Use RepeatingCallback instead of function pointer and void* data

Bug: 330675788
Test: mma -j68
Flag: exempt, trivial
Change-Id: Ibcd3f313f6d28c4f2b4544480b67f9842f4a65a5

17 files changed, 97 insertions, 115 deletions

diff --git a/system/bta/gatt/bta_gattc_cache.cc b/system/bta/gatt/bta_gattc_cache.cc
index 001a41a95d..93f5735acb 100644
--- a/system/bta/gatt/bta_gattc_cache.cc
+++ b/system/bta/gatt/bta_gattc_cache.cc
@@ -25,6 +25,7 @@
 
 #define LOG_TAG "bt_bta_gattc"
 
+#include <base/bind.h>
 #include <base/strings/string_number_conversions.h>
 #include <base/strings/stringprintf.h>
 #include <bluetooth/log.h>
@@ -342,9 +343,9 @@ descriptor_discovery_done:
 }
 
 /* Process the discovery result from sdp */
-void bta_gattc_sdp_callback(const RawAddress& /* bd_addr */,
-                            tSDP_STATUS sdp_status, const void* user_data) {
-  tBTA_GATTC_CB_DATA* cb_data = (tBTA_GATTC_CB_DATA*)user_data;
+void bta_gattc_sdp_callback(tBTA_GATTC_CB_DATA* cb_data,
+                            const RawAddress& /* bd_addr */,
+                            tSDP_STATUS sdp_status) {
   tBTA_GATTC_SERV* p_srvc_cb = bta_gattc_find_scb_by_cid(cb_data->sdp_conn_id);
 
   if (p_srvc_cb == nullptr) {
@@ -440,8 +441,8 @@ static tGATT_STATUS bta_gattc_sdp_service_disc(uint16_t conn_id,
   };
 
   if (!get_legacy_stack_sdp_api()->service.SDP_ServiceSearchAttributeRequest2(
-          p_server_cb->server_bda, cb_data->p_sdp_db, &bta_gattc_sdp_callback,
-          const_cast<const void*>(static_cast<void*>(cb_data)))) {
+          p_server_cb->server_bda, cb_data->p_sdp_db,
+          base::BindRepeating(bta_gattc_sdp_callback, cb_data))) {
     log::warn("Unable to start SDP service search attribute request peer:{}",
               p_server_cb->server_bda);
     osi_free(cb_data);
diff --git a/system/bta/hf_client/bta_hf_client_sdp.cc b/system/bta/hf_client/bta_hf_client_sdp.cc
index ae8b7916f0..70f53d1680 100644
--- a/system/bta/hf_client/bta_hf_client_sdp.cc
+++ b/system/bta/hf_client/bta_hf_client_sdp.cc
@@ -61,14 +61,14 @@ using namespace bluetooth;
  * Returns          void
  *
  ******************************************************************************/
-static void bta_hf_client_sdp_cback(const RawAddress& /* bd_addr */,
-                                    tSDP_STATUS status, const void* data) {
+static void bta_hf_client_sdp_cback(tBTA_HF_CLIENT_CB* client_cb,
+                                    const RawAddress& /* bd_addr */,
+                                    tSDP_STATUS status) {
   uint16_t event;
   tBTA_HF_CLIENT_DISC_RESULT* p_buf = (tBTA_HF_CLIENT_DISC_RESULT*)osi_malloc(
       sizeof(tBTA_HF_CLIENT_DISC_RESULT));
 
   log::verbose("bta_hf_client_sdp_cback status:0x{:x}", status);
-  tBTA_HF_CLIENT_CB* client_cb = (tBTA_HF_CLIENT_CB*)data;
 
