system-bt

Fork

Avoid more annoying crashing

Android 8.1.0 release 76
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXrBHFQAKCRDorT+BmrEO
eKjGAJ959Enb7SOOTTUMChpZl2d65gpnQgCeM1glqV8wKbm2JnqbJYluTwGftU0=
=2M7C
-----END PGP SIGNATURE-----

Merge tag 'android-8.1.0_r76' into oreo-x86

Android 8.1.0 release 76

Android 9.0.0 release 56
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXrBHVQAKCRDorT+BmrEO
eHOjAJ9/cfWIFJQM9KiqMK5lsWbU4go1HACfVhZkHJloHW5lCdTgaVoZB6s6fkQ=
=quwk
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r56' into pie-x86

Android 9.0.0 release 56

hci_packetizer: fix unused building errors

Fixes the following building errors:

system/bt/vendor_libs/linux/interface/hci_packetizer.cc:28:14:
error: unused variable 'preamble_size_for_type' [-Werror,-Wunused-const-variable]
const size_t preamble_size_for_type[] = {
^
system/bt/vendor_libs/linux/interface/hci_packetizer.cc:35:8:
error: unused function 'HciGetPacketLengthForType' [-Werror,-Wunused-function]
size_t HciGetPacketLengthForType(HciPacketType type, const uint8_t* preamble) {
^
2 errors generated.

Add back libbt-vendor

Fix for multiple com.android.bluetooth crash issues.

Issue 1: com.android.bluetooth crash was seen due to invalid/
out of bound index while creating Listening Channel for AVRCP.

Reason: AVRCP creates the listening channel using
bta_av_rc_create, this function expects RC Channel Handle to be
passed as it will fetch the index for RC handle using
tBTA_AV_SCB* p_scb = p_cb->p_scb[shdl - 1];

But we are passing 0 i.e. index for RC handle directly. Due to
which above statement will throw exception for out of bound
index and crash is observed.

Fix: Updated the bta_av_rc_create calls with RC handle value
instead of index.

Issue 2: com.android.bluetooth crash was seen due to failed
check for parameter length for vendor capabilities as:
CHECK(p_vcs_cplt_params->param_len >
BTM_VSC_CHIP_CAPABILITY_RSP_LEN)

Reason: We always receive param_len for vendor capabilities as
9. Also BTM_VSC_CHIP_CAPABILITY_RSP_LEN is defined as 9. But as
per the check param_len is expected to be greater than 9. As the
check fails, exception is seen and crash is observed.

Fix: Changed the CHECK on param_len for Vendor Capabilities as:
CHECK(p_vcs_cplt_params->param_len >=
BTM_VSC_CHIP_CAPABILITY_RSP_LEN)

Change-Id: Ic11c58e8193c0d8252e569fee2bc99d30abb7aae
Tracked-On:
Signed-off-by: Gaganpreet kaur <gaganpreetx.kaur@intel.com>

A work around fix for incorrect controller response.

Reason: The controller did not send correct response
for read remote extended features for "page 1" request.
Since lmp extended features ssp was not true, the sm4
was not enabled. Therefore host did not initiate
authentication request. When L2CAP AVDTP connection
was established, the controller returned disconnect
complete with authentication failed reason.

Fix: Provided a retry of read remote extended features
request from host, when response for 'page 1' was
incorrect. This enabled authentication from host and
hence L2CAP AVDTP connection was successful.
Revert the changes, once contoller fix is available

Tracked-On: OAM-69566

Signed-off-by: anitha3x <anithax.h.chandrasekar@intel.com>

Avoid annoying crashing on VMware

Remove the unused function

HCI: don't abort on timeout

Timeout is normal. Especially when the device is suspending.
Don't abort it stupidly.

Fix potential stack overflow caused by integer overflow

Bug: 151155194
Merged-In: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Change-Id: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
(cherry picked from commit 1570b62c88d7c5b9c6bfe43da8cc16ea30d3e8df)

Fix potential stack overflow caused by integer overflow

Bug: 151155194
Merged-In: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Change-Id: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
(cherry picked from commit 1570b62c88d7c5b9c6bfe43da8cc16ea30d3e8df)

Android 8.1.0 release 74
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXl1rEAAKCRDorT+BmrEO
eLxvAJ9ujZEpIPtet+3JnxDojMQ7nqiVDwCdGgo6yyOaaSb2niJMkybWw99Ze4M=
=VLUH
-----END PGP SIGNATURE-----

Merge tag 'android-8.1.0_r74' into oreo-x86

Android 8.1.0 release 74

GattServcer: Check invalid offset

Test: manual
Bug: 143231677
Change-Id: I97e2c3ae15fccc482d07d8d621c455cc74900cfd
Merged-In: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
(cherry picked from commit 7674de8fc890572471831ded8c80d3b52db5b60a)

AAC Decoder: Use osi_free() to free buffers allocated by osi_malloc()

* buffers allocated by osi_malloc() have canary bytes around it and need special method
osi_free() to free them

Bug: 148107188
Test: manual
Change-Id: Ifcfe494737c47e33755297214d3f637852a8be0b
(cherry picked from commit b88f8057fd28ca271ccd436a17f6489d4cf46697)
(cherry picked from commit 7a6fd5459ef8c6a2c21774e1220deb1023ae2935)

