OSDN Git Service

Don't use Address after it was deleted
[android-x86/system-bt.git] / bta / dm / bta_dm_act.c
index 441269f..e361970 100644 (file)
@@ -25,6 +25,8 @@
 
 #define LOG_TAG "bt_bta_dm"
 
+#include <assert.h>
+#include <cutils/log.h>
 #include <string.h>
 
 #include "bt_target.h"
@@ -63,19 +65,6 @@ static void bta_dm_local_name_cback(BD_ADDR bd_addr);
 static BOOLEAN bta_dm_check_av(UINT16 event);
 static void bta_dm_bl_change_cback (tBTM_BL_EVENT_DATA *p_data);
 
-
-#if BLE_INCLUDED == TRUE
-static void bta_dm_acl_change_cback(BD_ADDR p_bda, DEV_CLASS p_dc,
-                                    BD_NAME p_bdn, UINT8 *features,
-                                    BOOLEAN is_new, UINT16 handle,
-                                    tBT_TRANSPORT transport);
-#else
-static void bta_dm_acl_change_cback(BD_ADDR p_bda, DEV_CLASS p_dc,
-                                    BD_NAME p_bdn, UINT8 *features,
-                                    BOOLEAN is_new);
-#endif
-
-
 static void bta_dm_policy_cback(tBTA_SYS_CONN_STATUS status, UINT8 id, UINT8 app_id, BD_ADDR peer_addr);
 
 /* Extended Inquiry Response */
@@ -142,6 +131,9 @@ static void bta_dm_ctrl_features_rd_cmpl_cback(tBTM_STATUS result);
 #define BTA_DM_SWITCH_DELAY_TIMER_MS 500
 #endif
 
+#define BTA_MAX_SERVICES 32
+
+static void bta_dm_reset_sec_dev_pending(BD_ADDR remote_bd_addr);
 static void bta_dm_remove_sec_dev_entry(BD_ADDR remote_bd_addr);
 static void bta_dm_observe_results_cb(tBTM_INQ_RESULTS *p_inq, UINT8 *p_eir);
 static void bta_dm_observe_cmpl_cb(void * p_result);
@@ -270,7 +262,6 @@ extern fixed_queue_t *btu_bta_alarm_queue;
 *******************************************************************************/
 void bta_dm_enable(tBTA_DM_MSG *p_data)
 {
-    tBTA_SYS_HW_MSG *sys_enable_event;
     tBTA_DM_ENABLE enable_event;
 
     /* if already in use, return an error */
@@ -295,13 +286,12 @@ void bta_dm_enable(tBTA_DM_MSG *p_data)
     bta_dm_cb.is_bta_dm_active = TRUE;
 
     /* send a message to BTA SYS */
-    if ((sys_enable_event = (tBTA_SYS_HW_MSG *) osi_getbuf(sizeof(tBTA_SYS_HW_MSG))) != NULL)
-    {
-        sys_enable_event->hdr.event = BTA_SYS_API_ENABLE_EVT;
-        sys_enable_event->hw_module = BTA_SYS_HW_BLUETOOTH;
+    tBTA_SYS_HW_MSG *sys_enable_event =
+        (tBTA_SYS_HW_MSG *)osi_malloc(sizeof(tBTA_SYS_HW_MSG));
+    sys_enable_event->hdr.event = BTA_SYS_API_ENABLE_EVT;
+    sys_enable_event->hw_module = BTA_SYS_HW_BLUETOOTH;
 
-        bta_sys_sendmsg(sys_enable_event);
-    }
+    bta_sys_sendmsg(sys_enable_event);
 }
 
 /*******************************************************************************
@@ -542,7 +532,7 @@ static void bta_dm_disable_timer_cback(void *data)
 
     APPL_TRACE_EVENT("%s trial %u", __func__, param);
 
-    if ((BTM_GetNumAclLinks() && param) == 0)
+    if (BTM_GetNumAclLinks() && (param == 0))
     {
         for(i=0; i<bta_dm_cb.device_list.count; i++)
         {
@@ -1206,7 +1196,7 @@ void bta_dm_search_start (tBTA_DM_MSG *p_data)
     tBTM_INQUIRY_CMPL result;
 
 #if (BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE)
-    UINT16 len = (UINT16)(sizeof(tBT_UUID) * p_data->search.num_uuid);
+    size_t len = sizeof(tBT_UUID) * p_data->search.num_uuid;
     bta_dm_gattc_register();
 #endif
 
@@ -1225,21 +1215,11 @@ void bta_dm_search_start (tBTA_DM_MSG *p_data)
     bta_dm_search_cb.services = p_data->search.services;
 
 #if (BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE)
-    osi_freebuf_and_reset((void **)&bta_dm_search_cb.p_srvc_uuid);
+    osi_free_and_reset((void **)&bta_dm_search_cb.p_srvc_uuid);
 
     if ((bta_dm_search_cb.num_uuid = p_data->search.num_uuid) != 0 &&
-         p_data->search.p_uuid != NULL)
-    {
-        if ((bta_dm_search_cb.p_srvc_uuid = (tBT_UUID *)osi_getbuf(len)) == NULL)
-        {
-            APPL_TRACE_ERROR("%s no resources", __func__);
-
-            result.status = BTA_FAILURE;
-            result.num_resp = 0;
-            bta_dm_inq_cmpl_cb ((void *)&result);
-            return;
-        }
-
+         p_data->search.p_uuid != NULL) {
+        bta_dm_search_cb.p_srvc_uuid = (tBT_UUID *)osi_malloc(len);
         memcpy(bta_dm_search_cb.p_srvc_uuid, p_data->search.p_uuid, len);
     }
 #endif
@@ -1268,20 +1248,17 @@ void bta_dm_search_start (tBTA_DM_MSG *p_data)
 void bta_dm_search_cancel (tBTA_DM_MSG *p_data)
 {
     UNUSED(p_data);
-    tBTA_DM_MSG * p_msg;
+    tBTA_DM_MSG *p_msg;
 
     if (BTM_IsInquiryActive())
     {
         if (BTM_CancelInquiry() == BTM_SUCCESS)
         {
             bta_dm_search_cancel_notify(NULL);
-            p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG));
-            if (p_msg != NULL)
-            {
-                p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
-                p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
-                bta_sys_sendmsg(p_msg);
-            }
+            p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+            p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
+            p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
+            bta_sys_sendmsg(p_msg);
         } else {
             /* flag a search cancel is pending */
             bta_dm_search_cb.cancel_pending = TRUE;
@@ -1292,21 +1269,15 @@ void bta_dm_search_cancel (tBTA_DM_MSG *p_data)
     {
         BTM_CancelRemoteDeviceName();
 
-        if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-        {
-            p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
-            p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
-            bta_sys_sendmsg(p_msg);
-        }
-
-    }
-    else {
-        if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-        {
-            p_msg->hdr.event = BTA_DM_INQUIRY_CMPL_EVT;
-            p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
-            bta_sys_sendmsg(p_msg);
-        }
+        p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+        p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
+        p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
+        bta_sys_sendmsg(p_msg);
+    } else {
+        p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+        p_msg->hdr.event = BTA_DM_INQUIRY_CMPL_EVT;
+        p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
+        bta_sys_sendmsg(p_msg);
     }
 
 #if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
@@ -1330,7 +1301,7 @@ void bta_dm_search_cancel (tBTA_DM_MSG *p_data)
 void bta_dm_discover (tBTA_DM_MSG *p_data)
 {
 #if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
-    UINT16 len = (UINT16)(sizeof(tBT_UUID) * p_data->discover.num_uuid);
+    size_t len = sizeof(tBT_UUID) * p_data->discover.num_uuid;
 #endif
     APPL_TRACE_EVENT("%s services_to_search=0x%04X, sdp_search=%d", __func__,
                       p_data->discover.services, p_data->discover.sdp_search);
@@ -1340,15 +1311,10 @@ void bta_dm_discover (tBTA_DM_MSG *p_data)
 