   /* set event according to int/acp */
   if (client_cb->role == BTA_HF_CLIENT_ACP)
@@ -359,8 +359,8 @@ void bta_hf_client_do_disc(tBTA_HF_CLIENT_CB* client_cb) {
     /*Service discovery not initiated */
     db_inited =
         get_legacy_stack_sdp_api()->service.SDP_ServiceSearchAttributeRequest2(
-            client_cb->peer_addr, client_cb->p_disc_db, bta_hf_client_sdp_cback,
-            (void*)client_cb);
+            client_cb->peer_addr, client_cb->p_disc_db,
+            base::BindRepeating(&bta_hf_client_sdp_cback, client_cb));
   }
 
   if (!db_inited) {
diff --git a/system/bta/jv/bta_jv_act.cc b/system/bta/jv/bta_jv_act.cc
index 0fc17d6d22..9ed3ee54e0 100644
--- a/system/bta/jv/bta_jv_act.cc
+++ b/system/bta/jv/bta_jv_act.cc
@@ -792,9 +792,9 @@ void bta_jv_free_scn(tBTA_JV_CONN_TYPE type /* One of BTA_JV_CONN_TYPE_ */,
  * Returns      void
  *
  ******************************************************************************/
-static void bta_jv_start_discovery_cback(const RawAddress& bd_addr,
-                                         tSDP_RESULT result,
-                                         const void* user_data) {
+static void bta_jv_start_discovery_cback(uint32_t rfcomm_slot_id,
+                                         const RawAddress& bd_addr,
+                                         tSDP_RESULT result) {
   if (!bta_jv_cb.sdp_cb.sdp_active) {
     log::warn(
         "Received unexpected service discovery callback bd_addr:{} result:{}",
@@ -809,7 +809,6 @@ static void bta_jv_start_discovery_cback(const RawAddress& bd_addr,
   }
 
   if (bta_jv_cb.p_dm_cback) {
-    const uint32_t rfcomm_slot_id = *static_cast<const uint32_t*>(user_data);
     tBTA_JV bta_jv = {
         .disc_comp =
             {
@@ -855,8 +854,6 @@ static void bta_jv_start_discovery_cback(const RawAddress& bd_addr,
         "result:{}",
         bd_addr, sdp_result_text(result));
   }
-  // User data memory is allocated in `bta_jv_start_discovery`
-  osi_free(const_cast<void*>(user_data));
   bta_jv_cb.sdp_cb = {};
 }
 
@@ -905,16 +902,10 @@ void bta_jv_start_discovery(const RawAddress& bd_addr, uint16_t num_uuid,
       .uuid = uuid_list[0],
   };
 
-  // NOTE: This gets freed on the callback or when discovery failed to start
-  uint32_t* rfcomm_slot_id_copy = (uint32_t*)osi_malloc(sizeof(uint32_t));
-  *rfcomm_slot_id_copy = rfcomm_slot_id;
-
-  // user_data memory is freed in `bta_jv_start_discovery_cback` callback
   if (!get_legacy_stack_sdp_api()->service.SDP_ServiceSearchAttributeRequest2(
-          bd_addr, p_bta_jv_cfg->p_sdp_db, bta_jv_start_discovery_cback,
-          (const void*)rfcomm_slot_id_copy)) {
+          bd_addr, p_bta_jv_cfg->p_sdp_db,
+          base::BindRepeating(&bta_jv_start_discovery_cback, rfcomm_slot_id))) {
     bta_jv_cb.sdp_cb = {};
-    osi_free(rfcomm_slot_id_copy);
     log::warn(
         "Unable to original service discovery bd_addr:{} num:uuid:{} "
         "rfcomm_slot_id:{}",
@@ -2079,9 +2070,10 @@ static void bta_jv_reset_sniff_timer(tBTA_JV_PM_CB* p_cb) {
 
 namespace bluetooth::legacy::testing {
 
-void bta_jv_start_discovery_cback(const RawAddress& bd_addr, tSDP_RESULT result,
-                                  const void* user_data) {
-  ::bta_jv_start_discovery_cback(bd_addr, result, user_data);
+void bta_jv_start_discovery_cback(uint32_t rfcomm_slot_id,
+                                  const RawAddress& bd_addr,
+                                  tSDP_RESULT result) {
+  ::bta_jv_start_discovery_cback(rfcomm_slot_id, bd_addr, result);
 }
 
 }  // namespace bluetooth::legacy::testing
diff --git a/system/bta/sdp/bta_sdp_act.cc b/system/bta/sdp/bta_sdp_act.cc
index c94683388a..6348a3a4d5 100644
--- a/system/bta/sdp/bta_sdp_act.cc
+++ b/system/bta/sdp/bta_sdp_act.cc
@@ -20,6 +20,7 @@
  *  This file contains action functions for SDP search.
  ******************************************************************************/
 
