system-bt

Fork

Avoid more annoying crashing

Android 9.0.0 Release 53 (6107734)
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXji5JAAKCRDorT+BmrEO
eJboAKCSe9P52YLnIX6VnMmDDDsqg903CACffCK0Mg8A9OqfA8/j+eSXd1PLC1k=
=XSWP
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r53' into pie-x86

Android 9.0.0 Release 53 (6107734)

Android 9.0.0 release 52
-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCXhOwsgAKCRDorT+BmrEO
eDoxAJ44V2t/Tt+GwLDRNqBNt2BJqppEnQCfZ26WzmibtVcI0EdiML9JFs3DnZI=
=LQYB
-----END PGP SIGNATURE-----

Merge tag 'android-9.0.0_r52' into pie-x86

Android 9.0.0 release 52

SDP: add return after SDP disconnection

A return is needed after sdp_disconnect(). It is the logic
expected and it prevents the use of p_ccb after it's freed.

Bug: 144177780
Bug: 117105007
Test: manual test
Change-Id: I7a64382b36adca37a8ff0c7e361d89ecdc8f3b55
(cherry picked from commit 30efc8c90a846460359a489e17e1461c725958b3)
(cherry picked from commit 5edd605227af9a1b9eedf4fd9f02373a47fd49fb)

Fix potential OOB write in btm_read_remote_ext_features_complete

Add event length check to avoid hci event sent from controller not
correct.
Add page number check to avoid page number is bigger than
HCI_EXT_FEATURES_PAGE_MAX.

Bug: 141552859
Bug: 144205318
Test: inject function
Merged-In: Iaca4db4ee9bf27362f62aba0da088727e98955d1
Change-Id: Iaca4db4ee9bf27362f62aba0da088727e98955d1
(cherry picked from commit 140d8297ace9cd54a903a9cd3a079fd805030f1e)

GAP: Correct the continuous pkt length in l2cap

L2cap continuous pkt length wrongly calculated in
reassembly logic when remote sends more data
than expected.

Wrong pkt length leading to memory corruption

Hence the Correct the continuous pkt length in
l2cap reassembly logic.

Bug: 135239489
Bug: 143894715
CRs-Fixed: 2434229
Test: make and internal testing
Change-Id: I758d9e31465b99e436b9b1841320000f08186c97
Merged-In: I758d9e31465b99e436b9b1841320000f08186c97
(cherry picked from commit 337bd4579453bd6bf98ff519de3ac1019cd30d28)
(cherry picked from commit 602f4b44fe30ec8b225e1cee5f96817607d93e5a)

Fall back to CLOCK_BOOTTIME if CLOCK_BOOTTIME_ALARM fails

If the cuttlefish device does not have an rtc device (such as the crosvm
VMM) the bt osi layer can promote crashes due to it not being able to
create a CLOCK_BOOTTIME_ALARM timer. Bring back a fallback but enable it
at runtime instead of compile time.

Bug: 126955943
Test: run with cuttlefish
Change-Id: I3ab0282b3e8fde776aa7b37d5772c8f62cf957bf

Support generic USB Bluetooth adapter

Find USB Bluetooth adapter according to device class and subclass.
See https://www.usb.org/defined-class-codes#anchor_BaseClassE0h.

hciblecmds: remove unnecessary checking

This fixes Bluetooth USB dongle support.

Replace Bluetooth HAL by Intel's implementation

Linaro's implementation is buggy.

Add back libbt-vendor

Avoid annoying crashing on VMware

Remove the unused function

HCI: don't abort on timeout

Timeout is normal. Especially when the device is suspending.
Don't abort it stupidly.

A work around fix for incorrect controller response.

Reason: The controller did not send correct response
for read remote extended features for "page 1" request.
Since lmp extended features ssp was not true, the sm4
was not enabled. Therefore host did not initiate
authentication request. When L2CAP AVDTP connection
was established, the controller returned disconnect
complete with authentication failed reason.