 #if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
     bta_dm_gattc_register();
-    osi_freebuf_and_reset((void **)&bta_dm_search_cb.p_srvc_uuid);
+    osi_free_and_reset((void **)&bta_dm_search_cb.p_srvc_uuid);
     if ((bta_dm_search_cb.num_uuid = p_data->discover.num_uuid) != 0 &&
-        p_data->discover.p_uuid != NULL)
-    {
-        if ((bta_dm_search_cb.p_srvc_uuid = (tBT_UUID *)osi_getbuf(len)) == NULL)
-        {
-            p_data->discover.p_cback(BTA_DM_DISC_CMPL_EVT, NULL);
-            return;
-        }
+        p_data->discover.p_uuid != NULL) {
+        bta_dm_search_cb.p_srvc_uuid = (tBT_UUID *)osi_malloc(len);
         memcpy(bta_dm_search_cb.p_srvc_uuid, p_data->discover.p_uuid, len);
     }
     bta_dm_search_cb.uuid_to_search = bta_dm_search_cb.num_uuid;
@@ -1409,15 +1375,13 @@ void bta_dm_di_disc_cmpl(tBTA_DM_MSG *p_data)
 *******************************************************************************/
 static void bta_dm_di_disc_callback(UINT16 result)
 {
-    tBTA_DM_MSG * p_msg;
+    tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
 
-    if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-    {
-        p_msg->hdr.event            = BTA_DM_SEARCH_CMPL_EVT;
-        p_msg->hdr.layer_specific   = BTA_DM_API_DI_DISCOVER_EVT;
-        p_msg->hdr.offset           = result;
-        bta_sys_sendmsg(p_msg);
-    }
+    p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
+    p_msg->hdr.layer_specific = BTA_DM_API_DI_DISCOVER_EVT;
+    p_msg->hdr.offset = result;
+
+    bta_sys_sendmsg(p_msg);
 }
 
 /*******************************************************************************
@@ -1462,31 +1426,24 @@ static void bta_dm_disable_search_and_disc (void)
 void bta_dm_di_disc (tBTA_DM_MSG *p_data)
 {
     UINT16  result = BTA_FAILURE;
-    tBTA_DM_MSG *p_msg;
 
     bta_dm_search_cb.p_search_cback = p_data->di_disc.p_cback;
     bdcpy(bta_dm_search_cb.peer_bdaddr, p_data->di_disc.bd_addr);
     bta_dm_di_cb.p_di_db = p_data->di_disc.p_sdp_db;
 
-    if((bta_dm_search_cb.p_sdp_db = (tSDP_DISCOVERY_DB *)osi_getbuf(BTA_DM_SDP_DB_SIZE)) != NULL)
-    {
-        if ( SDP_DiDiscover(bta_dm_search_cb.peer_bdaddr, p_data->di_disc.p_sdp_db,
-                    p_data->di_disc.len, bta_dm_di_disc_callback) == SDP_SUCCESS)
-        {
-            result = BTA_SUCCESS;
-        }
-    }
-    else
-    {
-        APPL_TRACE_ERROR("No buffer to start DI discovery");
+    bta_dm_search_cb.p_sdp_db = (tSDP_DISCOVERY_DB *)osi_malloc(BTA_DM_SDP_DB_SIZE);
+    if (SDP_DiDiscover(bta_dm_search_cb.peer_bdaddr, p_data->di_disc.p_sdp_db,
+                       p_data->di_disc.len,
+                       bta_dm_di_disc_callback) == SDP_SUCCESS) {
+        result = BTA_SUCCESS;
     }
 
-    if ( result == BTA_FAILURE &&
-        (p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-    {
-        p_msg->hdr.event            = BTA_DM_SEARCH_CMPL_EVT;
-        p_msg->hdr.layer_specific   = BTA_DM_API_DI_DISCOVER_EVT;
-        p_data->hdr.offset          = result;
+    if (result == BTA_FAILURE) {
+        tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+
+        p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
+        p_msg->hdr.layer_specific = BTA_DM_API_DI_DISCOVER_EVT;
+        p_data->hdr.offset = result;
         bta_sys_sendmsg(p_msg);
     }
 }
@@ -1548,7 +1505,6 @@ static BOOLEAN bta_dm_read_remote_device_name (BD_ADDR bd_addr,tBT_TRANSPORT tra
 *******************************************************************************/
 void bta_dm_inq_cmpl (tBTA_DM_MSG *p_data)
 {
-    tBTA_DM_MSG * p_msg;
     tBTA_DM_SEARCH  data;
 
     APPL_TRACE_DEBUG("bta_dm_inq_cmpl");
@@ -1562,20 +1518,17 @@ void bta_dm_inq_cmpl (tBTA_DM_MSG *p_data)
         bta_dm_search_cb.name_discover_done = FALSE;
         bta_dm_search_cb.peer_name[0]       = 0;
         bta_dm_discover_device(bta_dm_search_cb.p_btm_inq_info->results.remote_bd_addr);
-    }
-    else
-    {
+    } else {
+        tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+
         /* no devices, search complete */
         bta_dm_search_cb.services = 0;
 
-        if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-        {
-            p_msg->hdr.event          = BTA_DM_SEARCH_CMPL_EVT;
-            p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
-            bta_sys_sendmsg(p_msg);
-        }
-        }
+        p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
+        p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
+        bta_sys_sendmsg(p_msg);
     }
+}
 
 /*******************************************************************************
 **
@@ -1651,7 +1604,7 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
 #endif
 
     UINT32 num_uuids = 0;
-    UINT8  uuid_list[32][MAX_UUID_SIZE]; // assuming a max of 32 services
+    UINT8  uuid_list[BTA_MAX_SERVICES][MAX_UUID_SIZE]; // assuming a max of 32 services
 
     if((p_data->sdp_event.sdp_result == SDP_SUCCESS)
         || (p_data->sdp_event.sdp_result == SDP_NO_RECS_MATCH)
@@ -1729,8 +1682,12 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
                             (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(bta_dm_search_cb.service_index-1));
                         tmp_svc = bta_service_id_to_uuid_lkup_tbl[bta_dm_search_cb.service_index-1];
                         /* Add to the list of UUIDs */
-                        sdpu_uuid16_to_uuid128(tmp_svc, uuid_list[num_uuids]);
-                        num_uuids++;
+                        if (num_uuids < BTA_MAX_SERVICES) {
+                            sdpu_uuid16_to_uuid128(tmp_svc, uuid_list[num_uuids]);
+                            num_uuids++;
+                        } else {
+                            android_errorWriteLog(0x534e4554, "74016921");
+                        }
                     }
                 }
             }
@@ -1769,8 +1726,12 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
                 {
                     if (SDP_FindServiceUUIDInRec_128bit(p_sdp_rec, &temp_uuid))
                     {
-                        memcpy(uuid_list[num_uuids], temp_uuid.uu.uuid128, MAX_UUID_SIZE);
-                        num_uuids++;
+                        if (num_uuids < BTA_MAX_SERVICES) {
+                            memcpy(uuid_list[num_uuids], temp_uuid.uu.uuid128, MAX_UUID_SIZE);
+                            num_uuids++;
+                        } else {
+                            android_errorWriteLog(0x534e4554, "74016921");
+                        }
                     }
                 }
             } while (p_sdp_rec);
@@ -1789,75 +1750,62 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
 
             BTM_SecDeleteRmtNameNotifyCallback(&bta_dm_service_search_remname_cback);
 