+#include <base/bind.h>
 #include <bluetooth/log.h>
 #include <frameworks/proto_logging/stats/enums/bluetooth/enums.pb.h>
 #include <hardware/bt_sdp.h>
@@ -550,8 +551,8 @@ static void bta_create_raw_sdp_record(bluetooth_sdp_record* record,
 }
 
 /** Callback from btm after search is completed */
-static void bta_sdp_search_cback(const RawAddress& /* bd_addr */,
-                                 tSDP_RESULT result, const void* user_data) {
+static void bta_sdp_search_cback(Uuid uuid, const RawAddress& /* bd_addr */,
+                                 tSDP_RESULT result) {
   tBTA_SDP_STATUS status = BTA_SDP_FAILURE;
   int count = 0;
   log::verbose("res: 0x{:x}", result);
@@ -560,8 +561,6 @@ static void bta_sdp_search_cback(const RawAddress& /* bd_addr */,
 
   if (bta_sdp_cb.p_dm_cback == NULL) return;
 
-  Uuid& uuid = *(reinterpret_cast<Uuid*>(const_cast<void*>(user_data)));
-
   tBTA_SDP_SEARCH_COMP evt_data;
   memset(&evt_data, 0, sizeof(evt_data));
   evt_data.remote_addr = bta_sdp_cb.remote_addr;
@@ -636,8 +635,6 @@ static void bta_sdp_search_cback(const RawAddress& /* bd_addr */,
   bta_sdp_cb.p_dm_cback(BTA_SDP_SEARCH_COMP_EVT, &bta_sdp, (void*)&uuid);
   bluetooth::shim::CountCounterMetrics(
       android::bluetooth::CodePathCounterKeyEnum::SDP_SUCCESS, 1);
-  osi_free(const_cast<void*>(
-      user_data));  // We no longer need the user data to track the search
 }
 
 /*******************************************************************************
@@ -699,11 +696,9 @@ void bta_sdp_search(const RawAddress bd_addr, const bluetooth::Uuid uuid) {
     log::warn("Unable to initialize SDP service search db peer:{}", bd_addr);
   }
 
-  Uuid* bta_sdp_search_uuid = (Uuid*)osi_malloc(sizeof(Uuid));
-  *bta_sdp_search_uuid = uuid;
   if (!get_legacy_stack_sdp_api()->service.SDP_ServiceSearchAttributeRequest2(
-          bd_addr, p_bta_sdp_cfg->p_sdp_db, bta_sdp_search_cback,
-          (void*)bta_sdp_search_uuid)) {
+          bd_addr, p_bta_sdp_cfg->p_sdp_db,
+          base::BindRepeating(bta_sdp_search_cback, uuid))) {
     log::warn("Unable to start SDP service search attribute request peer:{}",
               bd_addr);
     bta_sdp_cb.sdp_active = false;
@@ -763,9 +758,9 @@ void bta_create_dip_sdp_record(bluetooth_sdp_record* record,
   ::bta_create_dip_sdp_record(record, p_rec);
 }
 
-void bta_sdp_search_cback(const RawAddress& bd_addr, tSDP_RESULT result,
-                          const void* user_data) {
-  ::bta_sdp_search_cback(bd_addr, result, user_data);
+void bta_sdp_search_cback(Uuid uuid, const RawAddress& bd_addr,
+                          tSDP_RESULT result) {
+  ::bta_sdp_search_cback(uuid, bd_addr, result);
 }
 
 }  // namespace testing
diff --git a/system/bta/test/bta_dip_test.cc b/system/bta/test/bta_dip_test.cc
index b9b4cfa65f..1a454fb810 100644
--- a/system/bta/test/bta_dip_test.cc
+++ b/system/bta/test/bta_dip_test.cc
@@ -107,8 +107,8 @@ namespace testing {
 
 void bta_create_dip_sdp_record(bluetooth_sdp_record* record,
                                tSDP_DISC_REC* p_rec);
-void bta_sdp_search_cback(const RawAddress& bd_addr, tSDP_RESULT result,
-                          const void* user_data);
+void bta_sdp_search_cback(Uuid uuid, const RawAddress& bd_addr,
+                          tSDP_RESULT result);
 
