From 53bb26683727cb466adb66e10196cf392eba7545 Mon Sep 17 00:00:00 2001
From: Hansong Zhang <hsz@google.com>
Date: Wed, 3 Feb 2021 15:34:15 -0800
Subject: [PATCH] Fix L2cap shim crash on shutdown

Bug: 179110548
Test: car kit
Tag: #stability
Change-Id: Id55bb63fea32d426f65eecbaf32ed45972059d7e
---
 main/shim/l2c_api.cc | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/main/shim/l2c_api.cc b/main/shim/l2c_api.cc
index 09db41883..4ef455ee4 100644
--- a/main/shim/l2c_api.cc
+++ b/main/shim/l2c_api.cc
@@ -76,6 +76,8 @@ void remove_classic_cid_token_entry(uint16_t cid_token) {
   classic_cid_token_to_channel_map_.erase(cid_token);
 }
 
+void remove_classic_dynamic_channel_helper(uint16_t psm);
+
 struct ClassicDynamicChannelHelper {
   ClassicDynamicChannelHelper(uint16_t psm, tL2CAP_APPL_INFO appl_info,
                               classic::DynamicChannelConfigurationOption config,
@@ -143,11 +145,13 @@ struct ClassicDynamicChannelHelper {
     for (const auto& device : channels_) {
       device.second->Close();
     }
+    remove_classic_dynamic_channel_helper(psm_);
   }
 
   void on_channel_close(uint16_t cid_token,
                         bluetooth::hci::ErrorCode error_code) {
     channel_enqueue_buffer_[cid_token] = nullptr;
+    channel_enqueue_buffer_.erase(cid_token);
     channels_[cid_token]->GetQueueUpEnd()->UnregisterDequeue();
     channels_.erase(cid_token);
     do_in_main_thread(FROM_HERE, base::Bind(appl_info_.pL2CA_DisconnectInd_Cb,
@@ -291,6 +295,13 @@ struct ClassicDynamicChannelHelper {
 std::unordered_map<uint16_t, std::unique_ptr<ClassicDynamicChannelHelper>>
     classic_dynamic_channel_helper_map_;
 
+void remove_classic_dynamic_channel_helper(uint16_t psm) {
+  if (classic_dynamic_channel_helper_map_.count(psm) != 0 &&
+      classic_dynamic_channel_helper_map_[psm]->channels_.empty()) {
+    classic_dynamic_channel_helper_map_.erase(psm);
+  }
+}
+
 // Helper: L2cap security enforcement shim
 
 std::unordered_map<intptr_t,
@@ -722,9 +733,6 @@ void L2CA_Deregister(uint16_t psm) {
     return;
   }
   classic_dynamic_channel_helper_map_[psm]->Unregister();
-  if (classic_dynamic_channel_helper_map_[psm]->channels_.empty()) {
-    classic_dynamic_channel_helper_map_.erase(psm);
-  }
 }
 
 /**
@@ -1233,6 +1241,8 @@ void remove_le_cid_token_entry(uint16_t cid_token) {
   le_cid_token_to_channel_map_.erase(cid_token);
 }
 
+void remove_le_dynamic_channel_helper(uint16_t psm);
+
 struct LeDynamicChannelHelper {
   LeDynamicChannelHelper(uint16_t psm, tL2CAP_APPL_INFO appl_info,
                          le::DynamicChannelConfigurationOption config,
@@ -1311,11 +1321,13 @@ struct LeDynamicChannelHelper {
     for (const auto& device : channels_) {
       device.second->Close();
     }
+    remove_le_dynamic_channel_helper(psm_);
   }
 
   void on_channel_close(uint16_t cid_token,
                         bluetooth::hci::ErrorCode error_code) {
     channel_enqueue_buffer_[cid_token] = nullptr;
+    channel_enqueue_buffer_.erase(cid_token);
     channels_[cid_token]->GetQueueUpEnd()->UnregisterDequeue();
     channels_.erase(cid_token);
     do_in_main_thread(FROM_HERE, base::Bind(appl_info_.pL2CA_DisconnectInd_Cb,
@@ -1418,6 +1430,13 @@ struct LeDynamicChannelHelper {
 std::unordered_map<uint16_t, std::unique_ptr<LeDynamicChannelHelper>>
     le_dynamic_channel_helper_map_;
 
+void remove_le_dynamic_channel_helper(uint16_t psm) {
+  if (le_dynamic_channel_helper_map_.count(psm) != 0 &&
+      le_dynamic_channel_helper_map_[psm]->channels_.empty()) {
+    le_dynamic_channel_helper_map_.erase(psm);
+  }
+}
+
 std::unordered_set<uint16_t> assigned_dynamic_le_psm_;
 uint16_t next_assigned_dynamic_le_psm_ = 0x80;
 }  // namespace
@@ -1470,9 +1489,6 @@ void L2CA_DeregisterLECoc(uint16_t psm) {
     return;
   }
   le_dynamic_channel_helper_map_[psm]->Unregister();
-  if (le_dynamic_channel_helper_map_[psm]->channels_.empty()) {
-    le_dynamic_channel_helper_map_.erase(psm);
-  }
 }
 
 uint16_t L2CA_ConnectLECocReq(uint16_t psm, const RawAddress& p_bd_addr,
-- 
2.11.0