+            p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+            p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
+            p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
+            p_msg->disc_result.result.disc_res.p_raw_data = NULL;
+            p_msg->disc_result.result.disc_res.raw_data_size = 0;
+            p_msg->disc_result.result.disc_res.num_uuids = num_uuids;
+            p_msg->disc_result.result.disc_res.p_uuid_list = NULL;
+            if (num_uuids > 0) {
+                p_msg->disc_result.result.disc_res.p_uuid_list =
+                    (UINT8 *)osi_malloc(num_uuids * MAX_UUID_SIZE);
+                memcpy(p_msg->disc_result.result.disc_res.p_uuid_list,
+                       uuid_list, num_uuids * MAX_UUID_SIZE);
+            }
+            // Copy the raw_data to the discovery result structure
+            if (bta_dm_search_cb.p_sdp_db != NULL &&
+                bta_dm_search_cb.p_sdp_db->raw_used != 0 &&
+                bta_dm_search_cb.p_sdp_db->raw_data != NULL) {
+                APPL_TRACE_DEBUG("%s raw_data used = 0x%x raw_data_ptr = 0x%x",
+                                 __func__,
+                                 bta_dm_search_cb.p_sdp_db->raw_used,
+                                 bta_dm_search_cb.p_sdp_db->raw_data);
+
+                p_msg->disc_result.result.disc_res.p_raw_data =
+                    osi_malloc(bta_dm_search_cb.p_sdp_db->raw_used);
+                memcpy(p_msg->disc_result.result.disc_res.p_raw_data,
+                       bta_dm_search_cb.p_sdp_db->raw_data,
+                       bta_dm_search_cb.p_sdp_db->raw_used);
+
+                p_msg->disc_result.result.disc_res.raw_data_size =
+                    bta_dm_search_cb.p_sdp_db->raw_used;
+
+                bta_dm_search_cb.p_sdp_db->raw_data = NULL;     //no need to free this - it is a global assigned.
+                bta_dm_search_cb.p_sdp_db->raw_used = 0;
+                bta_dm_search_cb.p_sdp_db->raw_size = 0;
+            } else {
+                APPL_TRACE_DEBUG("%s raw data size is 0 or raw_data is null!!",
+                                 __func__);
+            }
+            /* Done with p_sdp_db. Free it */
+            bta_dm_free_sdp_db(NULL);
+            p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
 
-            if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-            {
-                p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
-                p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
-                p_msg->disc_result.result.disc_res.p_raw_data = NULL;
-                p_msg->disc_result.result.disc_res.raw_data_size = 0;
-                p_msg->disc_result.result.disc_res.num_uuids = num_uuids;
-                p_msg->disc_result.result.disc_res.p_uuid_list = NULL;
-                if (num_uuids > 0) {
-                    p_msg->disc_result.result.disc_res.p_uuid_list = (UINT8*)osi_getbuf(num_uuids*MAX_UUID_SIZE);
-                    if (p_msg->disc_result.result.disc_res.p_uuid_list) {
-                        memcpy(p_msg->disc_result.result.disc_res.p_uuid_list, uuid_list,
-                               num_uuids*MAX_UUID_SIZE);
-                    } else {
-                       p_msg->disc_result.result.disc_res.num_uuids = 0;
-                       APPL_TRACE_ERROR("%s: Unable to allocate memory for uuid_list", __func__);
-                    }
-                }
-                //copy the raw_data to the discovery result  structure
-                //
-
-                if (  bta_dm_search_cb.p_sdp_db != NULL && bta_dm_search_cb.p_sdp_db->raw_used != 0   &&
-                    bta_dm_search_cb.p_sdp_db->raw_data != NULL) {
-                    APPL_TRACE_DEBUG(
-                        "%s raw_data used = 0x%x raw_data_ptr = 0x%x", __func__,
-                        bta_dm_search_cb.p_sdp_db->raw_used,
-                        bta_dm_search_cb.p_sdp_db->raw_data);
-
-                    p_msg->disc_result.result.disc_res.p_raw_data = osi_getbuf(bta_dm_search_cb.p_sdp_db->raw_used);
-                    if ( NULL != p_msg->disc_result.result.disc_res.p_raw_data  ) {
-                        memcpy(     p_msg->disc_result.result.disc_res.p_raw_data,
-                                    bta_dm_search_cb.p_sdp_db->raw_data,
-                                    bta_dm_search_cb.p_sdp_db->raw_used );
-
-                        p_msg->disc_result.result.disc_res.raw_data_size =
-                            bta_dm_search_cb.p_sdp_db->raw_used;
-
-                    } else {
-                        APPL_TRACE_DEBUG("%s GKI Alloc failed to allocate %d bytes !!", __func__,
-                            bta_dm_search_cb.p_sdp_db->raw_used);
-                    }
-
-                    bta_dm_search_cb.p_sdp_db->raw_data = NULL;     //no need to free this - it is a global assigned.
-                    bta_dm_search_cb.p_sdp_db->raw_used = 0;
-                    bta_dm_search_cb.p_sdp_db->raw_size = 0;
-                }
-                else {
-                    APPL_TRACE_DEBUG("%s raw data size is 0 or raw_data is null!!", __func__);
-                }
-                /* Done with p_sdp_db. Free it */
-                bta_dm_free_sdp_db(NULL);
-                p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
-
-                //Piggy back the SCN over result field
-                if( scn_found )
-                {
-                  p_msg->disc_result.result.disc_res.result = (3 + bta_dm_search_cb.peer_scn);
-                  p_msg->disc_result.result.disc_res.services |= BTA_USER_SERVICE_MASK;
-
-                  APPL_TRACE_EVENT(" Piggy back the SCN over result field  SCN=%d", bta_dm_search_cb.peer_scn);
+            // Piggy back the SCN over result field
+            if (scn_found) {
+                p_msg->disc_result.result.disc_res.result = (3 + bta_dm_search_cb.peer_scn);
+                p_msg->disc_result.result.disc_res.services |= BTA_USER_SERVICE_MASK;
 
-                }
-                bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-                strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name,
-                        bta_dm_get_remname(), BD_NAME_LEN);
+                APPL_TRACE_EVENT(" Piggy back the SCN over result field  SCN=%d", bta_dm_search_cb.peer_scn);
 
-                bta_sys_sendmsg(p_msg);
             }
+            bdcpy(p_msg->disc_result.result.disc_res.bd_addr,
+                  bta_dm_search_cb.peer_bdaddr);
+            strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name,
+                      bta_dm_get_remname(), BD_NAME_LEN);
+
+            bta_sys_sendmsg(p_msg);
         }
     } else {
         /* conn failed. No need for timer */
@@ -1866,21 +1814,21 @@ void bta_dm_sdp_result (tBTA_DM_MSG *p_data)
             bta_dm_search_cb.wait_disc = FALSE;
 
         /* not able to connect go to next device */
-        osi_freebuf_and_reset((void **)&bta_dm_search_cb.p_sdp_db);
+        if (bta_dm_search_cb.p_sdp_db)
+            osi_free_and_reset((void **)&bta_dm_search_cb.p_sdp_db);
 
         BTM_SecDeleteRmtNameNotifyCallback(&bta_dm_service_search_remname_cback);
 
-        if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-        {
-            p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
-            p_msg->disc_result.result.disc_res.result = BTA_FAILURE;
-            p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
-            bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name,
-                    bta_dm_get_remname(), BD_NAME_LEN);
+        p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+        p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
+        p_msg->disc_result.result.disc_res.result = BTA_FAILURE;
+        p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
+        bdcpy(p_msg->disc_result.result.disc_res.bd_addr,
+              bta_dm_search_cb.peer_bdaddr);
+        strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name,
+                bta_dm_get_remname(), BD_NAME_LEN);
 
-            bta_sys_sendmsg(p_msg);
-        }
+        bta_sys_sendmsg(p_msg);
     }
 }
 
@@ -1898,7 +1846,7 @@ void bta_dm_search_cmpl(tBTA_DM_MSG *p_data)
     APPL_TRACE_EVENT("%s", __func__);
 
 #if (BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE)
-    osi_freebuf_and_reset((void **)&bta_dm_search_cb.p_srvc_uuid);
+    osi_free_and_reset((void **)&bta_dm_search_cb.p_srvc_uuid);
 #endif
 
     if (p_data->hdr.layer_specific == BTA_DM_API_DI_DISCOVER_EVT)
@@ -1926,15 +1874,12 @@ void bta_dm_disc_result (tBTA_DM_MSG *p_data)
 #endif
     bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result);
 
-    tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG));
+    tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
 
     /* send a message to change state */
-    if (p_msg != NULL)
-    {
-        p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
-        p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
-        bta_sys_sendmsg(p_msg);
-    }
+    p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
+    p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
+    bta_sys_sendmsg(p_msg);
 }
 
 /*******************************************************************************
@@ -2010,7 +1955,7 @@ static void bta_dm_search_timer_cback(UNUSED_ATTR void *data)
 void bta_dm_free_sdp_db (tBTA_DM_MSG *p_data)
 {
     UNUSED(p_data);
-    osi_freebuf_and_reset((void **)&bta_dm_search_cb.p_sdp_db);
+    osi_free_and_reset((void **)&bta_dm_search_cb.p_sdp_db);
 }
 