 }  // namespace testing
 }  // namespace bluetooth
@@ -208,9 +208,6 @@ TEST_F(BtaDipTest, test_invalid_size_checks) {
 
 
 TEST_F(BtaDipTest, test_bta_sdp_search_cback) {
-  Uuid* userdata = (Uuid*)malloc(sizeof(Uuid));
-
-  memcpy(userdata, &UUID_DIP, sizeof(UUID_DIP));
-  bluetooth::testing::bta_sdp_search_cback(RawAddress::kEmpty, SDP_SUCCESS,
-                                           userdata);
+  bluetooth::testing::bta_sdp_search_cback(UUID_DIP, RawAddress::kEmpty,
+                                           SDP_SUCCESS);
 }
diff --git a/system/bta/test/bta_jv_test.cc b/system/bta/test/bta_jv_test.cc
index a1eeb1c46f..aa06835235 100644
--- a/system/bta/test/bta_jv_test.cc
+++ b/system/bta/test/bta_jv_test.cc
@@ -42,8 +42,9 @@ constexpr uint8_t kScn = 123;
 
 namespace bluetooth::legacy::testing {
 
-void bta_jv_start_discovery_cback(const RawAddress& bd_addr, tSDP_RESULT result,
-                                  const void* user_data);
+void bta_jv_start_discovery_cback(uint32_t rfcomm_slot_id,
+                                  const RawAddress& bd_addr,
+                                  tSDP_RESULT result);
 
 }  // namespace bluetooth::legacy::testing
 
@@ -61,8 +62,8 @@ class FakeSdp {
             .SDP_ServiceSearchAttributeRequest2 =
                 [](const RawAddress& /* p_bd_addr */,
                    tSDP_DISCOVERY_DB* /* p_db */,
-                   tSDP_DISC_CMPL_CB2* /* p_cb2 */, const void* user_data) {
-                  if (user_data) osi_free((void*)user_data);
+                   base::RepeatingCallback<
+                       tSDP_DISC_CMPL_CB> /* complete_callback */) {
                   return true;
                 },
         },
@@ -144,19 +145,13 @@ class BtaJvTest : public BtaJvMockAndFakeTest {
 };
 
 TEST_F(BtaJvTest, bta_jv_start_discovery_cback__no_callback) {
-  uint32_t* user_data = (uint32_t*)osi_malloc(sizeof(uint32_t));
-  *user_data = 0x12345678;
-
   bta_jv_enable(nullptr);
   bluetooth::legacy::testing::bta_jv_start_discovery_cback(
-      kRawAddress, SDP_SUCCESS, (const void*)user_data);
+      0x12345678, kRawAddress, SDP_SUCCESS);
 }
 
 TEST_F(BtaJvTest,
        bta_jv_start_discovery_cback__with_callback_success_no_record) {
-  uint32_t* user_data = (uint32_t*)osi_malloc(sizeof(uint32_t));
-  *user_data = kSlotId;
-
   // Ensure that there was an sdp active
   bta_jv_cb.sdp_cb = {
       .sdp_active = true,
@@ -179,15 +174,12 @@ TEST_F(BtaJvTest,
         FAIL();
     }
   });
-  bluetooth::legacy::testing::bta_jv_start_discovery_cback(
-      kRawAddress, SDP_SUCCESS, (const void*)user_data);
+  bluetooth::legacy::testing::bta_jv_start_discovery_cback(kSlotId, kRawAddress,
+                                                           SDP_SUCCESS);
 }
 
 TEST_F(BtaJvTest,
        bta_jv_start_discovery_cback__with_callback_success_with_record) {
-  uint32_t* user_data = (uint32_t*)osi_malloc(sizeof(uint32_t));
-  *user_data = kSlotId;
-
   static tSDP_DISC_REC sdp_disc_rec = {
       .p_first_attr = nullptr,
       .p_next_rec = nullptr,
@@ -231,14 +223,12 @@ TEST_F(BtaJvTest,
         FAIL();
     }
   });
-  bluetooth::legacy::testing::bta_jv_start_discovery_cback(
-      kRawAddress, SDP_SUCCESS, (const void*)user_data);
+  bluetooth::legacy::testing::bta_jv_start_discovery_cback(kSlotId, kRawAddress,
+                                                           SDP_SUCCESS);
 }
 
