Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7c0a042 authored Jul 18, 2022 by William Escande

SDP: Set address in tBTM_REMOTE_DEV_NAME

The tBTM_REMOTE_DEV_NAME.bd_addr was never set but we do use it to
decide if we can remove the callback in bta_dm_remname_cback.
Without the fix we are triggering too many remote name request. They
will eventually conflict with each other and ends in the busy state.
At this point if the stack is performing a search, we could receive
delayed sdp_result that will end in a crash.

Repro steps:
 * Start a search on phone
 * Pair & connect from carkit
 * Crash should occur (1~4% repro).

Without any logs nor fix, crash is around 15%+ repro
With the fix, the 'crash situation' only appear around 1~2% and it no
longer crash
Crash situation as been identified to match with the following logs
    `BTM_ReadRemoteDeviceName is busy`

Bug: 231150390
Test: Execute repro step above
Ignore-AOSP-First: AOSP does not merge on tm-dev
Merged-In: I317f5d689a9efb85d997a38470712ed3d8e0c531
Change-Id: I317f5d689a9efb85d997a38470712ed3d8e0c531

parent 3d0f7c50

system/bta/dm/bta_dm_act.cc

+3 −1

Original line number	Diff line number	Diff line
		@@ -966,7 +966,7 @@ static bool bta_dm_read_remote_device_name(const RawAddress& bd_addr,

		/* Remote name discovery is on going now so BTM cannot notify through
		* "bta_dm_remname_cback" */
		/* adding callback to get notified that current reading remore name done */
		/* adding callback to get notified that current reading remote name done */

		if (bluetooth::shim::is_gd_security_enabled()) {
		bluetooth::shim::BTM_SecAddRmtNameNotifyCallback(
		@@ -1879,6 +1879,8 @@ static void bta_dm_service_search_remname_cback(const RawAddress& bd_addr,

		APPL_TRACE_DEBUG("%s name=<%s>", __func__, bd_name);

		rem_name.bd_addr = bd_addr;

		/* if this is what we are looking for */
		if (bta_dm_search_cb.peer_bdaddr == bd_addr) {
		rem_name.length = strlcpy((char)rem_name.remote_bd_name, (char)bd_name,

system/stack/btm/btm_inq.cc

+3 −0

Original line number	Diff line number	Diff line
		@@ -1443,7 +1443,10 @@ void btm_process_remote_name(const RawAddress* bda, const BD_NAME bdn,
		uint16_t temp_evt_len;

		if (bda) {
		rem_name.bd_addr = *bda;
		VLOG(2) << "BDA " << *bda;
		} else {
		rem_name.bd_addr = RawAddress::kEmpty;
		}

		VLOG(2) << "Inquire BDA " << p_inq->remname_bda;