Merge "L2CAP: Fix for infinite loop in LE Security Access" (e0f21887) · Commits · e / os / android_packages_modules_Bluetooth

system/stack/l2cap/l2c_ble.cc

+10 −5

Original line number	Diff line number	Diff line
		@@ -1431,6 +1431,7 @@ void l2cble_sec_comp(const RawAddress* bda, tBT_TRANSPORT transport,

		if (status != BTM_SUCCESS) {
		(*(p_buf->p_callback))(p_bda, BT_TRANSPORT_LE, p_buf->p_ref_data, status);
		osi_free(p_buf);
		} else {
		if (sec_act == BTM_SEC_ENCRYPT_MITM) {
		if (BTM_IsLinkKeyAuthed(p_bda, transport))
		@@ -1448,24 +1449,28 @@ void l2cble_sec_comp(const RawAddress* bda, tBT_TRANSPORT transport,
		(*(p_buf->p_callback))(p_bda, BT_TRANSPORT_LE, p_buf->p_ref_data,
		status);
		}
		osi_free(p_buf);
		}
		} else {
		L2CAP_TRACE_WARNING(
		"%s Security complete for request not initiated from L2CAP", __func__);
		return;
		}
		osi_free(p_buf);

		while (!fixed_queue_is_empty(p_lcb->le_sec_pending_q)) {
		p_buf = (tL2CAP_SEC_DATA*)fixed_queue_dequeue(p_lcb->le_sec_pending_q);

		if (status != BTM_SUCCESS)
		if (status != BTM_SUCCESS) {
		(*(p_buf->p_callback))(p_bda, BT_TRANSPORT_LE, p_buf->p_ref_data, status);
		else
		osi_free(p_buf);
		}
		else {
		l2ble_sec_access_req(p_bda, p_buf->psm, p_buf->is_originator,
		p_buf->p_callback, p_buf->p_ref_data);

		osi_free(p_buf);
		break;
		}
		}
		}