 TEST_F(BtaJvTest, bta_jv_start_discovery_cback__with_callback_failure) {
   tSDP_RESULT result = SDP_CONN_FAILED;
-  uint32_t* user_data = (uint32_t*)osi_malloc(sizeof(uint32_t));
-  *user_data = kSlotId;
 
   // Ensure that there was an sdp active
   bta_jv_cb.sdp_cb = {
@@ -262,8 +252,8 @@ TEST_F(BtaJvTest, bta_jv_start_discovery_cback__with_callback_failure) {
         FAIL();
     }
   });
-  bluetooth::legacy::testing::bta_jv_start_discovery_cback(
-      kRawAddress, result, (const void*)user_data);
+  bluetooth::legacy::testing::bta_jv_start_discovery_cback(kSlotId, kRawAddress,
+                                                           result);
 }
 
 TEST_F(BtaJvTest, bta_jv_start_discovery__idle) {
@@ -288,8 +278,9 @@ TEST_F(BtaJvTest, bta_jv_start_discovery__idle_failed_to_start) {
   test::mock::stack_sdp_legacy::api_.service
       .SDP_ServiceSearchAttributeRequest2 =
       [](const RawAddress& /* p_bd_addr */, tSDP_DISCOVERY_DB* /* p_db */,
-         tSDP_DISC_CMPL_CB2* /* p_cb2 */,
-         const void* /* user_data */) { return false; };
+         base::RepeatingCallback<tSDP_DISC_CMPL_CB> /* complete_callback */) {
+        return false;
+      };
 
   bta_jv_enable([](tBTA_JV_EVT event, tBTA_JV* p_data, uint32_t id) {
     switch (event) {
diff --git a/system/stack/include/sdp_api.h b/system/stack/include/sdp_api.h
index 2a862ee781..fb86a584df 100644
--- a/system/stack/include/sdp_api.h
+++ b/system/stack/include/sdp_api.h
@@ -18,6 +18,7 @@
 
 #pragma once
 
+#include <base/callback_forward.h>
 #include <base/strings/stringprintf.h>
 
 #include <cstdint>
@@ -129,15 +130,15 @@ struct tSdpApi {
       parameters:      bd_addr     - (input) device address for service search
                        p_db        - (input) address of an area of memory where
                                              the discovery database is managed.
-                       p_cb2       - (input) callback executed when complete
-                       p_data      - (input) user data
+                       complete_callback - (input) callback executed when
+     complete
 
       Returns          true if discovery started, false if failed.
 
      ******************************************************************************/
     [[nodiscard]] bool (*SDP_ServiceSearchAttributeRequest2)(
-        const RawAddress&, tSDP_DISCOVERY_DB*, tSDP_DISC_CMPL_CB2*,
-        const void*);
+        const RawAddress&, tSDP_DISCOVERY_DB*,
+        base::RepeatingCallback<tSDP_DISC_CMPL_CB> complete_callback);
   } service;
 
   struct {
diff --git a/system/stack/include/sdp_callback.h b/system/stack/include/sdp_callback.h
index 5ebd2789af..87dbff8733 100644
--- a/system/stack/include/sdp_callback.h
+++ b/system/stack/include/sdp_callback.h
@@ -23,5 +23,3 @@
 
 /* Define a callback function for when discovery is complete. */
 typedef void(tSDP_DISC_CMPL_CB)(const RawAddress& bd_addr, tSDP_RESULT result);
-typedef void(tSDP_DISC_CMPL_CB2)(const RawAddress& bd_addr, tSDP_RESULT result,
-                                 const void* user_data);
diff --git a/system/stack/sdp/internal/sdp_api.h b/system/stack/sdp/internal/sdp_api.h
index ba2276fb6e..2f89b31d41 100644
--- a/system/stack/sdp/internal/sdp_api.h
+++ b/system/stack/sdp/internal/sdp_api.h
@@ -18,6 +18,8 @@
 
