Merge ~kzapalowicz/bluez:fix/cherrypick-from-upstream-sony-crash into ~bluetooth/bluez:artful

[Konrad Zapałowicz]

Cherry-pick a fix for a crash from upstream.

[Daniel van Vugt (vanvugt)]

Looks good to me. That's the same as what I was going to do...

I was hoping we could figure out the exact bug ID of the crash in advance but I think this is going to be one of those we confirm afterwards (when errors.ubuntu.com shows a crash has stopped happening in version 5.46-0ubuntu2).

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 0a00f5f..f3692ac 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+bluez (5.46-0ubuntu2) UNRELEASED; urgency=medium
+
+  * debian/patches/0001-device-Fix-crash-when-connecting-ATT-with-BR-EDR-onl.patch
+    - fix crash when conecting ATT with BR/EDR only device. cherry-picked
+      from upstream.
+
+ -- Konrad Zapałowicz <[e-mail]>  Mon, 21 Aug 2017 15:34:15 +0200
+
 bluez (5.46-0ubuntu1) artful; urgency=medium
 
   [ Konrad Zapałowicz ]
diff --git a/debian/patches/0001-device-Fix-crash-when-connecting-ATT-with-BR-EDR-onl.patch b/debian/patches/0001-device-Fix-crash-when-connecting-ATT-with-BR-EDR-onl.patch
new file mode 100644
index 0000000..484d458
--- /dev/null
+++ b/debian/patches/0001-device-Fix-crash-when-connecting-ATT-with-BR-EDR-onl.patch
@@ -0,0 +1,155 @@
+From 0c1b55d7efaede3b5070cbdccdea248279f59a51 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <[e-mail]>
+Date: Wed, 9 Aug 2017 14:14:23 +0300
+Subject: device: Fix crash when connecting ATT with BR/EDR only device
+
+* device.c: fix the crash
+
+Origin: upstream, https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=5252296b725ef159992be5372f60721bd9adca48
+---
+ src/device.c | 38 +++++++++++++++++++++++---------------
+ 1 file changed, 23 insertions(+), 15 deletions(-)
+
+diff --git a/src/device.c b/src/device.c
+index fb9c0e7..4136425 100644
+--- a/src/device.c
++++ b/src/device.c
+@@ -133,10 +133,15 @@ struct authentication_req {
+ 	gboolean secure;
+ };
+ 
++enum {
++	BROWSE_SDP,
++	BROWSE_GATT
++};
++
+ struct browse_req {
+ 	DBusMessage *msg;
+ 	struct btd_device *device;
+-	uint8_t bdaddr_type;
++	uint8_t type;
+ 	GSList *match_uuids;
+ 	GSList *profiles_added;
+ 	sdp_list_t *records;
+@@ -2188,13 +2193,13 @@ static void store_gatt_db(struct btd_device *device)
+ }
+ 
+ 
+-static void browse_request_complete(struct browse_req *req, uint8_t bdaddr_type,
+-									int err)
++static void browse_request_complete(struct browse_req *req, uint8_t type,
++						uint8_t bdaddr_type, int err)
+ {
+ 	struct btd_device *dev = req->device;
+ 	DBusMessage *reply = NULL;
+ 
+-	if (req->bdaddr_type != bdaddr_type)
++	if (req->type != type)
+ 		return;
+ 
+ 	if (!req->msg)
+@@ -2248,8 +2253,8 @@ static void device_set_svc_refreshed(struct btd_device *device, bool value)
+ 					DEVICE_INTERFACE, "ServicesResolved");
+ }
+ 
+-static void device_svc_resolved(struct btd_device *dev, uint8_t bdaddr_type,
+-								int err)
++static void device_svc_resolved(struct btd_device *dev, uint8_t browse_type,
++						uint8_t bdaddr_type, int err)
+ {
+ 	struct bearer_state *state = get_state(dev, bdaddr_type);
+ 	struct browse_req *req = dev->browse;
+@@ -2296,7 +2301,7 @@ static void device_svc_resolved(struct btd_device *dev, uint8_t bdaddr_type,
