system-bt

Fork

Android 9.0.0 release 56
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXrBHVQAKCRDorT+BmrEO
eHOjAJ9/cfWIFJQM9KiqMK5lsWbU4go1HACfVhZkHJloHW5lCdTgaVoZB6s6fkQ=
=quwk
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r56' into pie-x86

Android 9.0.0 release 56

Fix potential stack overflow caused by integer overflow

Bug: 151155194
Merged-In: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Change-Id: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
(cherry picked from commit 1570b62c88d7c5b9c6bfe43da8cc16ea30d3e8df)

GattServcer: Check invalid offset

Test: manual
Bug: 143231677
Change-Id: I97e2c3ae15fccc482d07d8d621c455cc74900cfd
Merged-In: I0ca22e7c60292d61c758120c1cd67f6e6edd8ae8
(cherry picked from commit 7674de8fc890572471831ded8c80d3b52db5b60a)

AAC Decoder: Use osi_free() to free buffers allocated by osi_malloc()

* buffers allocated by osi_malloc() have canary bytes around it and need special method
osi_free() to free them

Bug: 148107188
Test: manual
Change-Id: Ifcfe494737c47e33755297214d3f637852a8be0b
(cherry picked from commit b88f8057fd28ca271ccd436a17f6489d4cf46697)
(cherry picked from commit 7a6fd5459ef8c6a2c21774e1220deb1023ae2935)

Avoid more annoying crashing

Android 9.0.0 Release 53 (6107734)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXji5JAAKCRDorT+BmrEO
eJboAKCSe9P52YLnIX6VnMmDDDsqg903CACffCK0Mg8A9OqfA8/j+eSXd1PLC1k=
=XSWP
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r53' into pie-x86

Android 9.0.0 Release 53 (6107734)

Android 9.0.0 release 52
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXhOwsgAKCRDorT+BmrEO
eDoxAJ44V2t/Tt+GwLDRNqBNt2BJqppEnQCfZ26WzmibtVcI0EdiML9JFs3DnZI=
=LQYB
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r52' into pie-x86

Android 9.0.0 release 52

SDP: add return after SDP disconnection

A return is needed after sdp_disconnect(). It is the logic
expected and it prevents the use of p_ccb after it's freed.

Bug: 144177780
Bug: 117105007
Test: manual test
Change-Id: I7a64382b36adca37a8ff0c7e361d89ecdc8f3b55
(cherry picked from commit 30efc8c90a846460359a489e17e1461c725958b3)
(cherry picked from commit 5edd605227af9a1b9eedf4fd9f02373a47fd49fb)

Fix potential OOB write in btm_read_remote_ext_features_complete

Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than
HCI_EXT_FEATURES_PAGE_MAX.

Bug: 141552859
Bug: 144205318
Test: inject function
Merged-In: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Change-Id: Iaca4db4ee9bf27362f62aba0da088727e98955d1
(cherry picked from commit 140d8297ace9cd54a903a9cd3a079fd805030f1e)

GAP: Correct the continuous pkt length in l2cap

L2cap continuous pkt length wrongly calculated in
reassembly logic when remote sends more data
than expected.

Wrong pkt length leading to memory corruption

Hence the Correct the continuous pkt length in
l2cap reassembly logic.

Bug: 135239489
Bug: 143894715
CRs-Fixed: 2434229
Test: make and internal testing
Change-Id: I758d9e31465b99e436b9b1841320000f08186c97
Merged-In: I758d9e31465b99e436b9b1841320000f08186c97
(cherry picked from commit 337bd4579453bd6bf98ff519de3ac1019cd30d28)
(cherry picked from commit 602f4b44fe30ec8b225e1cee5f96817607d93e5a)

Fall back to CLOCK_BOOTTIME if CLOCK_BOOTTIME_ALARM fails

If the cuttlefish device does not have an rtc device (such as the crosvm
VMM) the bt osi layer can promote crashes due to it not being able to
create a CLOCK_BOOTTIME_ALARM timer. Bring back a fallback but enable it
at runtime instead of compile time.

Bug: 126955943
Test: run with cuttlefish
Change-Id: I3ab0282b3e8fde776aa7b37d5772c8f62cf957bf

Support generic USB Bluetooth adapter

Find USB Bluetooth adapter according to device class and subclass.
See https://www.usb.org/defined-class-codes#anchor_BaseClassE0h.

hciblecmds: remove unnecessary checking

This fixes Bluetooth USB dongle support.

Replace Bluetooth HAL by Intel's implementation

Linaro's implementation is buggy.

Add back libbt-vendor

Avoid annoying crashing on VMware

Remove the unused function

HCI: don't abort on timeout

Timeout is normal. Especially when the device is suspending.
Don't abort it stupidly.

A work around fix for incorrect controller response.

Reason: The controller did not send correct response
for read remote extended features for "page 1" request.
Since lmp extended features ssp was not true, the sm4
was not enabled. Therefore host did not initiate
authentication request. When L2CAP AVDTP connection
was established, the controller returned disconnect
complete with authentication failed reason.

Fix: Provided a retry of read remote extended features
request from host, when response for 'page 1' was
incorrect. This enabled authentication from host and
hence L2CAP AVDTP connection was successful.
Revert the changes, once contoller fix is available

Tracked-On: OAM-69566

Signed-off-by: anitha3x <anithax.h.chandrasekar@intel.com>

Fix for Bluetooth device name reset to default name after reboot

Reason: When the BT device name is updated is getting saved
to the config data pointer but not to the persistent data
(i.e. bt_config.conf). So, when the reboot is happening it
is not able to get the updated device name from the persistent
data (i.e. bt_config.conf) as during reboot bt_config_flush is
not called. It is only called on the BT Enable Event.