 #pragma once
 
+#include <base/callback_forward.h>
+
 #include <cstdint>
 
 #include "stack/include/sdp_callback.h"
@@ -94,10 +96,9 @@ bool SDP_ServiceSearchAttributeRequest(const RawAddress& p_bd_addr,
  * Returns          true if discovery started, false if failed.
  *
  ******************************************************************************/
-bool SDP_ServiceSearchAttributeRequest2(const RawAddress& p_bd_addr,
-                                        tSDP_DISCOVERY_DB* p_db,
-                                        tSDP_DISC_CMPL_CB2* p_cb,
-                                        const void* user_data);
+bool SDP_ServiceSearchAttributeRequest2(
+    const RawAddress& p_bd_addr, tSDP_DISCOVERY_DB* p_db,
+    base::RepeatingCallback<tSDP_DISC_CMPL_CB> complete_callback);
 
 /* API of utilities to find data in the local discovery database */
 
diff --git a/system/stack/sdp/sdp_api.cc b/system/stack/sdp/sdp_api.cc
index 40595ef77a..b19652e0bc 100644
--- a/system/stack/sdp/sdp_api.cc
+++ b/system/stack/sdp/sdp_api.cc
@@ -194,10 +194,9 @@ bool SDP_ServiceSearchAttributeRequest(const RawAddress& bd_addr,
  * Returns          true if discovery started, false if failed.
  *
  ******************************************************************************/
-bool SDP_ServiceSearchAttributeRequest2(const RawAddress& bd_addr,
-                                        tSDP_DISCOVERY_DB* p_db,
-                                        tSDP_DISC_CMPL_CB2* p_cb2,
-                                        const void* user_data) {
+bool SDP_ServiceSearchAttributeRequest2(
+    const RawAddress& bd_addr, tSDP_DISCOVERY_DB* p_db,
+    base::RepeatingCallback<tSDP_DISC_CMPL_CB> complete_callback) {
   tCONN_CB* p_ccb;
 
   /* Specific BD address */
@@ -207,10 +206,9 @@ bool SDP_ServiceSearchAttributeRequest2(const RawAddress& bd_addr,
 
   p_ccb->disc_state = SDP_DISC_WAIT_CONN;
   p_ccb->p_db = p_db;
-  p_ccb->p_cb2 = p_cb2;
+  p_ccb->complete_callback = std::move(complete_callback);
 
   p_ccb->is_attr_search = true;
-  p_ccb->user_data = user_data;
 
   return (true);
 }
diff --git a/system/stack/sdp/sdp_utils.cc b/system/stack/sdp/sdp_utils.cc
index 71bc4f88a3..654fc9d8be 100644
--- a/system/stack/sdp/sdp_utils.cc
+++ b/system/stack/sdp/sdp_utils.cc
@@ -412,8 +412,8 @@ tCONN_CB* sdpu_allocate_ccb(void) {
 void sdpu_callback(tCONN_CB& ccb, tSDP_REASON reason) {
   if (ccb.p_cb) {
     (ccb.p_cb)(ccb.device_address, reason);
-  } else if (ccb.p_cb2) {
-    (ccb.p_cb2)(ccb.device_address, reason, ccb.user_data);
+  } else if (ccb.complete_callback) {
+    ccb.complete_callback.Run(ccb.device_address, reason);
   }
 }
 
diff --git a/system/stack/sdp/sdpint.h b/system/stack/sdp/sdpint.h
index d9ae88b761..057b8dabf6 100644
--- a/system/stack/sdp/sdpint.h
+++ b/system/stack/sdp/sdpint.h
@@ -25,6 +25,7 @@
 #ifndef SDP_INT_H
 #define SDP_INT_H
 
