Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aa349da0 authored by Myles Watson's avatar Myles Watson
Browse files

DO NOT MERGE: PAN: Always allocate in bta_pan_data_buf_ind_cback 

Change I63b857d031c55d3a0754e4101e330843eb422b2a caused a double
free.  Move the free call to pan_data_buf_ind_cb().

Free the buffer before every return in pan_data_buf_ind_cb.

Bug: 74950468
Test: manual tethering test with DUT sharing its connection
Change-Id: If4526f3042699581e2cdde79a362eef0f83768eb
Merged-In: If4526f3042699581e2cdde79a362eef0f83768eb
(cherry picked from commit 2e0deb1d135805b37697f0e02a55269c6cc500fe)
parent 8ea5dc35

system/bta/pan/bta_pan_act.c

+15 −23
Original line number Diff line number Diff line
@@ -212,8 +212,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst, 
        return;

    }



    if ( sizeof(tBTA_PAN_DATA_PARAMS) > p_buf->offset )

    {

    if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >

        GKI_get_pool_bufsize(PAN_POOL_ID)) {

        android_errorWriteLog(0x534e4554, "63146237");
@@ -222,7 +220,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst, 
        return;

    }



        /* offset smaller than data structure in front of actual data */

    p_new_buf = (BT_HDR *)GKI_getpoolbuf( PAN_POOL_ID );

    if(!p_new_buf)

    {
@@ -235,11 +232,6 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst, 
        p_new_buf->len    = p_buf->len;

        p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS);

    }

    }

    else

    {

        p_new_buf = p_buf;

    }

    /* copy params into the space before the data */

    bdcpy(((tBTA_PAN_DATA_PARAMS *)p_new_buf)->src, src);

    bdcpy(((tBTA_PAN_DATA_PARAMS *)p_new_buf)->dst, dst);

system/stack/bnep/bnep_main.c

+0 −1
Original line number Diff line number Diff line
@@ -661,7 +661,6 @@ static void bnep_data_ind (UINT16 l2cap_cid, BT_HDR *p_buf) 
    if (bnep_cb.p_data_buf_cb)

    {

        (*bnep_cb.p_data_buf_cb)(p_bcb->handle, p_src_addr, p_dst_addr, protocol, p_buf, fw_ext_present);

        GKI_freebuf (p_buf);

    }

    else if (bnep_cb.p_data_ind_cb)

    {

system/stack/pan/pan_main.c

+2 −10
Original line number Diff line number Diff line
@@ -629,11 +629,8 @@ void pan_data_buf_ind_cb (UINT16 handle, 
            if (pan_cb.pan_data_buf_ind_cb)

                (*pan_cb.pan_data_buf_ind_cb) (pcb->handle, src, dst, protocol, p_buf, ext, forward);

            else if (pan_cb.pan_data_ind_cb)

            {

                (*pan_cb.pan_data_ind_cb) (pcb->handle, src, dst, protocol, p_data, len, ext, forward);

            GKI_freebuf (p_buf);

            }



            return;

        }
@@ -656,13 +653,8 @@ void pan_data_buf_ind_cb (UINT16 handle, 
    if (pan_cb.pan_data_buf_ind_cb)

        (*pan_cb.pan_data_buf_ind_cb) (pcb->handle, src, dst, protocol, p_buf, ext, forward);

    else if (pan_cb.pan_data_ind_cb)

    {

        (*pan_cb.pan_data_ind_cb) (pcb->handle, src, dst, protocol, p_data, len, ext, forward);

    GKI_freebuf (p_buf);

    }

    else

        GKI_freebuf (p_buf);



    return;

}