Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b03ad660 authored by Himanshu Rawat's avatar Himanshu Rawat
Browse files

Reset HID host callback after cleanup is complete 

bt_hh_callbacks is immediately reset HID host disable is requested. Crash may
happen due to a race condition with pending BTA event processing.

Bug: 272153768
Change-Id: I5e71106974cc503e616f5220af28906d380eae09
Test: Test regression
parent d3e9b02b

system/btif/src/btif_hh.cc

+6 −2
Original line number Diff line number Diff line
@@ -775,6 +775,10 @@ static void btif_hh_upstreams_evt(uint16_t event, char* p_param) { 
      break;



    case BTA_HH_DISABLE_EVT:

      if (btif_hh_cb.status == BTIF_HH_DISABLING) {

        bt_hh_callbacks = NULL;

      }



      btif_hh_cb.status = BTIF_HH_DISABLED;

      if (btif_hh_cb.service_dereg_active) {

        BTIF_TRACE_DEBUG("BTA_HH_DISABLE_EVT: enabling HID Device service");
@@ -1806,7 +1810,8 @@ static void cleanup(void) { 
  BTIF_TRACE_EVENT("%s", __func__);

  btif_hh_device_t* p_dev;

  int i;

  if (btif_hh_cb.status == BTIF_HH_DISABLED) {

  if (btif_hh_cb.status == BTIF_HH_DISABLED ||

      btif_hh_cb.status == BTIF_HH_DISABLING) {

    BTIF_TRACE_WARNING("%s: HH disabling or disabled already, status = %d",

                       __func__, btif_hh_cb.status);

    return;
@@ -1817,7 +1822,6 @@ static void cleanup(void) { 
     */

    btif_hh_cb.service_dereg_active = FALSE;

    btif_disable_service(BTA_HID_SERVICE_ID);

    bt_hh_callbacks = NULL;

  }

  for (i = 0; i < BTIF_HH_MAX_HID; i++) {

    p_dev = &btif_hh_cb.devices[i];