+#include <base/callback.h>
 #include <base/strings/stringprintf.h>
 
 #include <cstdint>
@@ -191,9 +192,11 @@ struct tCONN_CB {
 
   tSDP_DISCOVERY_DB* p_db; /* Database to save info into   */
   tSDP_DISC_CMPL_CB* p_cb; /* Callback for discovery done  */
-  tSDP_DISC_CMPL_CB2*
-      p_cb2; /* Callback for discovery done piggy back with the user data */
-  const void* user_data; /* piggy back user data */
+  /* OnceCallback would be more appropriate, but it doesn't have copy
+   * constructor, so won't compile with current memory management for control
+   * blocks */
+  base::RepeatingCallback<tSDP_DISC_CMPL_CB>
+      complete_callback; /* Callback for discovery */
   uint32_t
       handles[SDP_MAX_DISC_SERVER_RECS]; /* Discovered server record handles */
   uint16_t num_handles;                  /* Number of server handles     */
diff --git a/system/stack/test/fuzzers/sdp/sdpFuzzFunctions.h b/system/stack/test/fuzzers/sdp/sdpFuzzFunctions.h
index a0924543a4..2862ab9d1c 100644
--- a/system/stack/test/fuzzers/sdp/sdpFuzzFunctions.h
+++ b/system/stack/test/fuzzers/sdp/sdpFuzzFunctions.h
@@ -17,6 +17,7 @@
 #ifndef FUZZER_SDP_FUNCTIONS_H_
 #define FUZZER_SDP_FUNCTIONS_H_
 
+#include <base/bind.h>
 #include <fuzzer/FuzzedDataProvider.h>
 
 #include <vector>
@@ -113,7 +114,8 @@ static const std::vector<std::function<void(FuzzedDataProvider*)>>
             [[maybe_unused]] bool rc =
                 get_legacy_stack_sdp_api()
                     ->service.SDP_ServiceSearchAttributeRequest2(
-                        bd_addr, db, &sdp_disc_cmpl_cb2, user_data.data());
+                        bd_addr, db,
+                        base::BindRepeating(&sdp_disc_cmpl_cb2, user_data));
           }
         },
 
diff --git a/system/stack/test/fuzzers/sdp/sdpFuzzHelpers.h b/system/stack/test/fuzzers/sdp/sdpFuzzHelpers.h
index 0038d77a87..5ad3d0e3b1 100644
--- a/system/stack/test/fuzzers/sdp/sdpFuzzHelpers.h
+++ b/system/stack/test/fuzzers/sdp/sdpFuzzHelpers.h
@@ -276,7 +276,7 @@ SDP_Sequence_Helper generateArbitrarySdpElemSequence(FuzzedDataProvider* fdp) {
 
 // Define our callback functions we'll be using within our functions
 void sdp_disc_cmpl_cb(const RawAddress& bd_addr, tSDP_STATUS result) {}
-void sdp_disc_cmpl_cb2(const RawAddress& bd_addr, tSDP_STATUS result,
-                       const void* user_data) {}
+void sdp_disc_cmpl_cb2(std::vector<uint8_t> data, const RawAddress& bd_addr,
+                       tSDP_STATUS result) {}
 
 #endif  // FUZZER_SDP_HELPERS_H_
diff --git a/system/test/headless/sdp/sdp.cc b/system/test/headless/sdp/sdp.cc
index ece2368629..82af90574a 100644
--- a/system/test/headless/sdp/sdp.cc
+++ b/system/test/headless/sdp/sdp.cc
@@ -32,11 +32,9 @@
 using namespace bluetooth::legacy::stack::sdp;
 using namespace bluetooth::test::headless;
 
-static void bta_jv_start_discovery_callback(const RawAddress& /* bd_addr */,
-                                            tSDP_STATUS result,
-                                            const void* user_data) {
-  auto promise =
-      static_cast<std::promise<uint16_t>*>(const_cast<void*>(user_data));
+static void bta_jv_start_discovery_callback(std::promise<tSDP_STATUS>* promise,
+                                            const RawAddress& /* bd_addr */,
+                                            tSDP_STATUS result) {
   promise->set_value(result);
 }
 
