Merge AU_LINUX_ANDROID_LA.BF.1.1.1_RB1.05.01.00.042.029 on remote branch

Change-Id: I136cd834cdeeec918317ff265f3eb8dd7aff0569
diff --git a/bta/jv/bta_jv_act.c b/bta/jv/bta_jv_act.c
index c3bf844..c9cce22 100644
--- a/bta/jv/bta_jv_act.c
+++ b/bta/jv/bta_jv_act.c
@@ -1912,9 +1912,16 @@
             case L2C_SOCK_DATA_CBACK_TYPE_INCOMING:
                 APPL_TRACE_DEBUG("bta_jv_l2c_data_co_cback, p_l2c_cb->p_pm_cb: %p",
                         p_l2c_cb->p_pm_cb);
-                bta_jv_pm_conn_busy(p_l2c_cb->p_pm_cb);
-                ret = bta_co_l2c_data_incoming(p_l2c_cb->user_data, (BT_HDR*)p_buf);
-                bta_jv_pm_conn_idle(p_l2c_cb->p_pm_cb);
+                if(p_buf && (((BT_HDR*)p_buf)->event == 0x00))
+                {
+                    bta_jv_pm_conn_busy(p_l2c_cb->p_pm_cb);
+                    GKI_freebuf (p_buf);
+                }
+                else if(p_buf && (((BT_HDR*)p_buf)->event == 0xffff))
+                {
+                    ret = bta_co_l2c_data_incoming(p_l2c_cb->user_data, (BT_HDR*)p_buf);
+                    bta_jv_pm_conn_idle(p_l2c_cb->p_pm_cb);
+                }
                 return ret;
             case L2C_SOCK_DATA_CBACK_TYPE_OUTGOING_SIZE:
                 return bta_co_l2c_data_outgoing_size(p_l2c_cb->user_data, (int*)p_buf);
diff --git a/gki/common/gki_time.c b/gki/common/gki_time.c
index 10d0aeb..428b9a4 100644
--- a/gki/common/gki_time.c
+++ b/gki/common/gki_time.c
@@ -646,7 +646,11 @@
 
     /* Only process valid tick values. */
     if (p_tle->ticks < 0)
+    {
+        BT_ERROR_TRACE(TRACE_LAYER_GKI, "ERROR :GKI_add_to_timer_list:no valid ticks");
+        pthread_mutex_unlock(&gki_cb.os.gki_timerupdate_mutex);
         return;
+    }
 
     p_tle->p_prev = NULL;
     p_tle->p_next = NULL;
diff --git a/stack/gatt/gatt_attr.c b/stack/gatt/gatt_attr.c
index 8773036..8ed0210 100644
--- a/stack/gatt/gatt_attr.c
+++ b/stack/gatt/gatt_attr.c
@@ -98,7 +98,7 @@
             return p_clcb;
     }
 
-    return p_clcb;
+    return NULL;
 }
 
 /*******************************************************************************
@@ -122,7 +122,7 @@
             return p_clcb;
     }
 
-    return p_clcb;
+    return NULL;
 }
 
 /*******************************************************************************
@@ -151,7 +151,10 @@
             break;
         }
     }
-    return p_clcb;
+    if(i_clcb < GATT_MAX_APPS)
+        return p_clcb;
+    else /*no available clcb*/
+        return NULL;
 }
 
 /*******************************************************************************
diff --git a/stack/l2cap/l2c_fcr.c b/stack/l2cap/l2c_fcr.c
index aa7ec12..a4296ce 100644
--- a/stack/l2cap/l2c_fcr.c
+++ b/stack/l2cap/l2c_fcr.c
@@ -1475,7 +1475,20 @@
 
                 p_fcrb->p_rx_sdu->len += p_buf->len;
 
+#if (defined(OBX_OVER_L2CAP_INCLUDED) && OBX_OVER_L2CAP_INCLUDED == TRUE)
+                if(p_ccb->ertm_info.user_rx_pool_id == GKI_POOL_ID_10)
+                {
+                    p_buf->event = 0x00;
+                    l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_buf);
+                }
+                else
+                {
+                    GKI_freebuf (p_buf);
+                }
+#else
                 GKI_freebuf (p_buf);
+#endif
+
                 p_buf = NULL;
 
                 if (sar_type == L2CAP_FCR_END_SDU)
@@ -1502,6 +1515,12 @@
         }
         else
 #endif
+#if (defined(OBX_OVER_L2CAP_INCLUDED) && OBX_OVER_L2CAP_INCLUDED == TRUE)
+            if(p_ccb->ertm_info.user_rx_pool_id == GKI_POOL_ID_10)
+            {
+                p_buf->event = 0xffff;
+            }
+#endif
             l2c_csm_execute (p_ccb, L2CEVT_L2CAP_DATA, p_buf);
     }