DO NOT MERGE: PAN: Always allocate in bta_pan_data_buf_ind_cback

[android-x86/system-bt.git] / stack / pan / pan_main.c

diff --git a/stack/pan/pan_main.c b/stack/pan/pan_main.c
index c16190f..b824b31 100644 (file)
--- a/stack/pan/pan_main.c
+++ b/stack/pan/pan_main.c
@@ -222,6 +222,39 @@ void pan_conn_ind_cb (UINT16 handle,
         return;
     }
 
+    /* Check for valid interactions between the three PAN profile roles */
+    /*
+     * For reference, see Table 1 in PAN Profile v1.0 spec.
+     * Note: the remote is the initiator.
+     */
+    BOOLEAN is_valid_interaction = FALSE;
+    switch (remote_uuid->uu.uuid16) {
+    case UUID_SERVCLASS_NAP:
+    case UUID_SERVCLASS_GN:
+        if (local_uuid->uu.uuid16 == UUID_SERVCLASS_PANU)
+            is_valid_interaction = TRUE;
+        break;
+    case UUID_SERVCLASS_PANU:
+        is_valid_interaction = TRUE;
+        break;
+    }
+    /*
+     * Explicitly disable connections to the local PANU if the remote is
+     * not PANU.
+     */
+    if ((local_uuid->uu.uuid16 == UUID_SERVCLASS_PANU) &&
+        (remote_uuid->uu.uuid16 != UUID_SERVCLASS_PANU)) {
+        is_valid_interaction = FALSE;
+    }
+    if (!is_valid_interaction) {
+        PAN_TRACE_ERROR(
+          "PAN Connection failed because of invalid PAN profile roles "
+          "interaction: Remote UUID 0x%x Local UUID 0x%x",
+          remote_uuid->uu.uuid16, local_uuid->uu.uuid16);
+        BNEP_ConnectResp(handle, BNEP_CONN_FAILED_SRC_UUID);
+        return;
+    }
+
     /* Requested destination role is */
     if (local_uuid->uu.uuid16 == UUID_SERVCLASS_PANU)
         req_role = PAN_ROLE_CLIENT;
@@ -553,7 +586,7 @@ void pan_data_buf_ind_cb (UINT16 handle,
     if (!pcb)
     {
         PAN_TRACE_ERROR ("PAN Data buffer indication for wrong handle %d", handle);
-        osi_freebuf (p_buf);
+        osi_free(p_buf);
         return;
     }
 
@@ -561,7 +594,7 @@ void pan_data_buf_ind_cb (UINT16 handle,
     {
         PAN_TRACE_ERROR ("PAN Data indication in wrong state %d for handle %d",
             pcb->con_state, handle);
-        osi_freebuf (p_buf);
+        osi_free(p_buf);
         return;
     }
 
@@ -596,11 +629,8 @@ void pan_data_buf_ind_cb (UINT16 handle,
             if (pan_cb.pan_data_buf_ind_cb)
                 (*pan_cb.pan_data_buf_ind_cb) (pcb->handle, src, dst, protocol, p_buf, ext, forward);
             else if (pan_cb.pan_data_ind_cb)
-            {
                 (*pan_cb.pan_data_ind_cb) (pcb->handle, src, dst, protocol, p_data, len, ext, forward);
-                osi_freebuf (p_buf);
-            }
-
+            osi_free(p_buf);
             return;
         }
 
@@ -614,7 +644,7 @@ void pan_data_buf_ind_cb (UINT16 handle,
             result = BNEP_Write (dst_pcb->handle, dst, p_data, len, protocol, src, ext);
             if (result != BNEP_SUCCESS && result != BNEP_IGNORE_CMD)
                 PAN_TRACE_ERROR ("Failed to write data for PAN connection handle %d", dst_pcb->handle);
-            osi_freebuf (p_buf);
+            osi_free(p_buf);
             return;
         }
     }
@@ -623,13 +653,8 @@ void pan_data_buf_ind_cb (UINT16 handle,
     if (pan_cb.pan_data_buf_ind_cb)
         (*pan_cb.pan_data_buf_ind_cb) (pcb->handle, src, dst, protocol, p_buf, ext, forward);
     else if (pan_cb.pan_data_ind_cb)
-    {
         (*pan_cb.pan_data_ind_cb) (pcb->handle, src, dst, protocol, p_data, len, ext, forward);
-        osi_freebuf (p_buf);
-    }
-    else
-        osi_freebuf (p_buf);
-
+    osi_free(p_buf);
     return;
 }