bluedroid: fixed gatt tcb free when disconnecting

components/bt/host/bluedroid/stack/include/stack/l2c_api.h

@@ -1240,6 +1240,7 @@ extern BOOLEAN L2CA_CheckIsCongest(UINT16 fixed_cid, BD_ADDR addr);
 #define  L2CA_DECREASE_BTU_NUM 4
 #define  L2CA_BUFF_INI         5
 #define  L2CA_BUFF_DEINIT      6
+#define  L2CA_BUFF_FREE        7
 
 typedef struct {
     UINT16 conn_id;

components/bt/host/bluedroid/stack/l2cap/l2c_api.c

@@ -2386,6 +2386,12 @@ void l2ble_update_att_acl_pkt_num(UINT8 type, tl2c_buff_param_t *param)
         buff_semaphore = NULL;
         break;
     }
+    case L2CA_BUFF_FREE:{
+        xSemaphoreTake(buff_semaphore, portMAX_DELAY);
+        // Do nothing
+        xSemaphoreGive(buff_semaphore);
+        break;
+    }
     default:
         break;
     }

components/bt/host/bluedroid/stack/l2cap/l2c_utils.c

@@ -1676,6 +1676,12 @@ void l2cu_release_ccb (tL2C_CCB *p_ccb)
     if (!p_ccb->in_use) {
         return;
     }
+#if BLE_INCLUDED == TRUE
+    if (p_lcb->transport == BT_TRANSPORT_LE) {
+        /* Take samephore to avoid race condition */
+        l2ble_update_att_acl_pkt_num(L2CA_BUFF_FREE, NULL);
+    }
+#endif
 #if (SDP_INCLUDED == TRUE)
     if (p_rcb && (p_rcb->psm != p_rcb->real_psm)) {
         btm_sec_clr_service_by_psm(p_rcb->psm);