+ 	if (!req)
+ 		return;
+ 
+-	browse_request_complete(req, bdaddr_type, err);
++	browse_request_complete(req, browse_type, bdaddr_type, err);
+ }
+ 
+ static struct bonding_req *bonding_request_new(DBusMessage *msg,
+@@ -4564,7 +4569,7 @@ static void search_cb(sdp_list_t *recs, int err, gpointer user_data)
+ 						DEVICE_INTERFACE, "UUIDs");
+ 
+ send_reply:
+-	device_svc_resolved(device, BDADDR_BREDR, err);
++	device_svc_resolved(device, BROWSE_SDP, BDADDR_BREDR, err);
+ }
+ 
+ static void browse_cb(sdp_list_t *recs, int err, gpointer user_data)
+@@ -4689,7 +4694,8 @@ static void gatt_client_ready_cb(bool success, uint8_t att_ecode,
+ 	DBG("status: %s, error: %u", success ? "success" : "failed", att_ecode);
+ 
+ 	if (!success) {
+-		device_svc_resolved(device, device->bdaddr_type, -EIO);
++		device_svc_resolved(device, BROWSE_GATT, device->bdaddr_type,
++									-EIO);
+ 		return;
+ 	}
+ 
+@@ -4697,7 +4703,7 @@ static void gatt_client_ready_cb(bool success, uint8_t att_ecode,
+ 
+ 	btd_gatt_client_ready(device->client_dbus);
+ 
+-	device_svc_resolved(device, device->bdaddr_type, 0);
++	device_svc_resolved(device, BROWSE_GATT, device->bdaddr_type, 0);
+ 
+ 	store_gatt_db(device);
+ }
+@@ -4903,6 +4909,7 @@ static void att_connect_cb(GIOChannel *io, GError *gerr, gpointer user_data)
+ 
+ 		if (device->browse)
+ 			browse_request_complete(device->browse,
++						BROWSE_GATT,
+ 						device->bdaddr_type,
+ 						-ECONNABORTED);
+ 
+@@ -5005,7 +5012,7 @@ int device_connect_le(struct btd_device *dev)
+ }
+ 
+ static struct browse_req *browse_request_new(struct btd_device *device,
+-							uint8_t bdaddr_type,
++							uint8_t type,
+ 							DBusMessage *msg)
+ {
+ 	struct browse_req *req;
+@@ -5015,7 +5022,7 @@ static struct browse_req *browse_request_new(struct btd_device *device,
+ 
+ 	req = g_new0(struct browse_req, 1);
+ 	req->device = device;
+-	req->bdaddr_type = bdaddr_type;
++	req->type = type;
+ 
+ 	device->browse = req;
+ 
+@@ -5041,7 +5048,7 @@ static int device_browse_gatt(struct btd_device *device, DBusMessage *msg)
+ 	struct btd_adapter *adapter = device->adapter;
+ 	struct browse_req *req;
+ 
+-	req = browse_request_new(device, device->bdaddr_type, msg);
++	req = browse_request_new(device, BROWSE_GATT, msg);
+ 	if (!req)
+ 		return -EBUSY;
+ 
+@@ -5057,7 +5064,8 @@ static int device_browse_gatt(struct btd_device *device, DBusMessage *msg)
+ 		 * Services have already been discovered, so signal this browse
+ 		 * request as resolved.
+ 		 */
+-		device_svc_resolved(device, device->bdaddr_type, 0);
++		device_svc_resolved(device, BROWSE_GATT, device->bdaddr_type,
++									0);
+ 		return 0;
+ 	}
+ 
+@@ -5113,7 +5121,7 @@ static int device_browse_sdp(struct btd_device *device, DBusMessage *msg)
+ 	uuid_t uuid;
+ 	int err;
+ 
+-	req = browse_request_new(device, BDADDR_BREDR, msg);
++	req = browse_request_new(device, BROWSE_SDP, msg);
+ 	if (!req)
+ 		return -EBUSY;
+ 
+-- 
+2.7.4
+
diff --git a/debian/patches/series b/debian/patches/series
index b5ac638..2fdf837 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -12,3 +12,4 @@ migrate_scripts_python3.patch
 
 # The following patches are submitted upstream and can be
 # dropped with one of the next releases
+0001-device-Fix-crash-when-connecting-ATT-with-BR-EDR-onl.patch