OSDN Git Service

DO NOT MERGE: PAN: Always allocate in bta_pan_data_buf_ind_cback
[android-x86/system-bt.git] / bta / pan / bta_pan_act.c
index 2befb71..b72a318 100644 (file)
@@ -26,6 +26,8 @@
 
 #if defined(PAN_INCLUDED) && (PAN_INCLUDED == TRUE)
 
+#include <cutils/log.h>
+
 #include "bta_api.h"
 #include "bta_sys.h"
 #include "bt_common.h"
@@ -88,62 +90,45 @@ static void bta_pan_pm_conn_idle(tBTA_PAN_SCB *p_scb)
 static void bta_pan_conn_state_cback(UINT16 handle, BD_ADDR bd_addr, tPAN_RESULT state,
                                      BOOLEAN is_role_change, UINT8 src_role, UINT8 dst_role)
 {
+    tBTA_PAN_SCB *p_scb;
+    tBTA_PAN_CONN *p_buf = (tBTA_PAN_CONN *)osi_malloc(sizeof(tBTA_PAN_CONN));
 
-    tBTA_PAN_CONN * p_buf;
-    tBTA_PAN_SCB     *p_scb;
-
-
-    if ((p_buf = (tBTA_PAN_CONN *) osi_getbuf(sizeof(tBTA_PAN_CONN))) != NULL)
-    {
-        if((state == PAN_SUCCESS) && !is_role_change)
-        {
-            p_buf->hdr.event = BTA_PAN_CONN_OPEN_EVT;
-            if((p_scb = bta_pan_scb_by_handle(handle)) == NULL)
-            {
-                /* allocate an scb */
-                p_scb = bta_pan_scb_alloc();
-
-            }
-            /* we have exceeded maximum number of connections */
-            if(!p_scb)
-            {
-                PAN_Disconnect (handle);
-                return;
-            }
-
-            p_scb->handle = handle;
-            p_scb->local_role = src_role;
-            p_scb->peer_role = dst_role;
-            p_scb->pan_flow_enable = TRUE;
-            bdcpy(p_scb->bd_addr, bd_addr);
-            p_scb->data_queue = fixed_queue_new(SIZE_MAX);
-
-            if(src_role == PAN_ROLE_CLIENT)
-                p_scb->app_id = bta_pan_cb.app_id[0];
-            else if (src_role == PAN_ROLE_GN_SERVER)
-                p_scb->app_id = bta_pan_cb.app_id[1];
-            else if (src_role == PAN_ROLE_NAP_SERVER)
-                p_scb->app_id = bta_pan_cb.app_id[2];
-
-        }
-        else if((state != PAN_SUCCESS) && !is_role_change)
-        {
-            p_buf->hdr.event = BTA_PAN_CONN_CLOSE_EVT;
-
+    if ((state == PAN_SUCCESS) && !is_role_change) {
+        p_buf->hdr.event = BTA_PAN_CONN_OPEN_EVT;
+        if ((p_scb = bta_pan_scb_by_handle(handle)) == NULL) {
+            /* allocate an scb */
+            p_scb = bta_pan_scb_alloc();
         }
-        else
-        {
+        /* we have exceeded maximum number of connections */
+        if (!p_scb) {
+            PAN_Disconnect (handle);
             return;
         }
 
-        p_buf->result = state;
-        p_buf->hdr.layer_specific = handle;
-        bta_sys_sendmsg(p_buf);
-
+        p_scb->handle = handle;
+        p_scb->local_role = src_role;
+        p_scb->peer_role = dst_role;
+        p_scb->pan_flow_enable = TRUE;
+        bdcpy(p_scb->bd_addr, bd_addr);
+        p_scb->data_queue = fixed_queue_new(SIZE_MAX);
+
+        if (src_role == PAN_ROLE_CLIENT)
+            p_scb->app_id = bta_pan_cb.app_id[0];
+        else if (src_role == PAN_ROLE_GN_SERVER)
+            p_scb->app_id = bta_pan_cb.app_id[1];
+        else if (src_role == PAN_ROLE_NAP_SERVER)
+            p_scb->app_id = bta_pan_cb.app_id[2];
+    }
+    else if ((state != PAN_SUCCESS) && !is_role_change) {
+        p_buf->hdr.event = BTA_PAN_CONN_CLOSE_EVT;
+    } else {
+        return;
     }
 
+    p_buf->result = state;
+    p_buf->hdr.layer_specific = handle;
 
-
+    bta_sys_sendmsg(p_buf);
 }
 
 /*******************************************************************************
@@ -158,35 +143,23 @@ static void bta_pan_conn_state_cback(UINT16 handle, BD_ADDR bd_addr, tPAN_RESULT
 *******************************************************************************/
 static void bta_pan_data_flow_cb(UINT16 handle, tPAN_RESULT result)
 {
-    BT_HDR  *p_buf;
     tBTA_PAN_SCB *p_scb;
 
