		evt_data.req_id = req_id;
		evt_data.p_data = p_data;
		evt_data.cong = p_cb->cong;
		evt_data.len = 0;
		bta_jv_pm_conn_busy(ls->p_cb->p_pm_cb);
		bta_jv_pm_conn_busy(p_cb->p_pm_cb);
		if (!evt_data.cong &&
		BT_PASS ==
		GAP_ConnWriteData(ls->handle, ls->p_data, ls->len, &evt_data.len)) {
		BT_PASS == GAP_ConnWriteData(handle, p_data, len, &evt_data.len)) {
		evt_data.status = BTA_JV_SUCCESS;
		}
		tBTA_JV bta_jv;
		bta_jv.l2c_write = evt_data;
		ls->p_cb->p_cback(BTA_JV_L2CAP_WRITE_EVT, &bta_jv, ls->user_id);
		} else {
		/* As this pointer is checked in the API function, this occurs only when the
		* channel is
		* disconnected after the API function is called, but before the message is
		* handled. */
		APPL_TRACE_ERROR("%s() ls->p_cb->p_cback == NULL", __func__);
		}
		p_cb->p_cback(BTA_JV_L2CAP_WRITE_EVT, &bta_jv, user_id);
		}

		/*******************************************************************************

system/bta/jv/bta_jv_api.cc

+5 −18

Original line number	Diff line number	Diff line
		@@ -544,27 +544,14 @@ tBTA_JV_STATUS BTA_JvL2capReady(uint32_t handle, uint32_t* p_data_size) {
		tBTA_JV_STATUS BTA_JvL2capWrite(uint32_t handle, uint32_t req_id,
		uint8_t* p_data, uint16_t len,
		uint32_t user_id) {
		tBTA_JV_STATUS status = BTA_JV_FAILURE;

		APPL_TRACE_API("%s", __func__);

		if (handle < BTA_JV_MAX_L2C_CONN && bta_jv_cb.l2c_cb[handle].p_cback) {
		tBTA_JV_API_L2CAP_WRITE* p_msg =
		(tBTA_JV_API_L2CAP_WRITE*)osi_malloc(sizeof(tBTA_JV_API_L2CAP_WRITE));
		p_msg->hdr.event = BTA_JV_API_L2CAP_WRITE_EVT;
		p_msg->handle = handle;
		p_msg->req_id = req_id;
		p_msg->p_data = p_data;
		p_msg->p_cb = &bta_jv_cb.l2c_cb[handle];
		p_msg->len = len;
		p_msg->user_id = user_id;

		bta_sys_sendmsg(p_msg);

		status = BTA_JV_SUCCESS;
		}
		if (handle >= BTA_JV_MAX_L2C_CONN \|\| !bta_jv_cb.l2c_cb[handle].p_cback)
		return BTA_JV_FAILURE;

		return status;
		do_in_bta_thread(FROM_HERE, Bind(&bta_jv_l2cap_write, handle, req_id, p_data,
		len, user_id, &bta_jv_cb.l2c_cb[handle]));
		return BTA_JV_SUCCESS;
		}

		/*******************************************************************************

system/bta/jv/bta_jv_int.h

+3 −14

Original line number	Diff line number	Diff line
		@@ -40,7 +40,6 @@ enum {
		/* these events are handled by the state machine */
		BTA_JV_API_START_DISCOVERY_EVT = BTA_SYS_EVT_START(BTA_ID_JV),
		BTA_JV_API_L2CAP_READ_EVT,
		BTA_JV_API_L2CAP_WRITE_EVT,
		BTA_JV_API_RFCOMM_CONNECT_EVT,
		BTA_JV_API_RFCOMM_CLOSE_EVT,
		BTA_JV_API_RFCOMM_START_SERVER_EVT,
		@@ -144,17 +143,6 @@ typedef struct {
		uint32_t l2cap_socket_id;
		} tBTA_JV_API_L2CAP_READ;

		/* data type for BTA_JV_API_L2CAP_WRITE_EVT */
		typedef struct {
		BT_HDR hdr;
		uint32_t handle;
		uint32_t req_id;
		tBTA_JV_L2C_CB* p_cb;
		uint8_t* p_data;
		uint16_t len;
		uint32_t user_id;
		} tBTA_JV_API_L2CAP_WRITE;

		/* data type for BTA_JV_API_L2CAP_WRITE_FIXED_EVT */
		typedef struct {
		BT_HDR hdr;
		@@ -231,7 +219,6 @@ typedef union {
		BT_HDR hdr;
		tBTA_JV_API_START_DISCOVERY start_discovery;
		tBTA_JV_API_L2CAP_READ l2cap_read;
		tBTA_JV_API_L2CAP_WRITE l2cap_write;
		tBTA_JV_API_RFCOMM_CONNECT rfcomm_connect;
		tBTA_JV_API_RFCOMM_WRITE rfcomm_write;
		tBTA_JV_API_SET_PM_PROFILE set_pm;
		@@ -302,7 +289,9 @@ extern void bta_jv_l2cap_start_server(
		extern void bta_jv_l2cap_stop_server(uint16_t local_psm,
		uint32_t l2cap_socket_id);
		extern void bta_jv_l2cap_read(tBTA_JV_MSG* p_data);
		extern void bta_jv_l2cap_write(tBTA_JV_MSG* p_data);
		extern void bta_jv_l2cap_write(uint32_t handle, uint32_t req_id,
		uint8_t* p_data, uint16_t len, uint32_t user_id,
		tBTA_JV_L2C_CB* p_cb);
		extern void bta_jv_rfcomm_connect(tBTA_JV_MSG* p_data);
		extern void bta_jv_rfcomm_close(tBTA_JV_MSG* p_data);
		extern void bta_jv_rfcomm_start_server(tBTA_JV_MSG* p_data);

system/bta/jv/bta_jv_main.cc

+0 −1

Original line number	Diff line number	Diff line
		@@ -43,7 +43,6 @@ typedef void (tBTA_JV_ACTION)(tBTA_JV_MSG p_data);
		const tBTA_JV_ACTION bta_jv_action[] = {
		bta_jv_start_discovery, /* BTA_JV_API_START_DISCOVERY_EVT */
		bta_jv_l2cap_read, /* BTA_JV_API_L2CAP_READ_EVT */
		bta_jv_l2cap_write, /* BTA_JV_API_L2CAP_WRITE_EVT */
		bta_jv_rfcomm_connect, /* BTA_JV_API_RFCOMM_CONNECT_EVT */
		bta_jv_rfcomm_close, /* BTA_JV_API_RFCOMM_CLOSE_EVT */
		bta_jv_rfcomm_start_server, /* BTA_JV_API_RFCOMM_START_SERVER_EVT */