Fix: Provided a retry of read remote extended features
request from host, when response for 'page 1' was
incorrect. This enabled authentication from host and
hence L2CAP AVDTP connection was successful.
Revert the changes, once contoller fix is available

Tracked-On: OAM-69566

Signed-off-by: anitha3x <anithax.h.chandrasekar@intel.com>

Fix for Bluetooth device name reset to default name after reboot

Reason: When the BT device name is updated is getting saved
to the config data pointer but not to the persistent data
(i.e. bt_config.conf). So, when the reboot is happening it
is not able to get the updated device name from the persistent
data (i.e. bt_config.conf) as during reboot bt_config_flush is
not called. It is only called on the BT Enable Event.

Fix: Saving the BT Device name to persistent data using
btif_config_flush once it is set.

Tracked-On: OAM-67917

Signed-off-by: Gaganpreet kaur <gaganpreetx.kaur@intel.com>
Signed-off-by: Aiswarya Cyriac <aiswarya.cyriac@intel.com>

Fix for BLE pairing failure in slave role

Pairing fails due to DHkey mismatch and this fix address the
mismatch

Change-Id: Ie09f6c4ef3e70cce3f3b57858b6e8945eb65e63c
Tracked-On:https://jira01.devtools.intel.com/browse/OAM-57377
Signed-Off-by: Aiswarya Cyriac <aiswarya.cyriac@intel.com>

[system][bt] fix -Wdangling-gsl

BtAddrString() returns a std::string. It's not safe to chain a call to
c_str() as otherwise the returned std::string is a temporary, and the
expression evaluates to an immediately dangling pointer.

Bug: 139945549
Bug: 142558228
Test: mm
Change-Id: I30972458abcc563b24ee0d80b289c3efd6c3e04d
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
(cherry picked from commit 20ed45d6339079645ef9fe576b894e9497684c93)

JustWorks: Auto-accept only incoming temporary pairing.

Bug: 110433804
Bug: 134461862
Test: Manual; atest net_test_bluetooth
Change-Id: I4e3f39bc08e9d9493734a21ea29d76e43aeb50c8
Merged-In: I4e3f39bc08e9d9493734a21ea29d76e43aeb50c8
(cherry picked from commit 650206874470dae8fac8e31174e98b3b6f65eebd)

Fix read out of bounds in BtifAvEvent::DeepCopy

Bug: 140768453
Change-Id: Ia05e12382ef78a3e07228d09bcf9347f9976bffd
(cherry picked from commit 8ac773aa5b2ace322a52e27a2231ac63688219de)

Revert "DO NOT MERGE: btif: require pairing dialog for JustWorks SSP"

This reverts commit 26ba26be830f04e6fd9c77b075bcae48677d4cce.

Reason for revert: breaks tv UX
Bug: 110433804
Change-Id: I2c644ed62619f34494be0a0c7c75078cec0ebdd3

(cherry picked from commit caff42bd3c5bc2f7120b94235c3c578a1b2b407d)

SDP: Disconnect when there is a bad length

Handle the case when SDP_RAW_DATA_INCLUDED is FALSE.
Related to: I9f0df8b2de28970e7d69b737ce5d363785183bf3

Bug: 137239831
Bug: 117105007
Test: manual test
Change-Id: I354494565005f2ca9093486546fc54c145066413
Merged-In: I354494565005f2ca9093486546fc54c145066413
(cherry picked from commit e45fe0a8ec678c73c57967b69c2fd485eef92927)
(cherry picked from commit 7f555a1a9b641a8e4892a4e7a7cc1ff294d8f2b7)

Use memcpy instead of casting to convert device_class to int

Bug: 140152619
Test: atest net_test_btcoreclear
Change-Id: Iee71ce35576e438317841d41a81fda6a87e1984a
Merged-In: Iee71ce35576e438317841d41a81fda6a87e1984a
(cherry picked from commit ec75f1efb6b9be4933225a4b724e7a3ef5e3d70b)
(cherry picked from commit 969ebed816c5d709128acadb1cbc8a04a6705d1e)

SDP: disconnect if sdp_copy_raw_data fails

Our partners met with the problem with sdp_copy_raw_data updated in
CVE-2019-2116. When peer device responds with a wrong size,
sdp_copy_raw_data will not complete and won't trigger
disconnection. This CL enables the disconnection when a wrong size is
received.