-    if((p_scb = bta_pan_scb_by_handle(handle)) == NULL)
+    if ((p_scb = bta_pan_scb_by_handle(handle)) == NULL)
         return;
 
-    if(result == PAN_TX_FLOW_ON)
-    {
-        if ((p_buf = (BT_HDR *) osi_getbuf(sizeof(BT_HDR))) != NULL)
-        {
-            p_buf->layer_specific = handle;
-            p_buf->event = BTA_PAN_BNEP_FLOW_ENABLE_EVT;
-            bta_sys_sendmsg(p_buf);
-        }
+    if (result == PAN_TX_FLOW_ON) {
+        BT_HDR *p_buf = (BT_HDR *) osi_malloc(sizeof(BT_HDR));
+        p_buf->layer_specific = handle;
+        p_buf->event = BTA_PAN_BNEP_FLOW_ENABLE_EVT;
+        bta_sys_sendmsg(p_buf);
         bta_pan_co_rx_flow(handle, p_scb->app_id, TRUE);
-
-    }
-    else if(result == PAN_TX_FLOW_OFF)
-    {
-
+    } else if (result == PAN_TX_FLOW_OFF) {
         p_scb->pan_flow_enable = FALSE;
         bta_pan_co_rx_flow(handle, p_scb->app_id, FALSE);
-
     }
-
-
 }
 
-
 /*******************************************************************************
 **
 ** Function         bta_pan_data_buf_ind_cback
@@ -201,31 +174,27 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
                                    BOOLEAN ext, BOOLEAN forward)
 {
     tBTA_PAN_SCB *p_scb;
-    BT_HDR * p_event;
     BT_HDR *p_new_buf;
 
-    if ( sizeof(tBTA_PAN_DATA_PARAMS) > p_buf->offset )
+    p_scb = bta_pan_scb_by_handle(handle);
+    if (p_scb == NULL)
     {
-        /* offset smaller than data structure in front of actual data */
-        p_new_buf = (BT_HDR *)osi_getbuf(PAN_BUF_SIZE);
-        if(!p_new_buf)
-        {
-            APPL_TRACE_WARNING("Cannot get a PAN buffer");
-            osi_freebuf( p_buf );
-            return;
-        }
-        else
-        {
-            memcpy( (UINT8 *)(p_new_buf+1)+sizeof(tBTA_PAN_DATA_PARAMS), (UINT8 *)(p_buf+1)+p_buf->offset, p_buf->len );
-            p_new_buf->len    = p_buf->len;
-            p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS);
-            osi_freebuf( p_buf );
-        }
+        return;
     }
-    else
-    {
-        p_new_buf = p_buf;
+
+    if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >
+        PAN_BUF_SIZE) {
+        android_errorWriteLog(0x534e4554, "63146237");
+        APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,
+                         p_buf->len);
+        return;
     }
+    p_new_buf = (BT_HDR *)osi_malloc(PAN_BUF_SIZE);
+    memcpy((UINT8 *)(p_new_buf + 1) + sizeof(tBTA_PAN_DATA_PARAMS),
+           (UINT8 *)(p_buf + 1) + p_buf->offset, p_buf->len);
+    p_new_buf->len    = p_buf->len;
+    p_new_buf->offset = sizeof(tBTA_PAN_DATA_PARAMS);
+
     /* copy params into the space before the data */
     bdcpy(((tBTA_PAN_DATA_PARAMS *)p_new_buf)->src, src);
     bdcpy(((tBTA_PAN_DATA_PARAMS *)p_new_buf)->dst, dst);
@@ -233,25 +202,13 @@ static void bta_pan_data_buf_ind_cback(UINT16 handle, BD_ADDR src, BD_ADDR dst,
     ((tBTA_PAN_DATA_PARAMS *)p_new_buf)->ext = ext;
     ((tBTA_PAN_DATA_PARAMS *)p_new_buf)->forward = forward;
 
-
-    if((p_scb = bta_pan_scb_by_handle(handle)) == NULL)
-    {
-
-        osi_freebuf( p_new_buf );
-        return;
-    }
-
     fixed_queue_enqueue(p_scb->data_queue, p_new_buf);
-    if ((p_event = (BT_HDR *) osi_getbuf(sizeof(BT_HDR))) != NULL)
-    {
-        p_event->layer_specific = handle;
-        p_event->event = BTA_PAN_RX_FROM_BNEP_READY_EVT;
-        bta_sys_sendmsg(p_event);
-    }
-
+    BT_HDR *p_event = (BT_HDR *)osi_malloc(sizeof(BT_HDR));
+    p_event->layer_specific = handle;
+    p_event->event = BTA_PAN_RX_FROM_BNEP_READY_EVT;
+    bta_sys_sendmsg(p_event);
 }
 