@@ -65,7 +63,7 @@ int sdp_query_uuid([[maybe_unused]] unsigned int num_loops,
 
   if (!get_legacy_stack_sdp_api()->service.SDP_ServiceSearchAttributeRequest2(
           raw_address, sdp_discovery_db.RawPointer(),
-          bta_jv_start_discovery_callback, (void*)&promise)) {
+          base::BindRepeating(bta_jv_start_discovery_callback, &promise))) {
     fprintf(stdout, "%s Failed to start search attribute request\n", __func__);
     return -2;
   }
diff --git a/system/test/mock/mock_stack_sdp_api.cc b/system/test/mock/mock_stack_sdp_api.cc
index 28b56bf6f1..e73f9d1425 100644
--- a/system/test/mock/mock_stack_sdp_api.cc
+++ b/system/test/mock/mock_stack_sdp_api.cc
@@ -102,13 +102,12 @@ bool SDP_ServiceSearchAttributeRequest(const RawAddress& p_bd_addr,
   return test::mock::stack_sdp_api::SDP_ServiceSearchAttributeRequest(
       p_bd_addr, p_db, p_cb);
 }
-bool SDP_ServiceSearchAttributeRequest2(const RawAddress& p_bd_addr,
-                                        tSDP_DISCOVERY_DB* p_db,
-                                        tSDP_DISC_CMPL_CB2* p_cb2,
-                                        const void* user_data) {
+bool SDP_ServiceSearchAttributeRequest2(
+    const RawAddress& p_bd_addr, tSDP_DISCOVERY_DB* p_db,
+    base::RepeatingCallback<tSDP_DISC_CMPL_CB> complete_callback) {
   inc_func_call_count(__func__);
   return test::mock::stack_sdp_api::SDP_ServiceSearchAttributeRequest2(
-      p_bd_addr, p_db, p_cb2, user_data);
+      p_bd_addr, p_db, complete_callback);
 }
 bool SDP_ServiceSearchRequest(const RawAddress& p_bd_addr,
                               tSDP_DISCOVERY_DB* p_db,
diff --git a/system/test/mock/mock_stack_sdp_api.h b/system/test/mock/mock_stack_sdp_api.h
index 758f48d987..0936e9f9c6 100644
--- a/system/test/mock/mock_stack_sdp_api.h
+++ b/system/test/mock/mock_stack_sdp_api.h
@@ -21,6 +21,8 @@
  *  mockcify.pl ver 0.2.1
  */
 
+#include <base/callback.h>
+
 #include <cstdint>
 #include <functional>
 
@@ -135,16 +137,20 @@ extern struct SDP_ServiceSearchAttributeRequest
     SDP_ServiceSearchAttributeRequest;
 // Name: SDP_ServiceSearchAttributeRequest2
 // Params: const RawAddress& p_bd_addr, tSDP_DISCOVERY_DB* p_db,
-// tSDP_DISC_CMPL_CB2* p_cb2, void* user_data Returns: bool
+// base::RepeatingCallback<tSDP_DISC_CMPL_CB> complete_callback
+// Returns: bool
 struct SDP_ServiceSearchAttributeRequest2 {
-  std::function<bool(const RawAddress& p_bd_addr, tSDP_DISCOVERY_DB* p_db,
-                     tSDP_DISC_CMPL_CB2* p_cb2, const void* user_data)>
-      body{[](const RawAddress& /* p_bd_addr */, tSDP_DISCOVERY_DB* /* p_db */,
-              tSDP_DISC_CMPL_CB2* /* p_cb2 */,
-              const void* /* user_data */) { return false; }};
-  bool operator()(const RawAddress& p_bd_addr, tSDP_DISCOVERY_DB* p_db,
-                  tSDP_DISC_CMPL_CB2* p_cb2, const void* user_data) {
-    return body(p_bd_addr, p_db, p_cb2, user_data);
+  std::function<bool(
+      const RawAddress& p_bd_addr, tSDP_DISCOVERY_DB* p_db,
+      base::RepeatingCallback<tSDP_DISC_CMPL_CB> complete_callback)>
+      body{
+          [](const RawAddress& /* p_bd_addr */, tSDP_DISCOVERY_DB* /* p_db */,
+             base::RepeatingCallback<
+                 tSDP_DISC_CMPL_CB> /* complete_callback */) { return false; }};
+  bool operator()(
+      const RawAddress& p_bd_addr, tSDP_DISCOVERY_DB* p_db,
+      base::RepeatingCallback<tSDP_DISC_CMPL_CB> complete_callback) {
+    return body(p_bd_addr, p_db, complete_callback);
   };
 };
 extern struct SDP_ServiceSearchAttributeRequest2