 /*******************************************************************************
@@ -2024,9 +1969,9 @@ void bta_dm_free_sdp_db (tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_queue_search(tBTA_DM_MSG *p_data)
 {
-    osi_freebuf(bta_dm_search_cb.p_search_queue);
+    osi_free(bta_dm_search_cb.p_search_queue);
     bta_dm_search_cb.p_search_queue =
-      (tBTA_DM_MSG *)osi_getbuf(sizeof(tBTA_DM_API_SEARCH));
+      (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_API_SEARCH));
     memcpy(bta_dm_search_cb.p_search_queue, p_data,
            sizeof(tBTA_DM_API_SEARCH));
 }
@@ -2042,9 +1987,9 @@ void bta_dm_queue_search(tBTA_DM_MSG *p_data)
 *******************************************************************************/
 void bta_dm_queue_disc(tBTA_DM_MSG *p_data)
 {
-    osi_freebuf(bta_dm_search_cb.p_search_queue);
+    osi_free(bta_dm_search_cb.p_search_queue);
     bta_dm_search_cb.p_search_queue =
-        (tBTA_DM_MSG *)osi_getbuf(sizeof(tBTA_DM_API_DISCOVER));
+        (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_API_DISCOVER));
     memcpy(bta_dm_search_cb.p_search_queue, p_data,
            sizeof(tBTA_DM_API_DISCOVER));
 }
@@ -2061,7 +2006,7 @@ void bta_dm_queue_disc(tBTA_DM_MSG *p_data)
 void bta_dm_search_clear_queue(tBTA_DM_MSG *p_data)
 {
     UNUSED(p_data);
-    osi_freebuf_and_reset((void **)&bta_dm_search_cb.p_search_queue);
+    osi_free_and_reset((void **)&bta_dm_search_cb.p_search_queue);
 }
 
 /*******************************************************************************
@@ -2098,7 +2043,7 @@ void bta_dm_search_cancel_transac_cmpl(tBTA_DM_MSG *p_data)
 {
     UNUSED(p_data);
 
-    osi_freebuf_and_reset((void **)&bta_dm_search_cb.p_sdp_db);
+    osi_free_and_reset((void **)&bta_dm_search_cb.p_sdp_db);
     bta_dm_search_cancel_notify(NULL);
 }
 
@@ -2145,107 +2090,92 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
 {
 
     tSDP_UUID    uuid;
-    tBTA_DM_MSG *p_msg;
 
-    memset (&uuid, 0, sizeof(tSDP_UUID));
+    memset(&uuid, 0, sizeof(tSDP_UUID));
 
     while(bta_dm_search_cb.service_index < BTA_MAX_SERVICE_ID)
     {
         if( bta_dm_search_cb.services_to_search
             & (tBTA_SERVICE_MASK)(BTA_SERVICE_ID_TO_SERVICE_MASK(bta_dm_search_cb.service_index)))
         {
-            if((bta_dm_search_cb.p_sdp_db = (tSDP_DISCOVERY_DB *)osi_getbuf(BTA_DM_SDP_DB_SIZE)) != NULL)
-            {
-                APPL_TRACE_DEBUG("bta_dm_search_cb.services = %04x***********", bta_dm_search_cb.services);
-                /* try to search all services by search based on L2CAP UUID */
-                if(bta_dm_search_cb.services == BTA_ALL_SERVICE_MASK )
-                {
-                    LOG_INFO(LOG_TAG, "%s services_to_search=%08x", __func__, bta_dm_search_cb.services_to_search);
-                    if (bta_dm_search_cb.services_to_search & BTA_RES_SERVICE_MASK)
-                    {
-                        uuid.uu.uuid16 = bta_service_id_to_uuid_lkup_tbl[0];
-                        bta_dm_search_cb.services_to_search &= ~BTA_RES_SERVICE_MASK;
-                    }
-                    else
-                    {
-                        uuid.uu.uuid16 = UUID_PROTOCOL_L2CAP;
-                        bta_dm_search_cb.services_to_search = 0;
-                    }
+            bta_dm_search_cb.p_sdp_db = (tSDP_DISCOVERY_DB *)osi_malloc(BTA_DM_SDP_DB_SIZE);
+            APPL_TRACE_DEBUG("bta_dm_search_cb.services = %04x***********", bta_dm_search_cb.services);
+            /* try to search all services by search based on L2CAP UUID */
+            if (bta_dm_search_cb.services == BTA_ALL_SERVICE_MASK) {
+                LOG_INFO(LOG_TAG, "%s services_to_search=%08x", __func__,
+                         bta_dm_search_cb.services_to_search);
+                if (bta_dm_search_cb.services_to_search & BTA_RES_SERVICE_MASK) {
+                    uuid.uu.uuid16 = bta_service_id_to_uuid_lkup_tbl[0];
+                    bta_dm_search_cb.services_to_search &= ~BTA_RES_SERVICE_MASK;
+                } else {
+                    uuid.uu.uuid16 = UUID_PROTOCOL_L2CAP;
+                    bta_dm_search_cb.services_to_search = 0;
                 }
-                else
-                {
+            } else {
 #if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
-                    /* for LE only profile */
-                    if (bta_dm_search_cb.service_index == BTA_BLE_SERVICE_ID)
-                    {
-                        if (bta_dm_search_cb.uuid_to_search > 0 && bta_dm_search_cb.p_srvc_uuid)
-                        {
-                            memcpy(&uuid,
-                                   (const void *)(bta_dm_search_cb.p_srvc_uuid + \
-                                                  bta_dm_search_cb.num_uuid - bta_dm_search_cb.uuid_to_search),
-                                   sizeof(tBT_UUID));
-
-                            bta_dm_search_cb.uuid_to_search -- ;
-                        }
-                        else
-                            uuid.uu.uuid16 = bta_service_id_to_uuid_lkup_tbl[bta_dm_search_cb.service_index];
+                /* for LE only profile */
+                if (bta_dm_search_cb.service_index == BTA_BLE_SERVICE_ID) {
+                    if (bta_dm_search_cb.uuid_to_search > 0 &&
+                        bta_dm_search_cb.p_srvc_uuid) {
+                        memcpy(&uuid,
+                               (const void *)(bta_dm_search_cb.p_srvc_uuid +
+                                              bta_dm_search_cb.num_uuid -
+                                              bta_dm_search_cb.uuid_to_search),
+                               sizeof(tBT_UUID));
+
+                        bta_dm_search_cb.uuid_to_search--;
+                    } else {
+                        uuid.uu.uuid16 = bta_service_id_to_uuid_lkup_tbl[bta_dm_search_cb.service_index];
+                    }
 
-                        /* last one? clear the BLE service bit if all discovery has been done */
-                        if (bta_dm_search_cb.uuid_to_search == 0)
-                            bta_dm_search_cb.services_to_search &=
-                            (tBTA_SERVICE_MASK)(~(BTA_SERVICE_ID_TO_SERVICE_MASK(bta_dm_search_cb.service_index)));
+                    /* last one? clear the BLE service bit if all discovery has been done */
+                    if (bta_dm_search_cb.uuid_to_search == 0)
+                      bta_dm_search_cb.services_to_search &=
+                        (tBTA_SERVICE_MASK)(~(BTA_SERVICE_ID_TO_SERVICE_MASK(bta_dm_search_cb.service_index)));
 
-                    }
-                    else
+                } else
 #endif
-                    {
-                        /* remove the service from services to be searched  */
-                        bta_dm_search_cb.services_to_search &=
+                {
+                    /* remove the service from services to be searched  */
+                    bta_dm_search_cb.services_to_search &=
                         (tBTA_SERVICE_MASK)(~(BTA_SERVICE_ID_TO_SERVICE_MASK(bta_dm_search_cb.service_index)));
-                        uuid.uu.uuid16 = bta_service_id_to_uuid_lkup_tbl[bta_dm_search_cb.service_index];
-                    }
+                    uuid.uu.uuid16 = bta_service_id_to_uuid_lkup_tbl[bta_dm_search_cb.service_index];
                 }
+            }
 
-                if (uuid.len == 0)
-                    uuid.len = LEN_UUID_16;
+            if (uuid.len == 0)
+                uuid.len = LEN_UUID_16;
 