Bug: 137239831
Bug: 117105007
Test: manual test
Change-Id: I9f0df8b2de28970e7d69b737ce5d363785183bf3
Merged-In: I9f0df8b2de28970e7d69b737ce5d363785183bf3
(cherry picked from commit bc9df3451dad17c1ab1002fdbc85d60e57d4f0af)
(cherry picked from commit 41939a2b5a8e3584c5a99dfe264a47df79e3091f)

DO NOT MERGE: btif: require pairing dialog for JustWorks SSP

Bug: 110433804
Test: Manual; atest net_test_bluetooth
Change-Id: If65a8d53ff368ba3ddddb47cfc0072469090b46a
(cherry picked from commit ddae6274742e241c03526c7659dca7b3446b9f8d)
(cherry picked from commit 26ba26be830f04e6fd9c77b075bcae48677d4cce)

DO NOT MERGE Store BLE keys using the address from the ble_auth_cmpl_evt

Reading the peer address from btif_dm_ble_auth_cmpl_evt, instead
of using the value from the pairing control block in
btif_dm_save_ble_bonding_keys, ensures that BLE keys are stored with
the correct address.

Bug: 133234174
Bug: 79703832
Test: 1. Initiate crosskey pairing from BLE
2. Check whether BLE keys are stored correctly
Change-Id: I18b4a1d8e2cdcd6dd4a300f1dc9e6d3892a3baff
(cherry picked from commit 0d95651e8b22b1012f1ee103e4a0b8665a0c17d4)
(cherry picked from commit b2334f05895e9926666904c41f13821210cbd6e9)

DO NOT MERGE Separate SDP procedure from bonding state (1/2)

- Do not stay in bonding state if the device is paried but still
discovering service.
- Report BOND_BONDED to Java after authentication for a classic
Bluetooth device is completed.
- Send BONDING event to Java when static identity address is
first obtained during crosskey pairing
- Send BONDING event to Java for the initial random address
before send BONDED event
- Do not send bond event for static identity address when SDP is done.
- Make sure pairing control block always get cleaned up when both SDP
and pairing are done
- Send empty UUIDs to Java layer to unblock bonding intent broadcast
when SDP fails

Bug: 79703832
Test: runtest bluetooth, regression test
Change-Id: Ic33ca045b996c02a7c98e458f791a1747a8ea6d5
(cherry picked from commit 6628beb969f3f8e58972d2c2eb8b4bc053a11109)

Revert "DO NOT MERGE Separate SDP procedure from bonding state (1/2)"

This reverts commit 12df1a2282e6d591bd0e1db75f0c38067a31ef40.

DO NOT MERGE Fix for Bluetooth connection being dropped after HCI Read Encryption Key Size

If remote device stop the encryption before we call "Read Encryption Key Size",
we might receive Insufficient Security, which means that link is no longer
encrypted.

In such cases we should stay connected, rather than disconnecting the
link.

Test: Connect to device that stop encryption right after encryption is
complete, i.e. to change roles.
Bug: 124301137
Bug: 132626699

Change-Id: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
Merged-In: Iab0fd9f357d18a6b048b971d0393fbb47fd4d793
(cherry picked from commit c978f86b506f31567b5991c91cdbe4c142ca8edd)

DO NOT MERGE Separate SDP procedure from bonding state (1/2)

- Do not stay in bonding state if the device is paried but still
discovering service.
- Report BOND_BONDED to Java after authentication for a classic
Bluetooth device is completed.
- Send BONDING event to Java when static identity address is
first obtained during crosskey pairing
- Send BONDING event to Java for the initial random address
before send BONDED event
- Do not send bond event for static identity address when SDP is done.
- Make sure pairing control block always get cleaned up when both SDP
and pairing are done
- Send empty UUIDs to Java layer to unblock bonding intent broadcast
when SDP fails

Bug: 79703832
Test: runtest bluetooth, regression test
Change-Id: Ic33ca045b996c02a7c98e458f791a1747a8ea6d5
(cherry picked from commit 6628beb969f3f8e58972d2c2eb8b4bc053a11109)