From a88e680fc8b99311c9b8fc89dc91696a8a65ada0 Mon Sep 17 00:00:00 2001
From: chenjianhua <chenjianhua@espressif.com>
Date: Mon, 26 Jun 2023 20:17:49 +0800
Subject: [PATCH] bluedroid: fixed gatt tcb free when disconnecting

---
 components/bt/host/bluedroid/stack/include/stack/l2c_api.h | 1 +
 components/bt/host/bluedroid/stack/l2cap/l2c_api.c         | 6 ++++++
 components/bt/host/bluedroid/stack/l2cap/l2c_utils.c       | 6 ++++++
 3 files changed, 13 insertions(+)

diff --git a/components/bt/host/bluedroid/stack/include/stack/l2c_api.h b/components/bt/host/bluedroid/stack/include/stack/l2c_api.h
index 58d2a13797..c8aaff9c2b 100644
--- a/components/bt/host/bluedroid/stack/include/stack/l2c_api.h
+++ b/components/bt/host/bluedroid/stack/include/stack/l2c_api.h
@@ -1236,6 +1236,7 @@ extern BOOLEAN L2CA_CheckIsCongest(UINT16 fixed_cid, BD_ADDR addr);
 #define  L2CA_DECREASE_BTU_NUM 4
 #define  L2CA_BUFF_INI         5
 #define  L2CA_BUFF_DEINIT      6
+#define  L2CA_BUFF_FREE        7
 
 typedef struct {
     UINT16 conn_id;
diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_api.c b/components/bt/host/bluedroid/stack/l2cap/l2c_api.c
index 2db8fd539d..c0ef71c78b 100644
--- a/components/bt/host/bluedroid/stack/l2cap/l2c_api.c
+++ b/components/bt/host/bluedroid/stack/l2cap/l2c_api.c
@@ -2386,6 +2386,12 @@ void l2ble_update_att_acl_pkt_num(UINT8 type, tl2c_buff_param_t *param)
         buff_semaphore = NULL;
         break;
     }
+    case L2CA_BUFF_FREE:{
+        xSemaphoreTake(buff_semaphore, portMAX_DELAY);
+        // Do nothing
+        xSemaphoreGive(buff_semaphore);
+        break;
+    }
     default:
         break;
     }
diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c b/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c
index ae9506fbd0..70b0af0143 100644
--- a/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c
+++ b/components/bt/host/bluedroid/stack/l2cap/l2c_utils.c
@@ -1676,6 +1676,12 @@ void l2cu_release_ccb (tL2C_CCB *p_ccb)
     if (!p_ccb->in_use) {
         return;
     }
+#if BLE_INCLUDED == TRUE
+    if (p_lcb->transport == BT_TRANSPORT_LE) {
+        /* Take samephore to avoid race condition */
+        l2ble_update_att_acl_pkt_num(L2CA_BUFF_FREE, NULL);
+    }
+#endif
 #if (SDP_INCLUDED == TRUE)
     if (p_rcb && (p_rcb->psm != p_rcb->real_psm)) {
         btm_sec_clr_service_by_psm(p_rcb->psm);