commit ee02e1ce774777e85b10be6d1ad5c6083fa08c18
author Jakub Pawlowski <jpawlowski@google.com> Mon Aug 28 04:12:49 2017 -0700
committer Andre Eisenbach <eisenbach@google.com> Mon Aug 28 18:09:03 2017 +0000
tree d39dbdc29fe25f1f1e7a4ddb22c0109dbcd85ebf
parent c0d8300b32b706e1d4caced06a4004d427a9bdd3

Fix GATT client leakage when scan is throttled (1/2)

Currently, scan throttling happens after client is registered, but
before the scan is started. This might lead to scan client being leaked.
This patch fixed that by moving check before client registration.

Bug: 64887233
Test: manual
Change-Id: I22ae624a0c51110cb69679f796926e3b2b36d0ac

core/java/android/bluetooth/le/BluetoothLeScanner.java

diff --git a/core/java/android/bluetooth/le/BluetoothLeScanner.java b/core/java/android/bluetooth/le/BluetoothLeScanner.java
index 19fab37..ad9e20b9 100644
--- a/core/java/android/bluetooth/le/BluetoothLeScanner.java
+++ b/core/java/android/bluetooth/le/BluetoothLeScanner.java
@@ -344,6 +344,7 @@
         private List<List<ResultStorageDescriptor>> mResultStorages;
 
         // mLeHandle 0: not registered
+        // -2: registration failed because app is scanning to frequently
         // -1: scan stopped or registration failed
         // > 0: registered and scan started
         private int mScannerId;
@@ -364,7 +365,7 @@
         public void startRegistration() {
             synchronized (this) {
                 // Scan stopped.
-                if (mScannerId == -1) return;
+                if (mScannerId == -1 || mScannerId == -2) return;
                 try {
                     mBluetoothGatt.registerScanner(this, mWorkSource);
                     wait(REGISTRATION_CALLBACK_TIMEOUT_MILLIS);
@@ -378,6 +379,10 @@
                     // Registration timed out or got exception, reset scannerId to -1 so no
                     // subsequent operations can proceed.
                     if (mScannerId == 0) mScannerId = -1;
+
+                    // If scanning too frequently, don't report anything to the app.
+                    if (mScannerId == -2) return;
+
                     postCallbackError(mScanCallback,
                             ScanCallback.SCAN_FAILED_APPLICATION_REGISTRATION_FAILED);
                 }
@@ -437,6 +442,9 @@
                         Log.e(TAG, "fail to start le scan: " + e);
                         mScannerId = -1;
                     }
+                } else if (status == ScanCallback.SCAN_FAILED_SCANNING_TOO_FREQUENTLY) {
+                    // applicaiton was scanning too frequently
+                    mScannerId = -2;
                 } else {
                     // registration failed
                     mScannerId = -1;

core/java/android/bluetooth/le/ScanCallback.java

diff --git a/core/java/android/bluetooth/le/ScanCallback.java b/core/java/android/bluetooth/le/ScanCallback.java
index fcbc2c7..53d9310 100644
--- a/core/java/android/bluetooth/le/ScanCallback.java
+++ b/core/java/android/bluetooth/le/ScanCallback.java
@@ -51,6 +51,12 @@
      */
     public static final int SCAN_FAILED_OUT_OF_HARDWARE_RESOURCES = 5;
 
+    /**
+     * Fails to start scan as application tries to scan too frequently.
+     * @hide
+     */
+    public static final int SCAN_FAILED_SCANNING_TOO_FREQUENTLY = 6;
+
     static final int NO_ERROR = 0;
 
     /**