fix: Fix the critical issues of btu and bt_common from AI review report

- advance connect queue on synchronous connect_cb failure
- lock bta_alarm_hash_map in all BTA timer APIs
- free controller params after stack disable; cleanup on init fail
- handle BTE_InitStack failure and signal init future
- validate HCI remote name event length before parse
- drop stale L2CAP quick-timer alarm events

components/bt/host/bluedroid/stack/btu/btu_hcif.c

@@ -1002,6 +1002,11 @@ static void btu_hcif_rmt_name_request_comp_evt (UINT8 *p, UINT16 evt_len)
     UINT8   status;
     BD_ADDR bd_addr;
 
+    if (evt_len < (1 + BD_ADDR_LEN)) {
+        HCI_TRACE_ERROR("HCI_RMT_NAME_REQUEST_COMP_EVT param too short (len=%u)", evt_len);
+        return;
+    }
+
     STREAM_TO_UINT8 (status, p);
     STREAM_TO_BDADDR (bd_addr, p);
 

components/bt/host/bluedroid/stack/btu/btu_init.c

@@ -148,10 +148,10 @@ void btu_free_core(void)
 **                  NOTE: Must be called before creating any tasks
 **                      (RPC, BTU, HCIT, APPL, etc.)
 **
-** Returns          void
+** Returns          true for success, otherwise false
 **
 ******************************************************************************/
-void BTU_StartUp(void)
+bool BTU_StartUp(void)
 {
 #if BTU_DYNAMIC_MEMORY
     btu_cb_ptr = (tBTU_CB *)osi_malloc(sizeof(tBTU_CB));
@@ -194,11 +194,12 @@ void BTU_StartUp(void)
         goto error_exit;
     }
 
-    return;
+    return true;
 
 error_exit:;
     LOG_ERROR("%s Unable to allocate resources for bt_workqueue", __func__);
     BTU_ShutDown();
+    return false;
 }
 
 /*****************************************************************************

components/bt/host/bluedroid/stack/btu/btu_task.c

@@ -272,7 +272,13 @@ void btu_task_start_up(void *param)
     btu_init_core();
 
     /* Initialize any optional stack components */
-    BTE_InitStack();
+    if (BTE_InitStack() != BT_STATUS_SUCCESS) {
+        HCI_TRACE_ERROR("BTE_InitStack failed");
+        if (bluedroid_init_done_cb) {
+            bluedroid_init_done_cb(BT_STATUS_NOMEM);
+        }
+        return;
+    }
 
 #if (defined(BTA_INCLUDED) && BTA_INCLUDED == TRUE)
     bta_sys_init();
@@ -280,11 +286,9 @@ void btu_task_start_up(void *param)
 
     // Inform the bt jni thread initialization is ok.
     // btif_transfer_context(btif_init_ok, 0, NULL, 0, NULL);
-#if(defined(BT_APP_DEMO) && BT_APP_DEMO == TRUE)
     if (bluedroid_init_done_cb) {
-        bluedroid_init_done_cb();
+        bluedroid_init_done_cb(BT_STATUS_SUCCESS);
     }
-#endif
 }
 
 void btu_task_shut_down(void)
@@ -551,6 +555,13 @@ static void btu_l2cap_alarm_process(void *param)
     TIMER_LIST_ENT *p_tle = (TIMER_LIST_ENT *)param;
     assert(p_tle != NULL);
 
+    osi_mutex_lock(&btu_l2cap_alarm_lock, OSI_MUTEX_MAX_TIMEOUT);
+    if (!hash_map_has_key(btu_l2cap_alarm_hash_map, p_tle) || p_tle->in_use == FALSE) {
+        osi_mutex_unlock(&btu_l2cap_alarm_lock);
+        return;
+    }
+    osi_mutex_unlock(&btu_l2cap_alarm_lock);
+
     switch (p_tle->event) {
     case BTU_TTYPE_L2CAP_CHNL:      /* monitor or retransmission timer */
     case BTU_TTYPE_L2CAP_FCR_ACK:   /* ack timer */

components/bt/host/bluedroid/stack/include/stack/btu.h

@@ -293,7 +293,7 @@ void  btu_hcif_cmd_timeout (UINT8 controller_id);
 void  btu_init_core(void);
 void  btu_free_core(void);
 
-void BTU_StartUp(void);
+bool BTU_StartUp(void);
 void BTU_ShutDown(void);
 
 void btu_task_start_up(void *param);