diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2021-07-28 17:34:20 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2021-07-28 17:34:20 +0000 |
| commit | 124f286f9cf1dabd3e05ee2022e81c8d31090ae7 (patch) | |
| tree | 26214ce01b5ce6aab0dac50cd36e1cd723e163e8 | |
| parent | 5de15fd5c5b63a6fd0b27e12a2185ae0454f407b (diff) | |
| parent | f4a911c0de8a29437c4a90eb30caa0081bf382e8 (diff) | |
| download | bt-124f286f9cf1dabd3e05ee2022e81c8d31090ae7.tar.gz | |
Merge "Fix L2cap LE COC security record leaks" into sc-dev
| -rw-r--r-- | stack/gap/gap_conn.cc | 2 | ||||
| -rw-r--r-- | stack/l2cap/l2c_api.cc | 6 |
2 files changed, 6 insertions, 2 deletions
diff --git a/stack/gap/gap_conn.cc b/stack/gap/gap_conn.cc index 52b15318f..0f0026f71 100644 --- a/stack/gap/gap_conn.cc +++ b/stack/gap/gap_conn.cc @@ -994,7 +994,7 @@ static void gap_release_ccb(tGAP_CCB* p_ccb) { } /* Free the security record for this PSM */ - BTM_SecClrService(p_ccb->service_id); + BTM_SecClrServiceByPsm(p_ccb->psm); if (p_ccb->transport == BT_TRANSPORT_BR_EDR) L2CA_Deregister(p_ccb->psm); if (p_ccb->transport == BT_TRANSPORT_LE) L2CA_DeregisterLECoc(p_ccb->psm); } diff --git a/stack/l2cap/l2c_api.cc b/stack/l2cap/l2c_api.cc index 198ccf7e8..43aab5fd6 100644 --- a/stack/l2cap/l2c_api.cc +++ b/stack/l2cap/l2c_api.cc @@ -382,7 +382,11 @@ uint16_t L2CA_RegisterLECoc(uint16_t psm, const tL2CAP_APPL_INFO& p_cb_info, return bluetooth::shim::L2CA_RegisterLECoc(psm, p_cb_info, sec_level, cfg); } - BTM_SetSecurityLevel(false, "", 0, sec_level, psm, 0, 0); + if (p_cb_info.pL2CA_ConnectInd_Cb != nullptr && psm < LE_DYNAMIC_PSM_START) { + // If we register LE COC for outgoing connection only, don't register with + // BTM_Sec, because it's handled by L2CA_ConnectLECocReq. + BTM_SetSecurityLevel(false, "", 0, sec_level, psm, 0, 0); + } /* Verify that the required callback info has been filled in ** Note: Connection callbacks are required but not checked |