Fix: Saving the BT Device name to persistent data using
btif_config_flush once it is set.

Tracked-On: OAM-67917

Signed-off-by: Gaganpreet kaur <gaganpreetx.kaur@intel.com>
Signed-off-by: Aiswarya Cyriac <aiswarya.cyriac@intel.com>

Fix for BLE pairing failure in slave role

Pairing fails due to DHkey mismatch and this fix address the
mismatch

Change-Id: Ie09f6c4ef3e70cce3f3b57858b6e8945eb65e63c
Tracked-On:https://jira01.devtools.intel.com/browse/OAM-57377
Signed-Off-by: Aiswarya Cyriac <aiswarya.cyriac@intel.com>

[system][bt] fix -Wdangling-gsl

BtAddrString() returns a std::string. It's not safe to chain a call to
c_str() as otherwise the returned std::string is a temporary, and the
expression evaluates to an immediately dangling pointer.

Bug: 139945549
Bug: 142558228
Test: mm
Change-Id: I30972458abcc563b24ee0d80b289c3efd6c3e04d
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
(cherry picked from commit 20ed45d6339079645ef9fe576b894e9497684c93)

JustWorks: Auto-accept only incoming temporary pairing.

Bug: 110433804
Bug: 134461862
Test: Manual; atest net_test_bluetooth
Change-Id: I4e3f39bc08e9d9493734a21ea29d76e43aeb50c8
Merged-In: I4e3f39bc08e9d9493734a21ea29d76e43aeb50c8
(cherry picked from commit 650206874470dae8fac8e31174e98b3b6f65eebd)

Fix read out of bounds in BtifAvEvent::DeepCopy

Bug: 140768453
Change-Id: Ia05e12382ef78a3e07228d09bcf9347f9976bffd
(cherry picked from commit 8ac773aa5b2ace322a52e27a2231ac63688219de)

Revert "DO NOT MERGE: btif: require pairing dialog for JustWorks SSP"

This reverts commit 26ba26be830f04e6fd9c77b075bcae48677d4cce.

Reason for revert: breaks tv UX
Bug: 110433804
Change-Id: I2c644ed62619f34494be0a0c7c75078cec0ebdd3

(cherry picked from commit caff42bd3c5bc2f7120b94235c3c578a1b2b407d)

SDP: Disconnect when there is a bad length

Handle the case when SDP_RAW_DATA_INCLUDED is FALSE.
Related to: I9f0df8b2de28970e7d69b737ce5d363785183bf3

Bug: 137239831
Bug: 117105007
Test: manual test
Change-Id: I354494565005f2ca9093486546fc54c145066413
Merged-In: I354494565005f2ca9093486546fc54c145066413
(cherry picked from commit e45fe0a8ec678c73c57967b69c2fd485eef92927)
(cherry picked from commit 7f555a1a9b641a8e4892a4e7a7cc1ff294d8f2b7)

Use memcpy instead of casting to convert device_class to int

Bug: 140152619
Test: atest net_test_btcoreclear
Change-Id: Iee71ce35576e438317841d41a81fda6a87e1984a
Merged-In: Iee71ce35576e438317841d41a81fda6a87e1984a
(cherry picked from commit ec75f1efb6b9be4933225a4b724e7a3ef5e3d70b)
(cherry picked from commit 969ebed816c5d709128acadb1cbc8a04a6705d1e)

SDP: disconnect if sdp_copy_raw_data fails

Our partners met with the problem with sdp_copy_raw_data updated in
CVE-2019-2116. When peer device responds with a wrong size,
sdp_copy_raw_data will not complete and won't trigger
disconnection. This CL enables the disconnection when a wrong size is
received.

Bug: 137239831
Bug: 117105007
Test: manual test
Change-Id: I9f0df8b2de28970e7d69b737ce5d363785183bf3
Merged-In: I9f0df8b2de28970e7d69b737ce5d363785183bf3
(cherry picked from commit bc9df3451dad17c1ab1002fdbc85d60e57d4f0af)
(cherry picked from commit 41939a2b5a8e3584c5a99dfe264a47df79e3091f)

DO NOT MERGE: btif: require pairing dialog for JustWorks SSP

Bug: 110433804
Test: Manual; atest net_test_bluetooth
Change-Id: If65a8d53ff368ba3ddddb47cfc0072469090b46a
(cherry picked from commit ddae6274742e241c03526c7659dca7b3446b9f8d)
(cherry picked from commit 26ba26be830f04e6fd9c77b075bcae48677d4cce)

DO NOT MERGE Store BLE keys using the address from the ble_auth_cmpl_evt

Reading the peer address from btif_dm_ble_auth_cmpl_evt, instead
of using the value from the pairing control block in
btif_dm_save_ble_bonding_keys, ensures that BLE keys are stored with
the correct address.

Bug: 133234174
Bug: 79703832
Test: 1. Initiate crosskey pairing from BLE
2. Check whether BLE keys are stored correctly
Change-Id: I18b4a1d8e2cdcd6dd4a300f1dc9e6d3892a3baff
(cherry picked from commit 0d95651e8b22b1012f1ee103e4a0b8665a0c17d4)
(cherry picked from commit b2334f05895e9926666904c41f13821210cbd6e9)