-                if (bta_dm_search_cb.service_index == BTA_USER_SERVICE_ID)
-                {
-                    memcpy(&uuid, &bta_dm_search_cb.uuid, sizeof(tSDP_UUID));
-                }
+            if (bta_dm_search_cb.service_index == BTA_USER_SERVICE_ID) {
+                memcpy(&uuid, &bta_dm_search_cb.uuid, sizeof(tSDP_UUID));
+            }
 
-                LOG_INFO(LOG_TAG, "%s search UUID = %04x", __func__, uuid.uu.uuid16);
-                SDP_InitDiscoveryDb (bta_dm_search_cb.p_sdp_db, BTA_DM_SDP_DB_SIZE, 1, &uuid, 0, NULL);
+            LOG_INFO(LOG_TAG, "%s search UUID = %04x", __func__,
+                     uuid.uu.uuid16);
+            SDP_InitDiscoveryDb(bta_dm_search_cb.p_sdp_db, BTA_DM_SDP_DB_SIZE,
+                                1, &uuid, 0, NULL);
 
-                memset(g_disc_raw_data_buf, 0, sizeof(g_disc_raw_data_buf));
-                bta_dm_search_cb.p_sdp_db->raw_data = g_disc_raw_data_buf;
+            memset(g_disc_raw_data_buf, 0, sizeof(g_disc_raw_data_buf));
+            bta_dm_search_cb.p_sdp_db->raw_data = g_disc_raw_data_buf;
 
-                bta_dm_search_cb.p_sdp_db->raw_size = MAX_DISC_RAW_DATA_BUF;
+            bta_dm_search_cb.p_sdp_db->raw_size = MAX_DISC_RAW_DATA_BUF;
 
-                if (!SDP_ServiceSearchAttributeRequest (bd_addr, bta_dm_search_cb.p_sdp_db, &bta_dm_sdp_callback))
-                {
-                    /*
-                     * If discovery is not successful with this device, then
-                     * proceed with the next one.
-                     */
-                    osi_freebuf_and_reset((void **)&bta_dm_search_cb.p_sdp_db);
-                    bta_dm_search_cb.service_index = BTA_MAX_SERVICE_ID;
+            if (!SDP_ServiceSearchAttributeRequest(bd_addr, bta_dm_search_cb.p_sdp_db, &bta_dm_sdp_callback)) {
+              /*
+               * If discovery is not successful with this device, then
+               * proceed with the next one.
+               */
+              osi_free_and_reset((void **)&bta_dm_search_cb.p_sdp_db);
+              bta_dm_search_cb.service_index = BTA_MAX_SERVICE_ID;
 
-                }
-                else
-                {
+            } else {
 #if BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE
-                    if ((bta_dm_search_cb.service_index == BTA_BLE_SERVICE_ID &&
-                         bta_dm_search_cb.uuid_to_search == 0) ||
-                         bta_dm_search_cb.service_index != BTA_BLE_SERVICE_ID)
+                if ((bta_dm_search_cb.service_index == BTA_BLE_SERVICE_ID &&
+                     bta_dm_search_cb.uuid_to_search == 0) ||
+                    bta_dm_search_cb.service_index != BTA_BLE_SERVICE_ID)
 #endif
                     bta_dm_search_cb.service_index++;
-                    return;
-                }
-            }
-            else
-            {
-                APPL_TRACE_ERROR("#### Failed to allocate SDP DB buffer! ####");
+                return;
             }
         }
 
@@ -2253,18 +2183,15 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
     }
 
     /* no more services to be discovered */
-    if(bta_dm_search_cb.service_index >= BTA_MAX_SERVICE_ID)
-    {
-        if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-        {
-            p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
-            p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
-            bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name,
-                    bta_dm_get_remname(), BD_NAME_LEN);
+    if (bta_dm_search_cb.service_index >= BTA_MAX_SERVICE_ID) {
+        tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+        p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
+        p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
+        bdcpy(p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
+        strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name,
+                bta_dm_get_remname(), BD_NAME_LEN);
 
-            bta_sys_sendmsg(p_msg);
-        }
+        bta_sys_sendmsg(p_msg);
     }
 }
 
@@ -2279,29 +2206,24 @@ static void bta_dm_find_services ( BD_ADDR bd_addr)
 *******************************************************************************/
 static void bta_dm_discover_next_device(void)
 {
-
-    tBTA_DM_MSG * p_msg;
-
     APPL_TRACE_DEBUG("bta_dm_discover_next_device");
 
     /* searching next device on inquiry result */
-    if((bta_dm_search_cb.p_btm_inq_info = BTM_InqDbNext(bta_dm_search_cb.p_btm_inq_info)) != NULL)
-    {
+    if((bta_dm_search_cb.p_btm_inq_info = BTM_InqDbNext(bta_dm_search_cb.p_btm_inq_info)) != NULL) {
         bta_dm_search_cb.name_discover_done = FALSE;
         bta_dm_search_cb.peer_name[0]       = 0;
         bta_dm_discover_device(bta_dm_search_cb.p_btm_inq_info->results.remote_bd_addr);
-    }
-    else
-    {
+    } else {
+        tBTA_DM_MSG *p_msg =
+            (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+
         /* no devices, search complete */
         bta_dm_search_cb.services = 0;
 
-        if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-        {
-            p_msg->hdr.event          = BTA_DM_SEARCH_CMPL_EVT;
-            p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
-            bta_sys_sendmsg(p_msg);
-        }
+        p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
+        p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
+
+        bta_sys_sendmsg(p_msg);
     }
 }
 
@@ -2316,7 +2238,6 @@ static void bta_dm_discover_next_device(void)
 *******************************************************************************/
 static void bta_dm_discover_device(BD_ADDR remote_bd_addr)
 {
-    tBTA_DM_MSG * p_msg;
     tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
 
 #if BLE_INCLUDED == TRUE
@@ -2444,19 +2365,17 @@ static void bta_dm_discover_device(BD_ADDR remote_bd_addr)
     }
 
     /* name discovery and service discovery are done for this device */
-    if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-    {
-        p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
-        /* initialize the data structure - includes p_raw_data and raw_data_size */
-        memset(&(p_msg->disc_result.result), 0, sizeof(tBTA_DM_DISC_RES));
-        p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
-        p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
-        bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name,
-                      (char*)bta_dm_search_cb.peer_name, BD_NAME_LEN);
-
-        bta_sys_sendmsg(p_msg);
-    }
+    tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+    p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
+    /* initialize the data structure - includes p_raw_data and raw_data_size */
+    memset(&(p_msg->disc_result.result), 0, sizeof(tBTA_DM_DISC_RES));
+    p_msg->disc_result.result.disc_res.result = BTA_SUCCESS;
+    p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
+    bdcpy(p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
+    strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name,
+            (char*)bta_dm_search_cb.peer_name, BD_NAME_LEN);
+
+    bta_sys_sendmsg(p_msg);
 }
 
 /*******************************************************************************
@@ -2471,15 +2390,13 @@ static void bta_dm_discover_device(BD_ADDR remote_bd_addr)
 static void bta_dm_sdp_callback (UINT16 sdp_status)
 {
 
-    tBTA_DM_SDP_RESULT * p_msg;
+    tBTA_DM_SDP_RESULT *p_msg =
+        (tBTA_DM_SDP_RESULT *)osi_malloc(sizeof(tBTA_DM_SDP_RESULT));
 
-    if ((p_msg = (tBTA_DM_SDP_RESULT *) osi_getbuf(sizeof(tBTA_DM_SDP_RESULT))) != NULL)
-    {
-        p_msg->hdr.event = BTA_DM_SDP_RESULT_EVT;
-        p_msg->sdp_result = sdp_status;
-        bta_sys_sendmsg(p_msg);
+    p_msg->hdr.event = BTA_DM_SDP_RESULT_EVT;
+    p_msg->sdp_result = sdp_status;
 
-    }
+    bta_sys_sendmsg(p_msg);
 }
 
 /*******************************************************************************
@@ -2548,30 +2465,21 @@ static void bta_dm_inq_results_cb (tBTM_INQ_RESULTS *p_inq, UINT8 *p_eir)
 *******************************************************************************/
 static void bta_dm_inq_cmpl_cb (void * p_result)
 {
-    tBTA_DM_MSG * p_msg;
+    tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
 
