gatt: Fix gatt_sr_is_cback_cnt_zero

This check is meant to be done per CID.

Bug: 385287242
Test: mmm packages/modules/Bluetooth
Test: manual test
1. create multiple EATT channels
2. Trigger Read Request on all the ATT bearers
3. Check all the responses arrives

Flag: Exempt, day-to-day fix
Change-Id: Idc8ca8a0023616a0add83a7c2df7ff1ce2fcc7ce

3 files changed, 24 insertions, 11 deletions

diff --git a/system/stack/gatt/gatt_int.h b/system/stack/gatt/gatt_int.h
index db0d0da9ca..57567986ed 100644
--- a/system/stack/gatt/gatt_int.h
+++ b/system/stack/gatt/gatt_int.h
@@ -614,7 +614,7 @@ bool gatt_is_pending_mtu_exchange(tGATT_TCB* p_tcb);
 void gatt_set_conn_id_waiting_for_mtu_exchange(tGATT_TCB* p_tcb, tCONN_ID conn_id);
 
 void gatt_sr_copy_prep_cnt_to_cback_cnt(tGATT_TCB& p_tcb);
-bool gatt_sr_is_cback_cnt_zero(tGATT_TCB& p_tcb);
+bool gatt_sr_is_cback_cnt_zero(tGATT_TCB& p_tcb, uint16_t cid);
 bool gatt_sr_is_prep_cnt_zero(tGATT_TCB& p_tcb);
 void gatt_sr_reset_cback_cnt(tGATT_TCB& p_tcb, uint16_t cid);
 void gatt_sr_reset_prep_cnt(tGATT_TCB& tcb);
diff --git a/system/stack/gatt/gatt_sr.cc b/system/stack/gatt/gatt_sr.cc
index 49c1ae452d..133080c1db 100644
--- a/system/stack/gatt/gatt_sr.cc
+++ b/system/stack/gatt/gatt_sr.cc
@@ -338,7 +338,7 @@ tGATT_STATUS gatt_sr_process_app_rsp(tGATT_TCB& tcb, tGATT_IF gatt_if, uint32_t
 
     sr_res_p->status = status;
 
-    if (gatt_sr_is_cback_cnt_zero(tcb) && status == GATT_SUCCESS) {
+    if (gatt_sr_is_cback_cnt_zero(tcb, sr_res_p->cid) && status == GATT_SUCCESS) {
       if (sr_res_p->p_rsp_msg == NULL) {
         sr_res_p->p_rsp_msg =
                 attp_build_sr_msg(tcb, (uint8_t)(op_code + 1), (tGATT_SR_MSG*)p_msg, payload_size);
@@ -347,7 +347,7 @@ tGATT_STATUS gatt_sr_process_app_rsp(tGATT_TCB& tcb, tGATT_IF gatt_if, uint32_t
       }
     }
   }
-  if (gatt_sr_is_cback_cnt_zero(tcb)) {
+  if (gatt_sr_is_cback_cnt_zero(tcb, sr_res_p->cid)) {
     if ((sr_res_p->status == GATT_SUCCESS) && (sr_res_p->p_rsp_msg)) {
       ret_code = attp_send_sr_msg(tcb, sr_res_p->cid, sr_res_p->p_rsp_msg);
       sr_res_p->p_rsp_msg = NULL;
diff --git a/system/stack/gatt/gatt_utils.cc b/system/stack/gatt/gatt_utils.cc
index 88ecfe2d53..584912752e 100644
--- a/system/stack/gatt/gatt_utils.cc
+++ b/system/stack/gatt/gatt_utils.cc
@@ -1362,17 +1362,30 @@ tGATT_SR_CMD* gatt_sr_get_cmd_by_trans_id(tGATT_TCB* p_tcb, uint32_t trans_id) {
  * Returns          True if thetotal application callback count is zero
  *
  ******************************************************************************/
-bool gatt_sr_is_cback_cnt_zero(tGATT_TCB& tcb) {
-  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
-    return tcb.sr_cmd.cback_cnt_map.empty();
+bool gatt_sr_is_cback_cnt_zero(tGATT_TCB& tcb, uint16_t cid) {
+  tGATT_SR_CMD* sr_cmd_p;
+  if (cid == tcb.att_lcid) {
+    sr_cmd_p = &tcb.sr_cmd;
   } else {
-    for (uint8_t i = 0; i < GATT_MAX_APPS; i++) {
-      if (tcb.sr_cmd.cback_cnt[i]) {
-        return false;
-      }
+    EattChannel* channel = EattExtension::GetInstance()->FindEattChannelByCid(tcb.peer_bda, cid);
+    if (channel == nullptr) {
+      log::warn("{}, cid 0x{:02x} already disconnected", tcb.peer_bda, cid);
+      return true;
     }
-    return true;
+    sr_cmd_p = &channel->server_outstanding_cmd_;
+  }
+
+  if (com::android::bluetooth::flags::gatt_client_dynamic_allocation()) {
+    return sr_cmd_p->cback_cnt_map.empty();
   }
+
+  for (uint8_t i = 0; i < GATT_MAX_APPS; i++) {
+    if (sr_cmd_p->cback_cnt[i] != 0) {
+      return false;
+    }
+  }
+
+  return true;
 }
 
 /*******************************************************************************