LE: UPF 45 bug fixes

This change fixes the following issues:
- Second GATT-over-BR/EDR channel cannot be established when there
  already is an existing GATT-over-BR/EDR channel
- If encryption fails for an LE connection due to a missing key,
  the security state is not being cleared and blocks all further
  security processing
- When DM discovery of an LE Peripheral device fails with a
  connection timeout, no further discovery requests can be made
- GATT service discovery can get into endless loop when duplicate descriptor
  definitions are found on the remote device
- When GATT over BR/EDR fails, BTA does not give a connection
  callback to the application initiating the connection
- BR/EDR connection to remote platform does not generate API callbacks
- Stack crash discovered during UPF after remote disconnects
- The host is sending HCI disconnect to invalid HCI handle when
  SMP fails because of a connection timeout
- Possible race condition:
  If a disconnect is immediately followed by a connection complete,
  the connection complete cannot be processed in the BTA GATT state
  machine
- Write Complete event is not triggered for Prepare Write requests

Change-Id: I539cdedd68007818ff4f0d0213cee1c913f72d0f

Conflicts:
	bta/gatt/bta_gatts_act.c

1 files changed, 4 insertions, 2 deletions

diff --git a/stack/gatt/gatt_utils.c b/stack/gatt/gatt_utils.c
index 5b375b54f..b7f5224d6 100644
--- a/stack/gatt/gatt_utils.c
+++ b/stack/gatt/gatt_utils.c
@@ -710,7 +710,7 @@ BOOLEAN gatt_find_the_connected_bda(UINT8 start_idx, BD_ADDR bda, UINT8 *p_found
 
     for (i = start_idx ; i < GATT_MAX_PHY_CHANNEL; i ++)
     {
-        if (gatt_cb.tcb[i].in_use)
+        if (gatt_cb.tcb[i].in_use && gatt_cb.tcb[i].ch_state == GATT_CH_OPEN)
         {
             memcpy( bda, gatt_cb.tcb[i].peer_bda, BD_ADDR_LEN);
             *p_found_idx = i;
@@ -2543,7 +2543,9 @@ void gatt_deregister_bgdev_list(tGATT_IF gatt_if)
                 if (p_dev_list->listen_gif[j] == gatt_if)
                 {
                     p_dev_list->listen_gif[j] = 0;
-                    p_reg->listening --;
+
+                    if (p_reg != NULL && p_reg->listening > 0)
+                        p_reg->listening --;
 
                     /* move all element behind one forward */
                     for (k = j + 1; k < GATT_MAX_APPS; k ++)