From 0dbe21d88e05a43d6882248144e4e9128f4c1928 Mon Sep 17 00:00:00 2001
From: Pavlin Radoslavov <pavlin@google.com>
Date: Thu, 11 Jan 2018 17:28:16 -0800
Subject: [PATCH] Allocate/free the SDP connection timers only during stack
 startup/shutdown

This avoids freeing the sdp_conn_timer within the alarm callback itself.

Bug: 67110137
Test: Manual
Change-Id: I775b4b532cd42cf207258c53c6052a167a124627
Merged-In: I775b4b532cd42cf207258c53c6052a167a124627
(cherry picked from commit ef6a4a0c9d9220a7d909863349d7a0c0b967d54c)
---
 stack/btu/btu_init.cc  |  2 ++
 stack/sdp/sdp_main.cc  | 11 +++++++++++
 stack/sdp/sdp_utils.cc |  6 +++---
 stack/sdp/sdpint.h     |  1 +
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/stack/btu/btu_init.cc b/stack/btu/btu_init.cc
index 14612a390..16b9d617a 100644
--- a/stack/btu/btu_init.cc
+++ b/stack/btu/btu_init.cc
@@ -102,6 +102,8 @@ void btu_free_core(void) {
   /* Free the mandatory core stack components */
   l2c_free();
 
+  sdp_free();
+
   gatt_free();
 }
 
diff --git a/stack/sdp/sdp_main.cc b/stack/sdp/sdp_main.cc
index 85112a1f0..023520393 100644
--- a/stack/sdp/sdp_main.cc
+++ b/stack/sdp/sdp_main.cc
@@ -75,6 +75,10 @@ void sdp_init(void) {
   /* Clears all structures and local SDP database (if Server is enabled) */
   memset(&sdp_cb, 0, sizeof(tSDP_CB));
 
+  for (int i = 0; i < SDP_MAX_CONNECTIONS; i++) {
+    sdp_cb.ccb[i].sdp_conn_timer = alarm_new("sdp.sdp_conn_timer");
+  }
+
   /* Initialize the L2CAP configuration. We only care about MTU and flush */
   sdp_cb.l2cap_my_cfg.mtu_present = true;
   sdp_cb.l2cap_my_cfg.mtu = SDP_MTU_SIZE;
@@ -124,6 +128,13 @@ void sdp_init(void) {
   }
 }
 
+void sdp_free(void) {
+  for (int i = 0; i < SDP_MAX_CONNECTIONS; i++) {
+    alarm_free(sdp_cb.ccb[i].sdp_conn_timer);
+    sdp_cb.ccb[i].sdp_conn_timer = NULL;
+  }
+}
+
 #if (SDP_DEBUG == TRUE)
 /*******************************************************************************
  *
diff --git a/stack/sdp/sdp_utils.cc b/stack/sdp/sdp_utils.cc
index 720c74672..803e963c2 100644
--- a/stack/sdp/sdp_utils.cc
+++ b/stack/sdp/sdp_utils.cc
@@ -108,8 +108,9 @@ tCONN_CB* sdpu_allocate_ccb(void) {
   /* Look through each connection control block for a free one */
   for (xx = 0, p_ccb = sdp_cb.ccb; xx < SDP_MAX_CONNECTIONS; xx++, p_ccb++) {
     if (p_ccb->con_state == SDP_STATE_IDLE) {
+      alarm_t* alarm = p_ccb->sdp_conn_timer;
       memset(p_ccb, 0, sizeof(tCONN_CB));
-      p_ccb->sdp_conn_timer = alarm_new("sdp.sdp_conn_timer");
+      p_ccb->sdp_conn_timer = alarm;
       return (p_ccb);
     }
   }
@@ -129,8 +130,7 @@ tCONN_CB* sdpu_allocate_ccb(void) {
  ******************************************************************************/
 void sdpu_release_ccb(tCONN_CB* p_ccb) {
   /* Ensure timer is stopped */
-  alarm_free(p_ccb->sdp_conn_timer);
-  p_ccb->sdp_conn_timer = NULL;
+  alarm_cancel(p_ccb->sdp_conn_timer);
 
   /* Drop any response pointer we may be holding */
   p_ccb->con_state = SDP_STATE_IDLE;
diff --git a/stack/sdp/sdpint.h b/stack/sdp/sdpint.h
index 9c1f112e5..53d238aee 100644
--- a/stack/sdp/sdpint.h
+++ b/stack/sdp/sdpint.h
@@ -222,6 +222,7 @@ extern tSDP_CB sdp_cb;
 
 /* Functions provided by sdp_main.cc */
 extern void sdp_init(void);
+extern void sdp_free(void);
 extern void sdp_disconnect(tCONN_CB* p_ccb, uint16_t reason);
 
 #if (SDP_DEBUG == TRUE)
-- 
2.11.0