static int bluetooth_class_handler(struct usb_setup_packet *setup,

                                 int32_t *len, uint8_t **data)

{

        struct net_buf *buf;

 

        LOG_DBG("len %u", *len);

 

        buf = bt_buf_get_tx(BT_BUF_CMD, K_NO_WAIT, *data, *len);

        if (!buf) {

               LOG_ERR("Cannot get free buffer\n");

               return -ENOMEM;

        }

 

        net_buf_put(&rx_queue, buf);

 

        return 0;

}

       buf = net_buf_alloc(pool, timeout);          //SH: allocate BT_HCI_CMD_HDR_SIZE + CONFIG_BT_BUF_CMD_TX_SIZE bytes

       if (!buf) {

              return buf;

       }

       net_buf_reserve(buf, BT_BUF_RESERVE);

       bt_buf_set_type(buf, type);

       if (data && size) {

              net_buf_add_mem(buf, data, size);

       }



       return buf;

static inline void *net_buf_add_mem(struct net_buf *buf, const void *mem,
                                  size_t len)

{

        return net_buf_simple_add_mem(&buf->b, mem, len);

}
 
void *net_buf_simple_add_mem(struct net_buf_simple *buf, const void *mem,
                                                                 size_t len)

{

                    NET_BUF_SIMPLE_DBG("buf %p len %zu", buf, len);

                    return memcpy(net_buf_simple_add(buf, len), mem, len);     //SH: if buffer is not large enough copy len bytes from mem to buf violating boundaries

}

void *net_buf_simple_add(struct net_buf_simple *buf, size_t len)

{

        uint8_t *tail = net_buf_simple_tail(buf);

        NET_BUF_SIMPLE_DBG("buf %p len %zu", buf, len);

        __ASSERT_NO_MSG(net_buf_simple_tailroom(buf) >= len);             //SH: shouldn’t this case be properly handled?

        buf->len += len;            //SH: does this buffer really have enough space?

        return tail;

}