-    if (bta_dm_search_cb.cancel_pending == FALSE)
-    {
-        APPL_TRACE_DEBUG("%s", __FUNCTION__);
-        p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG));
-        if (p_msg != NULL) {
-            p_msg->inq_cmpl.hdr.event = BTA_DM_INQUIRY_CMPL_EVT;
-            p_msg->inq_cmpl.num = ((tBTM_INQUIRY_CMPL *)p_result)->num_resp;
-            bta_sys_sendmsg(p_msg);
-        }
-    }
-    else
-    {
+    APPL_TRACE_DEBUG("%s", __func__);
+
+    if (bta_dm_search_cb.cancel_pending == FALSE) {
+        p_msg->inq_cmpl.hdr.event = BTA_DM_INQUIRY_CMPL_EVT;
+        p_msg->inq_cmpl.num = ((tBTM_INQUIRY_CMPL *)p_result)->num_resp;
+    } else {
         bta_dm_search_cb.cancel_pending = FALSE;
         bta_dm_search_cancel_notify(NULL);
-
-        p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG));
-        if (p_msg != NULL) {
-            p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
-            p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
-            bta_sys_sendmsg(p_msg);
-        }
+        p_msg->hdr.event = BTA_DM_SEARCH_CMPL_EVT;
+        p_msg->hdr.layer_specific = BTA_DM_API_DISCOVER_EVT;
     }
+
+    bta_sys_sendmsg(p_msg);
 }
 
 /*******************************************************************************
@@ -2641,8 +2549,6 @@ static void bta_dm_service_search_remname_cback (BD_ADDR bd_addr, DEV_CLASS dc,
 *******************************************************************************/
 static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)
 {
-    tBTA_DM_REM_NAME * p_msg;
-
     APPL_TRACE_DEBUG("bta_dm_remname_cback len = %d name=<%s>", p_remote_name->length,
                       p_remote_name->remote_bd_name);
 
@@ -2660,15 +2566,14 @@ static void bta_dm_remname_cback (tBTM_REMOTE_DEV_NAME *p_remote_name)
     }
 #endif
 
-    if ((p_msg = (tBTA_DM_REM_NAME *) osi_getbuf(sizeof(tBTA_DM_REM_NAME))) != NULL)
-    {
-        bdcpy (p_msg->result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-        strlcpy((char*)p_msg->result.disc_res.bd_name,
-                (char*)p_remote_name->remote_bd_name, BD_NAME_LEN);
-        p_msg->hdr.event = BTA_DM_REMT_NAME_EVT;
+    tBTA_DM_REM_NAME *p_msg =
+        (tBTA_DM_REM_NAME *)osi_malloc(sizeof(tBTA_DM_REM_NAME));
+    bdcpy(p_msg->result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
+    strlcpy((char*)p_msg->result.disc_res.bd_name,
+            (char*)p_remote_name->remote_bd_name, BD_NAME_LEN);
+    p_msg->hdr.event = BTA_DM_REMT_NAME_EVT;
 
-        bta_sys_sendmsg(p_msg);
-    }
+    bta_sys_sendmsg(p_msg);
 }
 
 /*******************************************************************************
@@ -2871,6 +2776,12 @@ static UINT8  bta_dm_new_link_key_cback(BD_ADDR bd_addr, DEV_CLASS dev_class,
 #endif
         if(bta_dm_cb.p_sec_cback)
             bta_dm_cb.p_sec_cback(event, &sec_event);
+
+        // Setting remove_dev_pending flag to FALSE, where it will avoid deleting the
+        // security device record when the ACL connection link goes down in case of
+        // reconnection.
+        if (bta_dm_cb.device_list.count)
+            bta_dm_reset_sec_dev_pending(p_auth_cmpl->bd_addr);
     }
     else
     {
@@ -2970,6 +2881,8 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
     /*case BTM_SP_KEY_REQ_EVT: */
     case BTM_SP_KEY_NOTIF_EVT:
 #endif
+        bta_dm_cb.num_val = sec_event.key_notif.passkey = p_data->key_notif.passkey;
+
         if(BTM_SP_CFM_REQ_EVT == event)
         {
           /* Due to the switch case falling through below to BTM_SP_KEY_NOTIF_EVT,
@@ -2995,7 +2908,6 @@ static UINT8 bta_dm_sp_cback (tBTM_SP_EVT event, tBTM_SP_EVT_DATA *p_data)
            }
         }
 
-        bta_dm_cb.num_val = sec_event.key_notif.passkey = p_data->key_notif.passkey;
         if (BTM_SP_KEY_NOTIF_EVT == event)
         {
             /* If the device name is not known, save bdaddr and devclass
@@ -3106,96 +3018,48 @@ static void bta_dm_local_name_cback(UINT8 *p_name)
 *******************************************************************************/
 static void bta_dm_bl_change_cback (tBTM_BL_EVENT_DATA *p_data)
 {
-    tBTA_DM_ACL_CHANGE * p_msg;
+    tBTA_DM_ACL_CHANGE *p_msg =
+        (tBTA_DM_ACL_CHANGE *)osi_malloc(sizeof(tBTA_DM_ACL_CHANGE));
 
-    if ((p_msg = (tBTA_DM_ACL_CHANGE *) osi_getbuf(sizeof(tBTA_DM_ACL_CHANGE))) != NULL)
-    {
-        p_msg->event = p_data->event;
-        p_msg->is_new = FALSE;
+    p_msg->event = p_data->event;
+    p_msg->is_new = FALSE;
 
-        switch(p_msg->event)
-        {
-        case BTM_BL_CONN_EVT:
-            p_msg->is_new = TRUE;
-            bdcpy(p_msg->bd_addr, p_data->conn.p_bda);
+    switch (p_msg->event) {
+    case BTM_BL_CONN_EVT:
+        p_msg->is_new = TRUE;
+        bdcpy(p_msg->bd_addr, p_data->conn.p_bda);
 #if BLE_INCLUDED == TRUE
-            p_msg->transport = p_data->conn.transport;
-            p_msg->handle = p_data->conn.handle;
+        p_msg->transport = p_data->conn.transport;
+        p_msg->handle = p_data->conn.handle;
 #endif
-            break;
-        case BTM_BL_DISCN_EVT:
-            bdcpy(p_msg->bd_addr, p_data->discn.p_bda);
+        break;
+    case BTM_BL_DISCN_EVT:
+        bdcpy(p_msg->bd_addr, p_data->discn.p_bda);
 #if BLE_INCLUDED == TRUE
-            p_msg->transport = p_data->discn.transport;
-            p_msg->handle = p_data->discn.handle;
+        p_msg->transport = p_data->discn.transport;
+        p_msg->handle = p_data->discn.handle;
 #endif
-            break;
-        case BTM_BL_UPDATE_EVT:
-            p_msg->busy_level = p_data->update.busy_level;
-            p_msg->busy_level_flags = p_data->update.busy_level_flags;
-            break;
-        case BTM_BL_ROLE_CHG_EVT:
-            p_msg->new_role = p_data->role_chg.new_role;
-            p_msg->hci_status = p_data->role_chg.hci_status;
-            bdcpy(p_msg->bd_addr, p_data->role_chg.p_bda);
-            break;
-        case BTM_BL_COLLISION_EVT:
-            bdcpy(p_msg->bd_addr, p_data->conn.p_bda);
-            break;
-        }
-
-        p_msg->hdr.event = BTA_DM_ACL_CHANGE_EVT;
-        bta_sys_sendmsg(p_msg);
-
+        break;
+    case BTM_BL_UPDATE_EVT:
+        p_msg->busy_level = p_data->update.busy_level;
+        p_msg->busy_level_flags = p_data->update.busy_level_flags;
+        break;
+    case BTM_BL_ROLE_CHG_EVT:
+        p_msg->new_role = p_data->role_chg.new_role;
+        p_msg->hci_status = p_data->role_chg.hci_status;
+        bdcpy(p_msg->bd_addr, p_data->role_chg.p_bda);
+        break;
+    case BTM_BL_COLLISION_EVT:
+        bdcpy(p_msg->bd_addr, p_data->conn.p_bda);
+        break;
     }
 