GattServcer: Check invalid offset

Test: manual
Bug: 143231677
Change-Id: I0396380f431cdb7f91c78db6de9043ea0f373dfe
Merged-In: I97e2c3ae15fccc482d07d8d621c455cc74900cfd
Merged-In: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
(cherry picked from commit c14c1fb86420bb69b1d8d2ee9e83108331183acd)

Avoid more annoying crashing

Avoid more annoying crashing

Merge cherrypicks of [10301183, 10301340, 10301110, 10299537, 10300908, 10301450, 10300619, 10301451, 10301654, 10301341, 10301342, 10301343, 10301344, 10301508, 10301184, 10301185, 10301309, 10301290, 10301310, 10301345, 10301346, 10301464, 10301291, 10300931, 10301382, 10301383, 10301465, 10301384, 10301385, 10301408, 10301386, 10299538, 10301387, 10301388, 10301389, 10301390, 10301391, 10301292, 10301392, 10301393, 10301694, 10301695, 10301489, 10299807, 10299808, 10299809, 10300620, 10301491, 10301111, 10301348] into qt-qpr2-release

Change-Id: I0cfb719c6af78bb1bb752f29e2950fcf20e1ad24

L2CAP socket: Stop L2CAP server by ID instead of PSM

* There could be multiple L2CAP socket control blocks with the same PSM
* The unique identifier for a L2CAP socket control block should be the
unique ID allocated during control block initialization
* Use this ID to track L2CAP socket control block instead of PSM ensure
that we close the correct socket
* Reset GAP handle and L2CAP socket ID to 0 when calling
bta_jv_free_l2c_cb() so that disconnected L2CAP control blocks does
not count

Test: CtsVerifier
Bug: 147997447
Bug: 144148429
Change-Id: Ideb428bc73aa0b36b8deb20fac280e44c8fe7db1
(cherry picked from commit ad23e6b2f473829b1819918cd3f927d1134c83b3)
(cherry picked from commit 7c901002dcf856c0102425631da3475364ac4129)

L2CAP Socket: Keep track of last allocated socket ID

* Keep track of last allocated socket ID in L2CAP socket stack
* Use last_sock_id + 1 as new IDs when allocating new socket blocks
* The de-dupe and overflow detection mechanism in btsock_l2cap_alloc_l()
would handle the uint32_t overflow and duplicate ID cases

Test: CtsBluetoothTestCases
Bug: 144148429
Change-Id: Ieb9791ffa34eef919a32e4aff6f4b514859c69c0
(cherry picked from commit 79eda3270bbd23814b5ec73ee3fd96ac80222db8)
(cherry picked from commit eb4e9162b91995ae8318745c42dad32e972a8bbd)

LE-COC: Free LE-COC server resource when BluetoothServerSocket is closed

* When BluetoothServerSocket is closed in the Java layer, the native
layer should respond by freeing all resources used by the server
including file descriptors, structs, PSMs, and security IDs
* We did this correctly for BR_EDR L2CAP COC channels after
I4e37dcd858af258fbd64fbfb2fbf0083bd743e06, but the same fix did not
apply to LE COC
* This CL make sure LE COC server resources are freed propertly upon
server fd closure

Test: open and close LE COC server repeatedly on an Android phone
Fixes: 144148429
Change-Id: I16fa10e77612105d23848f71925ff6efc95bc75a
(cherry picked from commit d3c9966624530772fbdc469179726bd9191314c5)
(cherry picked from commit 8d2c8ba5739432e8104b6aa6d8e64fe407f9b974)

Android 9.0.0 Release 53 (6107734)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXji5JAAKCRDorT+BmrEO
eJboAKCSe9P52YLnIX6VnMmDDDsqg903CACffCK0Mg8A9OqfA8/j+eSXd1PLC1k=
=XSWP
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r53' into pie-x86

Android 9.0.0 Release 53 (6107734)

Android 9.0.0 release 52
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXhOwsgAKCRDorT+BmrEO
eDoxAJ44V2t/Tt+GwLDRNqBNt2BJqppEnQCfZ26WzmibtVcI0EdiML9JFs3DnZI=
=LQYB
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r52' into pie-x86

Android 9.0.0 release 52

SDP: add return after SDP disconnection

A return is needed after sdp_disconnect(). It is the logic
expected and it prevents the use of p_ccb after it's freed.

Bug: 144177780
Bug: 117105007
Test: manual test
Change-Id: I7a64382b36adca37a8ff0c7e361d89ecdc8f3b55
(cherry picked from commit 30efc8c90a846460359a489e17e1461c725958b3)
(cherry picked from commit 5edd605227af9a1b9eedf4fd9f02373a47fd49fb)

SDP: add return after SDP disconnection

A return is needed after sdp_disconnect(). It is the logic
expected and it prevents the use of p_ccb after it's freed.

Bug: 144177780
Bug: 117105007
Test: manual test
Change-Id: I7a64382b36adca37a8ff0c7e361d89ecdc8f3b55
(cherry picked from commit 30efc8c90a846460359a489e17e1461c725958b3)
(cherry picked from commit 5edd605227af9a1b9eedf4fd9f02373a47fd49fb)

Snap for 6091187 from fb4b5ebf1dd89ca8f3903a436e39e803949735ea to qt-qpr2-release

Change-Id: I529c233bc91e51349fa2bee5cef27644ea867bf7

Merge "L2CAP: Check length for packet before connection complete" into qt-qpr1-dev

Merge "HCI: Check length of connection complete event" into qt-qpr1-dev

Merge "L2CAP: Bounds check num_handles in NumCompletedPackets" into qt-qpr1-dev