-
 /*******************************************************************************
 **
 ** Function         bta_pan_pfilt_ind_cback
@@ -487,7 +444,7 @@ void bta_pan_disable(void)
         if (p_scb->in_use)
         {
             while ((p_buf = (BT_HDR *)fixed_queue_try_dequeue(p_scb->data_queue)) != NULL)
-                osi_freebuf(p_buf);
+                osi_free(p_buf);
 
             bta_pan_co_close(p_scb->handle, p_scb->app_id);
 
@@ -558,25 +515,22 @@ void bta_pan_open(tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
 *******************************************************************************/
 void bta_pan_api_close (tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
 {
-    tBTA_PAN_CONN * p_buf;
-    UNUSED(p_data);
-
-    PAN_Disconnect (p_scb->handle);
+    tBTA_PAN_CONN *p_buf = (tBTA_PAN_CONN *)osi_malloc(sizeof(tBTA_PAN_CONN));
 
+    UNUSED(p_data);
 
-    /* send an event to BTA so that application will get the connection
-       close event */
-    if ((p_buf = (tBTA_PAN_CONN *) osi_getbuf(sizeof(tBTA_PAN_CONN))) != NULL)
-    {
-        p_buf->hdr.event = BTA_PAN_CONN_CLOSE_EVT;
+    PAN_Disconnect(p_scb->handle);
 
-        p_buf->hdr.layer_specific = p_scb->handle;
-        bta_sys_sendmsg(p_buf);
+    /*
+     * Send an event to BTA so that application will get the connection
+     * close event.
+     */
+    p_buf->hdr.event = BTA_PAN_CONN_CLOSE_EVT;
+    p_buf->hdr.layer_specific = p_scb->handle;
 
-    }
+    bta_sys_sendmsg(p_buf);
 }
 
-
 /*******************************************************************************
 **
 ** Function         bta_pan_conn_open
@@ -651,7 +605,7 @@ void bta_pan_conn_close(tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
 
     /* free all queued up data buffers */
     while ((p_buf = (BT_HDR *)fixed_queue_try_dequeue(p_scb->data_queue)) != NULL)
-        osi_freebuf(p_buf);
+        osi_free(p_buf);
 
     bta_pan_scb_dealloc(p_scb);
 
@@ -706,7 +660,6 @@ void bta_pan_rx_path(tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
 *******************************************************************************/
 void bta_pan_tx_path(tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
 {
-    BT_HDR * p_buf;
     UNUSED(p_data);
 
     /* if data path configured for tx pull */
@@ -718,7 +671,7 @@ void bta_pan_tx_path(tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
 
         /* free data that exceeds queue level */
         while (fixed_queue_length(p_scb->data_queue) > bta_pan_cb.q_level)
-            osi_freebuf(fixed_queue_try_dequeue(p_scb->data_queue));
+            osi_free(fixed_queue_try_dequeue(p_scb->data_queue));
         bta_pan_pm_conn_idle(p_scb);
     }
     /* if configured for zero copy push */
@@ -727,6 +680,8 @@ void bta_pan_tx_path(tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
         /* if app can accept data */
         if (p_scb->app_flow_enable == TRUE)
         {
+            BT_HDR *p_buf;
+
             /* read data from the queue */
             if ((p_buf = (BT_HDR *)fixed_queue_try_dequeue(p_scb->data_queue)) != NULL)
             {
@@ -743,21 +698,17 @@ void bta_pan_tx_path(tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
             }
             /* free data that exceeds queue level  */
             while (fixed_queue_length(p_scb->data_queue) > bta_pan_cb.q_level)
-                osi_freebuf(fixed_queue_try_dequeue(p_scb->data_queue));
+                osi_free(fixed_queue_try_dequeue(p_scb->data_queue));
 
             /* if there is more data to be passed to
             upper layer */
             if (!fixed_queue_is_empty(p_scb->data_queue))
             {
-                if ((p_buf = (BT_HDR *) osi_getbuf(sizeof(BT_HDR))) != NULL)
-                {
-                    p_buf->layer_specific = p_scb->handle;
-                    p_buf->event = BTA_PAN_RX_FROM_BNEP_READY_EVT;
-                    bta_sys_sendmsg(p_buf);
-                }
-
+                p_buf = (BT_HDR *)osi_malloc(sizeof(BT_HDR));
+                p_buf->layer_specific = p_scb->handle;
+                p_buf->event = BTA_PAN_RX_FROM_BNEP_READY_EVT;
+                bta_sys_sendmsg(p_buf);
             }
-
         }
     }
 }
@@ -817,9 +768,7 @@ void bta_pan_write_buf(tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
 void bta_pan_free_buf(tBTA_PAN_SCB *p_scb, tBTA_PAN_DATA *p_data)
 {
     UNUSED(p_scb);
-
-    osi_freebuf(p_data);
-
+    osi_free(p_data);
 }
 
 #endif /* PAN_INCLUDED */