+    p_msg->hdr.event = BTA_DM_ACL_CHANGE_EVT;
+    bta_sys_sendmsg(p_msg);
 }
 
 /*******************************************************************************
 **
-** Function         bta_dm_acl_change_cback
-**
-** Description      Callback from btm when acl connection goes up or down
-**
-**
-** Returns          void
-**
-*******************************************************************************/
-#if BLE_INCLUDED == TRUE
-static void bta_dm_acl_change_cback(BD_ADDR p_bda, DEV_CLASS p_dc, BD_NAME p_bdn,
-                                    UINT8 *features, BOOLEAN is_new,UINT16 handle,
-                                    tBT_TRANSPORT transport)
-#else
-static void bta_dm_acl_change_cback(BD_ADDR p_bda, DEV_CLASS p_dc, BD_NAME p_bdn,
-                                    UINT8 *features, BOOLEAN is_new)
-#endif
-{
-    tBTA_DM_ACL_CHANGE *p_msg = (tBTA_DM_ACL_CHANGE *) osi_getbuf(sizeof(tBTA_DM_ACL_CHANGE));
-    if (p_msg != NULL)
-    {
-        memset(p_msg, 0, sizeof(tBTA_DM_ACL_CHANGE));
-
-        bdcpy(p_msg->bd_addr, p_bda);
-        p_msg->is_new = is_new;
-#if BLE_INCLUDED == TRUE
-        p_msg->handle = handle;
-        p_msg->transport = transport;
-#endif
-        /* This is collision case */
-        if (features != NULL)
-        {
-            if ((features[0] == 0xFF) && !is_new)
-                p_msg->event = BTM_BL_COLLISION_EVT;
-        }
-
-        p_msg->hdr.event = BTA_DM_ACL_CHANGE_EVT;
-        bta_sys_sendmsg(p_msg);
-    }
-}
-
-
-/*******************************************************************************
-**
 ** Function         bta_dm_rs_cback
 **
 ** Description      Receives the role switch complete event
@@ -3469,12 +3333,16 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
         }
         if (conn.link_down.is_removed)
         {
-            BTM_SecDeleteDevice(p_bda);
+            // p_bda points to security record, which is removed in
+            // BTM_SecDeleteDevice.
+            BD_ADDR addr_copy;
+            memcpy(addr_copy, p_bda, BD_ADDR_LEN);
+            BTM_SecDeleteDevice(addr_copy);
 #if (BLE_INCLUDED == TRUE && BTA_GATT_INCLUDED == TRUE)
             /* need to remove all pending background connection */
-            BTA_GATTC_CancelOpen(0, p_bda, FALSE);
+            BTA_GATTC_CancelOpen(0, addr_copy, FALSE);
             /* remove all cached GATT information */
-            BTA_GATTC_Refresh(p_bda);
+            BTA_GATTC_Refresh(addr_copy);
 #endif
          }
 
@@ -3503,24 +3371,21 @@ void bta_dm_acl_change(tBTA_DM_MSG *p_data)
 *******************************************************************************/
 static void bta_dm_disable_conn_down_timer_cback(UNUSED_ATTR void *data)
 {
-    tBTA_SYS_HW_MSG *sys_enable_event;
+    tBTA_SYS_HW_MSG *sys_enable_event =
+        (tBTA_SYS_HW_MSG *)osi_malloc(sizeof(tBTA_SYS_HW_MSG));
 
     /* disable the power managment module */
     bta_dm_disable_pm();
 
     /* register our callback to SYS HW manager */
-    bta_sys_hw_register( BTA_SYS_HW_BLUETOOTH, bta_dm_sys_hw_cback );
+    bta_sys_hw_register(BTA_SYS_HW_BLUETOOTH, bta_dm_sys_hw_cback );
 
     /* send a message to BTA SYS */
-    if ((sys_enable_event = (tBTA_SYS_HW_MSG *) osi_getbuf(sizeof(tBTA_SYS_HW_MSG))) != NULL)
-    {
-        sys_enable_event->hdr.event = BTA_SYS_API_DISABLE_EVT;
-        sys_enable_event->hw_module = BTA_SYS_HW_BLUETOOTH;
-        bta_sys_sendmsg(sys_enable_event);
-    }
+    sys_enable_event->hdr.event = BTA_SYS_API_DISABLE_EVT;
+    sys_enable_event->hw_module = BTA_SYS_HW_BLUETOOTH;
+    bta_sys_sendmsg(sys_enable_event);
 
     bta_dm_cb.disabling = FALSE;
-
 }
 
 /*******************************************************************************
@@ -3612,6 +3477,29 @@ static void bta_dm_delay_role_switch_cback(UNUSED_ATTR void *data)
 
 /*******************************************************************************
 **
+** Function         bta_dm_reset_sec_dev_pending
+**
+** Description      Setting the remove device pending status to FALSE from
+**                  security device DB, when the link key notification
+**                  event comes.
+**
+** Returns          void
+**
+*******************************************************************************/
+static void bta_dm_reset_sec_dev_pending(BD_ADDR remote_bd_addr)
+{
+    for (size_t i = 0; i < bta_dm_cb.device_list.count; i++)
+    {
+        if (bdcmp(bta_dm_cb.device_list.peer_device[i].peer_bdaddr, remote_bd_addr) == 0)
+        {
+            bta_dm_cb.device_list.peer_device[i].remove_dev_pending = FALSE;
+            return;
+        }
+    }
+}
+
+/*******************************************************************************
+**
 ** Function         bta_dm_remove_sec_dev_entry
 **
 ** Description      Removes device entry from Security device DB if ACL connection with
@@ -3623,24 +3511,19 @@ static void bta_dm_delay_role_switch_cback(UNUSED_ATTR void *data)
 *******************************************************************************/
 static void bta_dm_remove_sec_dev_entry(BD_ADDR remote_bd_addr)
 {
-    UINT16 index = 0;
     if ( BTM_IsAclConnectionUp(remote_bd_addr, BT_TRANSPORT_LE) ||
          BTM_IsAclConnectionUp(remote_bd_addr, BT_TRANSPORT_BR_EDR))
     {
-         APPL_TRACE_DEBUG("%s ACL is not down. Schedule for  Dev Removal when ACL closes",
-                            __FUNCTION__);
-        for (index = 0; index < bta_dm_cb.device_list.count; index ++)
+        APPL_TRACE_DEBUG("%s ACL is not down. Schedule for  Dev Removal when ACL closes",
+                            __func__);
+        BTM_SecClearSecurityFlags (remote_bd_addr);
+        for (int i = 0; i < bta_dm_cb.device_list.count; i++)
         {
-            if (!bdcmp( bta_dm_cb.device_list.peer_device[index].peer_bdaddr, remote_bd_addr))
+            if (!bdcmp( bta_dm_cb.device_list.peer_device[i].peer_bdaddr, remote_bd_addr))
+            {
+                bta_dm_cb.device_list.peer_device[i].remove_dev_pending = TRUE;
                 break;
-        }
-        if (index != bta_dm_cb.device_list.count)
-        {
-            bta_dm_cb.device_list.peer_device[index].remove_dev_pending = TRUE;
-        }
-        else
-        {
-            APPL_TRACE_ERROR(" %s Device does not exist in DB", __FUNCTION__);
+            }
         }
     }
     else
@@ -3798,6 +3681,34 @@ static void bta_dm_bond_cancel_complete_cback(tBTM_STATUS result)
 
 /*******************************************************************************
 **
+** Function         find_utf8_char_boundary
+**
+** Description      This function checks a UTF8 string |utf8str| starting at
+**                  |offset|, moving backwards and returns the offset of the
+**                  next valid UTF8 character boundary found.
+**
+** Returns          Offset of UTF8 character boundary
+**
+*******************************************************************************/
+static size_t find_utf8_char_boundary(const char *utf8str, size_t offset)
+{
+    assert(utf8str);
+    assert(offset > 0);
+
+    while (--offset)
+    {
+        uint8_t ch = (uint8_t)utf8str[offset];
+        if ((ch & 0x80) == 0x00) // ASCII
+            return offset + 1;
+        if ((ch & 0xC0) == 0xC0) // Multi-byte sequence start
+            return offset;
+    }
+
+    return 0;
+}
+
+/*******************************************************************************
+**
 ** Function         bta_dm_set_eir
 **
 ** Description      This function creates EIR tagged data and writes it to controller.
@@ -3841,12 +3752,7 @@ static void bta_dm_set_eir (char *local_name)
 #endif  // BTA_EIR_CANNED_UUID_LIST
 
