PAN: Fix to avoid buffer corruption while rebuilding the Bnep header
A case, where 3 remote device (PANU role) is connected with DUT (NAP role).
the one remote (PANU role) send BNEP_COMPRESSED_ETHERNET_DEST_ONLY
packet to DUT (NAP role), which is for another remote device (PANU role).
So DUT (NAP role) forwards this packet to another remote device (PANU role).
As same pbuf is used across the L2CAP/BNEP/PAN layer since reception from
L2CAP to writing on L2CAP CID of another PANU. Sometimes buffer (p_buf) gets
corrupted, when required buffer size is greater than actual buffer size,
while rebuilding the Bnep header.
Using bnep_write instead of bnep_writeBuf to solve the buffer corruption
issue, which allocates the new buffer & append data into it.
This patch also add TRC_BNEP & TRC_PAN into conf file.
Bug: 22028876
Change-Id: I125cab6d3da0f8126605bc7e9f764a27ee72fb1f
diff --git a/conf/bt_stack.conf b/conf/bt_stack.conf
index b1f848e..1278921 100644
--- a/conf/bt_stack.conf
+++ b/conf/bt_stack.conf
@@ -37,3 +37,5 @@
TRC_BTAPP=2
TRC_BTIF=2
TRC_GAP=2
+TRC_BNEP=2
+TRC_PAN=2
diff --git a/stack/pan/pan_main.c b/stack/pan/pan_main.c
index 56a8f12..2afcd6a 100644
--- a/stack/pan/pan_main.c
+++ b/stack/pan/pan_main.c
@@ -608,10 +608,13 @@
dst_pcb = pan_get_pcb_by_addr (dst);
if (dst_pcb)
{
- PAN_TRACE_EVENT ("pan_data_buf_ind_cb - destination PANU found and sending the data");
- result = BNEP_WriteBuf (dst_pcb->handle, dst, p_buf, protocol, src, ext);
+ PAN_TRACE_EVENT ("%s - destination PANU found on handle %d and sending data, len: %d",
+ __func__, dst_pcb->handle, len);
+
+ result = BNEP_Write (dst_pcb->handle, dst, p_data, len, protocol, src, ext);
if (result != BNEP_SUCCESS && result != BNEP_IGNORE_CMD)
PAN_TRACE_ERROR ("Failed to write data for PAN connection handle %d", dst_pcb->handle);
+ GKI_freebuf (p_buf);
return;
}
}