     /* Allocate a buffer to hold HCI command */
-    BT_HDR *p_buf = (BT_HDR *)osi_getbuf(BTM_CMD_BUF_SIZE);
-    if (p_buf == NULL)
-    {
-        APPL_TRACE_ERROR("bta_dm_set_eir couldn't allocate buffer");
-        return;
-    }
+    BT_HDR *p_buf = (BT_HDR *)osi_malloc(BTM_CMD_BUF_SIZE);
     p = (UINT8 *)p_buf + BTM_HCI_EIR_OFFSET;
 
     memset(p, 0x00, HCI_EXT_INQ_RESPONSE_LEN );
@@ -3874,14 +3780,15 @@ static void bta_dm_set_eir (char *local_name)
 #endif  // BTA_EIR_CANNED_UUID_LIST
 
         /* if UUID doesn't fit remaing space, shorten local name */
-        if ( local_name_len > (free_eir_length - 4 - num_uuid*LEN_UUID_16))
+        if (local_name_len > (free_eir_length - 4 - num_uuid*LEN_UUID_16))
         {
-            APPL_TRACE_WARNING("BTA EIR: local name is shortened");
-            local_name_len = p_bta_dm_eir_cfg->bta_dm_eir_min_name_len;
+            local_name_len = find_utf8_char_boundary(local_name,
+                p_bta_dm_eir_cfg->bta_dm_eir_min_name_len);
+            APPL_TRACE_WARNING("%s local name is shortened (%d)", __func__, local_name_len);
             data_type = BTM_EIR_SHORTENED_LOCAL_NAME_TYPE;
-        }
-        else
+        } else {
             data_type = BTM_EIR_COMPLETE_LOCAL_NAME_TYPE;
+        }
     }
 
     UINT8_TO_STREAM(p, local_name_len + 1);
@@ -4491,6 +4398,11 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
             bta_dm_cb.p_sec_cback(BTA_DM_BLE_NC_REQ_EVT, &sec_event);
             break;
 
+        case BTM_LE_SC_OOB_REQ_EVT:
+            bdcpy(sec_event.ble_req.bd_addr, bda);
+            bta_dm_cb.p_sec_cback(BTA_DM_BLE_SC_OOB_REQ_EVT, &sec_event);
+            break;
+
         case BTM_LE_KEY_EVT:
             bdcpy(sec_event.ble_key.bd_addr, bda);
             sec_event.ble_key.key_type = p_data->key.key_type;
@@ -4518,7 +4430,6 @@ static UINT8 bta_dm_ble_smp_cback (tBTM_LE_EVT event, BD_ADDR bda, tBTM_LE_EVT_D
             else
             {
                 sec_event.auth_cmpl.success = TRUE;
-                /* We also register for Service Changed right after connect. */
                 if (!p_data->complt.smp_over_br)
                     GATT_ConfigServiceChangeCCC(bda, TRUE, BT_TRANSPORT_LE);
             }
@@ -5516,53 +5427,49 @@ static void bta_dm_gatt_disc_result(tBTA_GATT_ID service_id)
 *******************************************************************************/
 static void bta_dm_gatt_disc_complete(UINT16 conn_id, tBTA_GATT_STATUS status)
 {
-    tBTA_DM_MSG *p_msg;
-
-    APPL_TRACE_DEBUG("bta_dm_gatt_disc_complete conn_id = %d",conn_id);
+    APPL_TRACE_DEBUG("%s conn_id = %d", __func__, conn_id);
 
-    if (bta_dm_search_cb.uuid_to_search > 0) bta_dm_search_cb.uuid_to_search --;
+    if (bta_dm_search_cb.uuid_to_search > 0)
+        bta_dm_search_cb.uuid_to_search --;
 
-    if (status == BTA_GATT_OK && bta_dm_search_cb.uuid_to_search > 0)
-    {
+    if (status == BTA_GATT_OK && bta_dm_search_cb.uuid_to_search > 0) {
         btm_dm_start_disc_gatt_services(conn_id);
-    }
-    else
-    {
+    } else {
+        tBTA_DM_MSG *p_msg = (tBTA_DM_MSG *)osi_malloc(sizeof(tBTA_DM_MSG));
+
         bta_dm_search_cb.uuid_to_search = 0;
 
         /* no more services to be discovered */
-        if ((p_msg = (tBTA_DM_MSG *) osi_getbuf(sizeof(tBTA_DM_MSG))) != NULL)
-        {
-            p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
-            p_msg->disc_result.result.disc_res.result = (status == BTA_GATT_OK) ? BTA_SUCCESS :BTA_FAILURE;
-            APPL_TRACE_DEBUG("%s service found: 0x%08x", __FUNCTION__,
-                             bta_dm_search_cb.services_found);
-            p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
-            p_msg->disc_result.result.disc_res.num_uuids = 0;
-            p_msg->disc_result.result.disc_res.p_uuid_list = NULL;
-            bdcpy (p_msg->disc_result.result.disc_res.bd_addr, bta_dm_search_cb.peer_bdaddr);
-            strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name, bta_dm_get_remname(), BD_NAME_LEN);
-
-            p_msg->disc_result.result.disc_res.device_type |= BT_DEVICE_TYPE_BLE;
-            if ( bta_dm_search_cb.ble_raw_used > 0 )
-            {
-                p_msg->disc_result.result.disc_res.p_raw_data = osi_getbuf(bta_dm_search_cb.ble_raw_used);
+        p_msg->hdr.event = BTA_DM_DISCOVERY_RESULT_EVT;
+        p_msg->disc_result.result.disc_res.result = (status == BTA_GATT_OK) ? BTA_SUCCESS :BTA_FAILURE;
+        APPL_TRACE_DEBUG("%s service found: 0x%08x", __func__,
+                         bta_dm_search_cb.services_found);
+        p_msg->disc_result.result.disc_res.services = bta_dm_search_cb.services_found;
+        p_msg->disc_result.result.disc_res.num_uuids = 0;
+        p_msg->disc_result.result.disc_res.p_uuid_list = NULL;
+        bdcpy(p_msg->disc_result.result.disc_res.bd_addr,
+              bta_dm_search_cb.peer_bdaddr);
+        strlcpy((char*)p_msg->disc_result.result.disc_res.bd_name,
+                bta_dm_get_remname(), BD_NAME_LEN);
 
-                memcpy( p_msg->disc_result.result.disc_res.p_raw_data,
-                            bta_dm_search_cb.p_ble_rawdata,
-                            bta_dm_search_cb.ble_raw_used );
+        p_msg->disc_result.result.disc_res.device_type |= BT_DEVICE_TYPE_BLE;
+        if (bta_dm_search_cb.ble_raw_used > 0) {
+            p_msg->disc_result.result.disc_res.p_raw_data =
+                osi_malloc(bta_dm_search_cb.ble_raw_used);
 
-                p_msg->disc_result.result.disc_res.raw_data_size = bta_dm_search_cb.ble_raw_used;
-            }
-            else
-            {
-                p_msg->disc_result.result.disc_res.p_raw_data = NULL;
-                bta_dm_search_cb.p_ble_rawdata = 0;
-            }
+            memcpy(p_msg->disc_result.result.disc_res.p_raw_data,
+                   bta_dm_search_cb.p_ble_rawdata,
+                   bta_dm_search_cb.ble_raw_used);
 
-            bta_sys_sendmsg(p_msg);
+            p_msg->disc_result.result.disc_res.raw_data_size =
+                bta_dm_search_cb.ble_raw_used;
+        } else {
+            p_msg->disc_result.result.disc_res.p_raw_data = NULL;
+            bta_dm_search_cb.p_ble_rawdata = 0;
         }
 
+        bta_sys_sendmsg(p_msg);
+
         if (conn_id != BTA_GATT_INVALID_CONN_ID)
         {
             /* start a GATT channel close delay timer */
@@ -5709,7 +5616,7 @@ static void bta_dm_gattc_callback(tBTA_GATTC_EVT event, tBTA_GATTC *p_data)
             break;
 
         case BTA_GATTC_SEARCH_RES_EVT:
-            bta_dm_gatt_disc_result(p_data->srvc_res.service_uuid.id);
+            bta_dm_gatt_disc_result(p_data->srvc_res.service_uuid);
             break;
 
         case BTA_GATTC_SEARCH_CMPL_EVT: