OSDN Git Service
Hansong Zhang [Thu, 7 Jun 2018 21:25:09 +0000 (14:25 -0700)]
HID Host: Check L2CAP packet data length
Bug:
80493272
Test: manual
Change-Id: I8b1acd11616684729752195fabb4fa34c46a508d
(cherry picked from commit
ca47a05acb66218ff2123f8d4642961f7f2eb5e2)
Hansong Zhang [Thu, 12 Jul 2018 17:51:30 +0000 (10:51 -0700)]
DO NOT MERGE Fix OOB read in process_l2cap_cmd
Test: manual
Bug:
79488381
Change-Id: I723866ed40d3647fed99875f659bb95df96a6969
(cherry picked from commit
54c6a9dfd52ac6711d6f2101d233b276b2e3bb53)
Jakub Pawlowski [Fri, 22 Jun 2018 05:56:11 +0000 (22:56 -0700)]
Add packet length checks in l2cble_process_sig_cmd
Bug:
80261585
Test: compilation
Change-Id: Icf55747dc948bcce140a12658237554938e2d717
(cherry picked from commit
02f47a752c818277b31852e3ff940764d5c7f9c7)
Jakub Pawlowski [Wed, 11 Jul 2018 09:57:07 +0000 (02:57 -0700)]
Don't use Address after it was deleted
Bug:
110216173
Change-Id: Id3364cf53153eafed478546d7347ed1673217e91
(cherry picked from commit
9930f6f4e14e64966869b119994126283d645fd0)
Hansong Zhang [Wed, 27 Jun 2018 21:26:40 +0000 (14:26 -0700)]
HFP: Fix out of bound access in phone number processing
* Write at most sizeof(dialnum) chars into dialnum array in ClccResponse
method
* Write at most sizeof(ag_res.str) - 5 chars into ag_res.str array in
PhoneStateChange method
Bug:
79431031
Bug:
79266386
Test: make call with super long phone numbers
Change-Id: I98e7687ac4055800aa46626c6b1c866e52e474df
Merged-In: I98e7687ac4055800aa46626c6b1c866e52e474df
(cherry picked from commit
820b4327b1359fb1b389e07fc0f8c5e1304a7bfa)
Jakub Pawlowski [Fri, 22 Jun 2018 11:46:39 +0000 (04:46 -0700)]
SDP: return error on offset bigger than atribute length
Test: none
Bug:
79217770
Change-Id: I8b594882dd07644b1a747c53d6166db466b7e998
(cherry picked from commit
0a74ffa44cbe48f674387cc951e6011c28ca003c)
Hansong Zhang [Thu, 21 Jun 2018 23:53:41 +0000 (16:53 -0700)]
HIDD: Prevent integer underflow in bta_hd_act
Bug:
109757435
Bug:
109757168
Bug:
110846194
Bug:
109757986
Test: manual
Change-Id: I80a6f3f931ac7512f1ba801cc5d8de6ac04f3422
(cherry picked from commit
74a6392875166698b64b624d12b6d2e404b75d72)
Ajay Panicker [Tue, 5 Jun 2018 23:08:06 +0000 (16:08 -0700)]
DO NOT MERGE: Don't reuse buffer when building response
Bug:
79541338
Test: Compile and connect to remote headset
Change-Id: I2d808f941d3c71fcb6306c733717624be10478e0
(cherry picked from commit
9bbce8603846159dec0d506ba867b7616557a303)
Pavlin Radoslavov [Thu, 31 May 2018 18:04:54 +0000 (11:04 -0700)]
Add BT_HDR length check for received AVCTP packets
Bug:
79944113
Test: Code compilation
Change-Id: I02c76ab8fad61669394062bf34656ea32f465b6a
Merged-In: I02c76ab8fad61669394062bf34656ea32f465b6a
(cherry picked from commit
4262b932e487b19d578d79e0120cf03291f44efc)
(cherry picked from commit
fa538540a7f147b8440ac49735a8dc596ce8dfc7)
Pavlin Radoslavov [Thu, 31 May 2018 02:26:16 +0000 (19:26 -0700)]
Add packet length check for received AVCTP packets
Bug:
79944113
Test: Manual: Custom test program and extra logging
Change-Id: Icde465fed723bf876ce3885d11099fddcb92de81
Merged-In: Icde465fed723bf876ce3885d11099fddcb92de81
(cherry picked from commit
2a934acf498a6b715cc7c634123aa403a70fe9e6)
(cherry picked from commit
d6fb21d8d8ae20addfc51246d840151fc86d8572)
Pavlin Radoslavov [Thu, 31 May 2018 00:56:14 +0000 (17:56 -0700)]
Add checks whether the AVDTP element data length is valid
Bug:
78288378
Test: Manual: Python script and extra logging
Change-Id: I715b5977c833d33ff798f008fbf244effa13ea1f
Merged-In: I715b5977c833d33ff798f008fbf244effa13ea1f
(cherry picked from commit
9b3f96f50287d8789aff6d6895d7ae02ca6ac619)
(cherry picked from commit
ee30c88a8d49b30860d35b34a57c3037a4045678)
Jack He [Fri, 1 Jun 2018 21:00:42 +0000 (14:00 -0700)]
BNEP: Fix OOB access in bnep_data_ind
* Stop reading the L2CAP packet if packet length is 0
* Process the buffer for BNEP_EXTENSION_CONTROL packet before advancing
the buffer pointer by length of payload
* Reject BNEP_EXTENSION_CONTROL packet when the payload size is zero
* Move error logging to more appropriate locations at where the OOB access
is most likely triggered
Bug:
78286118
Bug:
79164722
Test: Send zero length L2CAP packet to BNEP, send invalid
BNEP_EXTENSION_CONTROL packet
Merged-In: I7e18632b8faab1b6aaca1bff1b7f55d69962729e
Change-Id: I7e18632b8faab1b6aaca1bff1b7f55d69962729e
(cherry picked from commit
3c799a6e25abdf6bacb660ff7a06338836cc7356)
(cherry picked from commit
0416340ffa61337dbaa2f6602ef85a1c32563ec2)
akirilov [Mon, 21 May 2018 18:45:55 +0000 (11:45 -0700)]
RESTRICT AUTOMERGE: Fixes two bluetooth causing remote overreads (2/2)
Bug:
74075873
Test: manual
Change-Id: I9a7035a74aca3256c5712ea67a7435627b139c37
(cherry picked from commit
9d647b201b64949e04eade9b594af76c764dbb96)
akirilov [Mon, 21 May 2018 19:56:17 +0000 (12:56 -0700)]
RESTRICT AUTOMERGE: Fixes two bluetooth bugs causing remote overreads (1/2)
Bug:
74075873
Test: manual test (poc in bug)
Change-Id: I56e87cfdf8731acca00cefac98abb2ba06f6e7ed
(cherry picked from commit
3575ba8ca36dccf7dcdb2dbf16ed170d549911d3)
Myles Watson [Tue, 29 May 2018 23:55:58 +0000 (16:55 -0700)]
DO NOT MERGE: SDP: Recalculate param_len after max_list_len
Bug:
78136869
Test: manual connection to an A2DP device
Change-Id: I71392cf1a70567fec957feb36768069ac5258aa1
(cherry picked from commit
9cc9eea21c7868034242b7ab8be750c565e46bfd)
Jakub Pawlowski [Tue, 29 May 2018 23:17:32 +0000 (16:17 -0700)]
Decrease length after reading from array in process_service_attr_req
Test: compilation
Bug:
78136677
Change-Id: I4807a350e2b4764a93f104ce88f23a957a7e85c0
(cherry picked from commit
6cd2e8bf6e5707e8e77e7aca6519c58200ee58db)
Hansong Zhang [Wed, 30 May 2018 00:38:39 +0000 (17:38 -0700)]
DO NOT MERGE SMP: Check p_cb->role in smp_br_state_machine_event
Bug:
80145946
Test: manual
Change-Id: Ic83eaa4be868d5a345d80cd50a6915c0af719a53
(cherry picked from commit
519b61392a96fbd45bdcc0bfddc881167c20cc23)
Jakub Pawlowski [Wed, 23 May 2018 17:19:53 +0000 (10:19 -0700)]
GATT: Handle too short Error Response PDU
Since the spec is not clear what to do in this case, use one of
reserved error codes as a failure reason, and pass it to upper layers.
Bug:
79591688
Change-Id: Ie6a53e9c8e4ceb8f1e5a75aee44baa5f4a798c4f
Merged-In: Ie6a53e9c8e4ceb8f1e5a75aee44baa5f4a798c4f
(cherry picked from commit
f63c4b652b3231c2b4907bffd13410c6eb2aa760)
Jakub Pawlowski [Thu, 24 May 2018 15:59:34 +0000 (08:59 -0700)]
Add PDU size checks in process_service_search_attr_rsp
Bug:
79884292
Change-Id: Icc02a6188f806f766aa8676804d74995afa08d25
Merged-In: Icc02a6188f806f766aa8676804d74995afa08d25
(cherry picked from commit
980f6427b183e013958acd6b70e91f58177408a6)
Ajay Panicker [Fri, 13 Apr 2018 00:03:09 +0000 (17:03 -0700)]
Add bounds check to l2cble_process_sig_cmd L2CAP_CMD_DISC_REQ
Bug:
74121659
Test: Compiles
Change-Id: Idf58e7b25b41ae1bd43cdd51de424b18e03cc7e8
(cherry picked from commit
ca4f8a18bce9331360144f1dbc51db1e2525bcc3)
Ajay Panicker [Fri, 11 May 2018 19:03:07 +0000 (12:03 -0700)]
DO NOT MERGE: Check number of attributes before writing to a buffer
Bug:
73824150
Test: Compile
Change-Id: I2a28a503cd74758e707d1e591b55c278d2299f45
(cherry picked from commit
f6db54f071f6974e18b10bb0c2cfcf397cd4c980)
Hansong Zhang [Fri, 11 May 2018 18:36:29 +0000 (11:36 -0700)]
DO NOT MERGE AVRC: Add bound check for AVRC_EVT_APP_SETTING_CHANGE
Test: manual
Bug:
73782082
Change-Id: I4e384a2f8c0d8c4af03bd5865b2e907321419c86
(cherry picked from commit
0061dd6ae30ebcebce695c212c8bc0ceb276710e)
Hansong Zhang [Thu, 26 Apr 2018 22:50:53 +0000 (15:50 -0700)]
DO NOT MERGE Prevent stack overflow in btif_storage
Bug:
73963551
Test: manual
Change-Id: I5f7a583aad150ebf9e3d492181d80ca935c8aa3f
(cherry picked from commit
e8d311224277e9db5dc94cb94929125992f546f3)
Andre Eisenbach [Thu, 1 Mar 2018 21:27:01 +0000 (13:27 -0800)]
DO NOT MERGE SMP: Validate remote elliptic curve points
Fixes:
72377774
Test: net_test_stack_smp (where applicable)
Change-Id: Iefcf97364493467075fadefd77d12716f71cd4f6
(cherry picked from commit
9181ec28da94705a763edbe60bd2a87e5f882beb)
(cherry picked from commit
e11ebfc21963ae905d58c034310efeca0e7cd2ee)
Hansong Zhang [Wed, 11 Apr 2018 23:04:51 +0000 (16:04 -0700)]
DO NOT MERGE Add bounds check for BNEP_Write
Bug:
74947856
Test: manual
Change-Id: If5db8c6b6e509a330ae74808fc3f0ffac137af14
(cherry picked from commit
ae9d06c1dc84db36c0c4a07fc56a1fbf008cd1ce)
Hansong Zhang [Thu, 12 Apr 2018 18:58:49 +0000 (11:58 -0700)]
DO NOT MERGE Initialize local variable in gatts_process_read_by_type_req
Bug:
73125709
Test: manual
Change-Id: I8b3346f605e0820385ea5ed7401bbee664fd15aa
(cherry picked from commit
0e34139d7fa338df6c99aaba13eb839a3dbc2548)
Hansong Zhang [Thu, 12 Apr 2018 22:50:28 +0000 (15:50 -0700)]
DO NOT MERGE Fix OOB read in process_l2cap_cmd
Bug:
74202041
Bug:
74196706
Bug:
74201143
Test: manual
Change-Id: Ic25f7f3777d0375f76cc91e4d129b1636f1c388d
(cherry picked from commit
ff15adf5150527db1012b9f7777066522835e2db)
Myles Watson [Wed, 21 Mar 2018 23:45:32 +0000 (16:45 -0700)]
PAN: Always allocate in bta_pan_data_buf_ind_cback
Change I63b857d031c55d3a0754e4101e330843eb422b2a caused a double
free. Move the free call to pan_data_buf_ind_cb().
Free the buffer before every return in pan_data_buf_ind_cb.
Bug:
74950468
Test: manual tethering test with DUT sharing its connection
Change-Id: If4526f3042699581e2cdde79a362eef0f83768eb
Merged-In: If4526f3042699581e2cdde79a362eef0f83768eb
(cherry picked from commit
98232b084c66368234d19fafe3076bc1c0f1b578)
Stanley Tng [Thu, 5 Apr 2018 16:54:13 +0000 (09:54 -0700)]
DO NOT MERGE Handle bad packet length in gatts_process_read_req
Added error check and handling code in gatts_process_read_req to
make sure that the packet length is correct.
Please note that there is another earlier CL that is reverted and this
is the updated one.
Bug:
73172115
Test: Run the test program, poc, that was attached in the bug report
Merged-In: Ia9b4e502fa8f8384bf9767e68f73b48a0915141b
Change-Id: Ia9b4e502fa8f8384bf9767e68f73b48a0915141b
(cherry picked from commit
cc9c7330d1c3507d745170ae7b2e0546197b7acb)
(cherry picked from commit
16f4c21be5bd0ea1968eee8a0f00648b1e326253)
Stanley Tng [Thu, 29 Mar 2018 00:12:28 +0000 (17:12 -0700)]
DO NOT MERGE Drop LE CoC fragments when frame size is too big
Drop the LE CoC data fragments when the received fragment size is too
big.
Test: Runs LE CoC SL4A test, BleCocTest.
Bug:
75298652
Merged-In: I529944341e9e67a39e7ec7e740d5ada3db8cc23a
Change-Id: I529944341e9e67a39e7ec7e740d5ada3db8cc23a
(cherry picked from commit
8365a2ace5e89d8b81bab468f0f9bc1137d773b4)
(cherry picked from commit
17db92e4fc3c7127c0ace625ff9735a9972eee70)
Hansong Zhang [Mon, 2 Apr 2018 17:05:56 +0000 (10:05 -0700)]
DO NOT MERGE Fix unexpected behavior in bta_dm_sdp_result
Check the number of UUIDs from remote device
Bug:
74016921
Test: manual
Change-Id: I1ca1f66bfc935f5fd219e8147511bdac7d2789ef
(cherry picked from commit
67ec216daa43f71adf103de6c4156c5a892c1460)
Hansong Zhang [Fri, 30 Mar 2018 23:27:37 +0000 (16:27 -0700)]
DO NOT MERGE Fix unexpected behavior in smp_sm_event
Bug:
74121126
Test: manual
Change-Id: Ie5dd841d6461ad057c4ab572007f38c5446aba53
(cherry picked from commit
652798b2f2d6c90e0fc95c00ccfb91e2870b03d4)
android-build-team Robot [Thu, 15 Mar 2018 17:02:36 +0000 (17:02 +0000)]
Snap for
4603989 from
cf98916401833f40c3aa5bf42dee577153ed4816 to oc-m2-release
Change-Id: I1670462ff0d485683973f498f53a9b4facdc4259
android-build-team Robot [Wed, 14 Feb 2018 17:18:27 +0000 (17:18 +0000)]
Merge cherrypicks of [
3614756,
3614757,
3614861,
3614758,
3614759,
3615200,
3615201,
3615202,
3615203,
3615204,
3614670,
3614671,
3615108,
3615109] into oc-mr1-release
Change-Id: Ia5da8d2f00425b1f21c3afcff6eefbed68c12346
Ajay Panicker [Fri, 2 Feb 2018 09:11:37 +0000 (01:11 -0800)]
AVRCP: Check number of text attribute values in response
Test: Build
Bug:
71603410
Change-Id: I6f822b0bc7fc2fb042a70b64cff61583a86b36e2
(cherry picked from commit
4cd518cb3f8ac6ccb43c94a441bee67e041d0dd5)
Ajay Panicker [Fri, 9 Feb 2018 08:21:06 +0000 (00:21 -0800)]
AVRCP: Set maximum string length when copying to buffer
Test: Compile
Bug:
71603262
Change-Id: I2416cdbcc3e4c5d71ab45998c02eb7cf679b1c10
(cherry picked from commit
a3077fa62c2fc1c6be3a3dd1ecda1eb64472f36f)
Ajay Panicker [Fri, 2 Feb 2018 09:26:34 +0000 (01:26 -0800)]
AVRCP: Initialize buffer for attribute values to be written to
Test: Build
Bug:
71603553
Change-Id: I978270605cfaa3b833d6c19f1b1d2cd5a82ac079
(cherry picked from commit
e36d6f8edceed860929901b6c49c1964a1ac563f)
Ajay Panicker [Fri, 2 Feb 2018 08:56:43 +0000 (00:56 -0800)]
AVRCP: Check number of text attributes in response
Test: Build
Bug:
71603315
Change-Id: Ieda5e410057062533ae09bd977bfe7f758a55140
(cherry picked from commit
658fd1b7c4ee959e42c20a2f1cfb7d895f94f6d2)
Hansong Zhang [Fri, 9 Feb 2018 22:16:59 +0000 (14:16 -0800)]
DO NOT MERGE Truncate new line characters when adding string to config
Bug:
70808273
Test: test with a device with newline character in name
Change-Id: I8729e12ad5851ee1ffbcb7c08e9a659f768ffc21
(cherry picked from commit
dd9bbfc2458569d9fecf35f7503d1b89b4c69aa0)
Ajay Panicker [Thu, 11 Jan 2018 00:58:16 +0000 (16:58 -0800)]
AVRCP: Check the number of text value attributes requested
Test: Builds
Bug:
69479009
Change-Id: I184ddfdb56c15c2b07d52a2624240738efb4d207
(cherry picked from commit
6313da35abc93fcfb783c68f2e02427df9928ecf)
android-build-team Robot [Thu, 8 Feb 2018 04:16:34 +0000 (04:16 +0000)]
Merge cherrypicks of [
3581037,
3581038,
3580473,
3580624,
3580656,
3580657,
3580658,
3580382,
3580474,
3580475,
3581039,
3581040,
3580476,
3580206,
3581527,
3580955,
3580956,
3580957,
3580958,
3580959,
3580960,
3580961,
3580962,
3580963,
3580964,
3580965,
3580966,
3581567,
3581568,
3581569,
3581570,
3581571,
3580625,
3580626,
3581587,
3581513,
3581514,
3581515,
3580477,
3581588,
3580659,
3580660,
3580383,
3580384,
3580478,
3580719,
3580479,
3580480,
3581385,
3581528,
3581041,
3581042,
3581043,
3581044,
3581045,
3581046,
3581607,
3580385,
3580481,
3580482,
3580483,
3580661,
3580662,
3580663,
3580664,
3580665,
3580484,
3580485,
3581608,
3581609,
3581610,
3581611,
3581612,
3581589,
3581613,
3580486,
3581519,
3581627,
3581628,
3581529,
3581530,
3581531,
3581629,
3581630] into oc-mr1-release
Change-Id: Idad72f8100382bf89a70f797f55169262d619791
Myles Watson [Fri, 12 Jan 2018 01:43:40 +0000 (17:43 -0800)]
SDP: Check p_req_end before reading from p_req
Bug:
69384124
Test: Connect a headset
Change-Id: Ia30c58ed39977552e5ddc21cc3c1b54c6b1d8abe
Merged-In: Ia30c58ed39977552e5ddc21cc3c1b54c6b1d8abe
(cherry picked from commit
dd856fbc4ade8f7d78873db3533b4c9fd7c6d612)
android-build-team Robot [Thu, 18 Jan 2018 22:44:47 +0000 (22:44 +0000)]
Merge cherrypicks of [
3478238,
3478653,
3478239,
3478580,
3478612,
3478240,
3478654,
3478655,
3478656,
3479494,
3479495,
3478933,
3478934,
3479496,
3479497,
3479498,
3478160,
3478161,
3478162,
3478876,
3478877,
3478878,
3478241,
3478163,
3478164,
3478165,
3478166,
3478167,
3478168,
3478169,
3479990,
3479991,
3479992,
3480010,
3480011,
3480012] into oc-m2-release
Change-Id: Iacfe7684cc7ab1a86df8c2fb5b06beac14378044
Myles Watson [Fri, 12 Jan 2018 04:43:47 +0000 (20:43 -0800)]
SDP: Include the offset in sdp_disc_server_rsp
The commit
SDP: Pass the bounds to process_service_*_rsp
with the change ID
Icf53d4d05f99b5e0a2b3f4d3735b6fbfd62adaa3
omitted the offset when calculating the end of the message.
Bug:
68161546
Test: Connect a headset
Change-Id: I6266b51e3871ed6ce9932161e4ab66de90af4ce6
(cherry picked from commit
1ff9151b7de9cff6aab3919d151542e7244cc0e5)
Merged-In: I6266b51e3871ed6ce9932161e4ab66de90af4ce6
(cherry picked from commit
c379fc0f7a158e7028771bcf9dea19987f771a8e)
Ajay Panicker [Thu, 11 Jan 2018 00:12:50 +0000 (16:12 -0800)]
AVRCP: Check the number of text attributes requested
Test: Build
Bug:
69478941
Change-Id: Ibc456511c8d7339213f08b07d70f5e25be140d68
(cherry picked from commit
249bb665b1020e81547246f5b29ed9040d696388)
Stanley Tng [Wed, 10 Jan 2018 21:13:15 +0000 (13:13 -0800)]
Remove memory reference to invalid mem in error log
Remove the memory reference to an invalid memory inside an error log
message.
Test: Edit code to force the error condition and make sure the new error
log does not crashed.
Bug:
67058064
Merged-In: I55ec6d8b53e5987cd7721e0ae3ffccc11d6638a0
Change-Id: I55ec6d8b53e5987cd7721e0ae3ffccc11d6638a0
(cherry picked from commit
11cd7277a1d0da9013a8381cddbfc096e9adaed6)
(cherry picked from commit
d10bc94f5ec64122382ed73a261c5f4d0a0fa195)
Myles Watson [Thu, 11 Jan 2018 22:20:26 +0000 (14:20 -0800)]
BNEP: Check received frame type
Bug:
68818034
Test: build
Change-Id: I2b9f32b92d72f226361e6a80f20f9c7ee77f6019
(cherry picked from commit
b910734a55fd3babf71b049d5638bf86f81d7c1e)
Myles Watson [Wed, 10 Jan 2018 17:51:28 +0000 (09:51 -0800)]
PAN: Fix Use-after-free in bta_pan_data_buf_ind_cback
Patch from b/
67078939
Test: build
Bug:
67110692
Change-Id: I63b857d031c55d3a0754e4101e330843eb422b2a
(cherry picked from commit
2a18e724b2bf101ea38a5b089de56842107c8369)
Hansong Zhang [Wed, 10 Jan 2018 21:43:25 +0000 (13:43 -0800)]
Fix unexpected behavior in reading BNEP packets
Bug:
67863755
Bug:
69177251
Bug:
69177292
Bug:
69271284
Test: BNEP still works
Change-Id: I41b8bfe5e123a56b8812124178663735f2bf3372
(cherry picked from commit
9844ddac4c0aaf217326c56f2814d145c11eb042)
Hansong Zhang [Wed, 10 Jan 2018 01:16:35 +0000 (17:16 -0800)]
Fix unexpected behavior in SDP
Bug:
68776054
Bug:
68817966
Test: Bluetooth SDP still works
Change-Id: I4eef22679a313b88d7e8ec463b29dbb592c6b5b9
(cherry picked from commit
5d6b1b1316afecebd939f77e3d01ab0a400e68a9)
Pavlin Radoslavov [Fri, 12 Jan 2018 01:28:16 +0000 (17:28 -0800)]
Allocate/free the SDP connection timers only during stack startup/shutdown
This avoids freeing the sdp_conn_timer within the alarm callback itself.
Bug:
67110137
Test: Manual
Change-Id: I775b4b532cd42cf207258c53c6052a167a124627
Merged-In: I775b4b532cd42cf207258c53c6052a167a124627
(cherry picked from commit
ef6a4a0c9d9220a7d909863349d7a0c0b967d54c)
(cherry picked from commit
0dbe21d88e05a43d6882248144e4e9128f4c1928)
Myles Watson [Wed, 10 Jan 2018 22:16:15 +0000 (14:16 -0800)]
SDP: Pass the bounds to process_service_*_rsp
Test: build
Bug:
68161546
Change-Id: Icf53d4d05f99b5e0a2b3f4d3735b6fbfd62adaa3
(cherry picked from commit
3c7bd5a8453110a7bd1351648c5a4001b99afa70)
Pavlin Radoslavov [Mon, 8 Jan 2018 19:37:05 +0000 (11:37 -0800)]
Removed alarm callback execution statistics
Updating the alarm state after the callback returns can be problematic
in case the callback itself deleted the alarm.
Bug:
67110137
Test: Manual
Change-Id: Id4de06eebedb792cadd63d09efb68672e9bddc69
Merged-In: Id4de06eebedb792cadd63d09efb68672e9bddc69
(cherry picked from commit
04574e1cde3b0d46b59b4b6ebab935ac60af9f97)
(cherry picked from commit
90ffe3f90a7589e4ff9e5e8bdf353cdcdfe88764)
android-build-team Robot [Thu, 18 Jan 2018 19:09:18 +0000 (19:09 +0000)]
Merge cherrypicks of [
3478311,
3478390,
3478133,
3478175,
3478391,
3478392,
3478393,
3478134,
3478135,
3478213,
3478214,
3478215,
3478233,
3478234,
3478235,
3478251,
3478252,
3478253,
3478254,
3478394,
3478395,
3478396,
3478397,
3478398,
3478399,
3478400,
3478401,
3478402,
3478403,
3478292,
3478293,
3478312,
3478136,
3477911] into oc-mr1-release
Change-Id: I8aa7841acf92f8acda1bfaada082013a83c8d3de
Myles Watson [Fri, 12 Jan 2018 04:43:47 +0000 (20:43 -0800)]
SDP: Include the offset in sdp_disc_server_rsp
The commit
SDP: Pass the bounds to process_service_*_rsp
with the change ID
Icf53d4d05f99b5e0a2b3f4d3735b6fbfd62adaa3
omitted the offset when calculating the end of the message.
Bug:
68161546
Test: Connect a headset
Change-Id: I6266b51e3871ed6ce9932161e4ab66de90af4ce6
(cherry picked from commit
1ff9151b7de9cff6aab3919d151542e7244cc0e5)
Merged-In: I6266b51e3871ed6ce9932161e4ab66de90af4ce6
(cherry picked from commit
c379fc0f7a158e7028771bcf9dea19987f771a8e)
Ajay Panicker [Thu, 11 Jan 2018 00:12:50 +0000 (16:12 -0800)]
AVRCP: Check the number of text attributes requested
Test: Build
Bug:
69478941
Change-Id: Ibc456511c8d7339213f08b07d70f5e25be140d68
(cherry picked from commit
249bb665b1020e81547246f5b29ed9040d696388)
Stanley Tng [Wed, 10 Jan 2018 21:13:15 +0000 (13:13 -0800)]
Remove memory reference to invalid mem in error log
Remove the memory reference to an invalid memory inside an error log
message.
Test: Edit code to force the error condition and make sure the new error
log does not crashed.
Bug:
67058064
Merged-In: I55ec6d8b53e5987cd7721e0ae3ffccc11d6638a0
Change-Id: I55ec6d8b53e5987cd7721e0ae3ffccc11d6638a0
(cherry picked from commit
11cd7277a1d0da9013a8381cddbfc096e9adaed6)
(cherry picked from commit
d10bc94f5ec64122382ed73a261c5f4d0a0fa195)
Myles Watson [Thu, 11 Jan 2018 22:20:26 +0000 (14:20 -0800)]
BNEP: Check received frame type
Bug:
68818034
Test: build
Change-Id: I2b9f32b92d72f226361e6a80f20f9c7ee77f6019
(cherry picked from commit
b910734a55fd3babf71b049d5638bf86f81d7c1e)
Myles Watson [Wed, 10 Jan 2018 17:51:28 +0000 (09:51 -0800)]
PAN: Fix Use-after-free in bta_pan_data_buf_ind_cback
Patch from b/
67078939
Test: build
Bug:
67110692
Change-Id: I63b857d031c55d3a0754e4101e330843eb422b2a
(cherry picked from commit
2a18e724b2bf101ea38a5b089de56842107c8369)
Hansong Zhang [Wed, 10 Jan 2018 21:43:25 +0000 (13:43 -0800)]
Fix unexpected behavior in reading BNEP packets
Bug:
67863755
Bug:
69177251
Bug:
69177292
Bug:
69271284
Test: BNEP still works
Change-Id: I41b8bfe5e123a56b8812124178663735f2bf3372
(cherry picked from commit
9844ddac4c0aaf217326c56f2814d145c11eb042)
Hansong Zhang [Wed, 10 Jan 2018 01:16:35 +0000 (17:16 -0800)]
Fix unexpected behavior in SDP
Bug:
68776054
Bug:
68817966
Test: Bluetooth SDP still works
Change-Id: I4eef22679a313b88d7e8ec463b29dbb592c6b5b9
(cherry picked from commit
5d6b1b1316afecebd939f77e3d01ab0a400e68a9)
Pavlin Radoslavov [Fri, 12 Jan 2018 01:28:16 +0000 (17:28 -0800)]
Allocate/free the SDP connection timers only during stack startup/shutdown
This avoids freeing the sdp_conn_timer within the alarm callback itself.
Bug:
67110137
Test: Manual
Change-Id: I775b4b532cd42cf207258c53c6052a167a124627
Merged-In: I775b4b532cd42cf207258c53c6052a167a124627
(cherry picked from commit
ef6a4a0c9d9220a7d909863349d7a0c0b967d54c)
(cherry picked from commit
0dbe21d88e05a43d6882248144e4e9128f4c1928)
Myles Watson [Wed, 10 Jan 2018 22:16:15 +0000 (14:16 -0800)]
SDP: Pass the bounds to process_service_*_rsp
Test: build
Bug:
68161546
Change-Id: Icf53d4d05f99b5e0a2b3f4d3735b6fbfd62adaa3
(cherry picked from commit
3c7bd5a8453110a7bd1351648c5a4001b99afa70)
Pavlin Radoslavov [Mon, 8 Jan 2018 19:37:05 +0000 (11:37 -0800)]
Removed alarm callback execution statistics
Updating the alarm state after the callback returns can be problematic
in case the callback itself deleted the alarm.
Bug:
67110137
Test: Manual
Change-Id: Id4de06eebedb792cadd63d09efb68672e9bddc69
Merged-In: Id4de06eebedb792cadd63d09efb68672e9bddc69
(cherry picked from commit
04574e1cde3b0d46b59b4b6ebab935ac60af9f97)
(cherry picked from commit
90ffe3f90a7589e4ff9e5e8bdf353cdcdfe88764)
android-build-team Robot [Wed, 18 Oct 2017 17:04:11 +0000 (17:04 +0000)]
Snap for
4402310 from
ff6208c4121dd6f14da465e3f5f4e0c30cd25d62 to oc-m2-release
Change-Id: Ie5bffa052306472064278a09bfd9d6ea4c850d3a
android-build-team Robot [Sun, 15 Oct 2017 07:26:24 +0000 (07:26 +0000)]
Snap for
4396223 from
aad2686274783a229c8642db5fec4727c3ab292b to oc-mr1-release
Change-Id: I025c64d825a510806bd292a5555aedc594372284
Jakub Pawlowski [Fri, 13 Oct 2017 16:51:06 +0000 (09:51 -0700)]
Fix crash in l2cble_start_conn_update
Bug:
67774334
Test: compilation
Change-Id: I42ec986c6c5f3fe81f507596bf1df05dcf3ec0ba
(cherry picked from
5e8d54e6c26c3bc8ced932bb9c455bbbad57a9db)
android-build-team Robot [Thu, 12 Oct 2017 07:24:01 +0000 (07:24 +0000)]
Snap for
4391495 from
00c4f653cd0b0f4f86361a862d3fe7f00f9bcb8c to oc-mr1-release
Change-Id: Ibde49a2937e4c8dc8b16161c551012d4fa95955e
Scott Bauer [Thu, 12 Oct 2017 00:26:02 +0000 (00:26 +0000)]
Read the correct amount of attributes am:
4d1470eb54 am:
48e5396b99 am:
57f958e7e3 am:
e69e6e0fab am:
1e67cf4b2e am:
930d16464f
am:
4010328f80
Change-Id: Ic069690e99651d756f923f6b276f0de85c2ac2c8
Scott Bauer [Thu, 12 Oct 2017 00:25:25 +0000 (00:25 +0000)]
Read the correct amount of attributes am:
636b754cfa am:
5ec93991d7 am:
6e7c360c85 am:
a51aaf2366
am:
15ce434f4b
Change-Id: Ib890b147a7bd77c4987503d8b62400a5735ad036
Scott Bauer [Thu, 12 Oct 2017 00:25:01 +0000 (00:25 +0000)]
Read the correct amount of attributes am:
8eb6493ad5 -s ours am:
95b2e35d5d
am:
f00207c227
Change-Id: I4128915b2b6e914a7798c9e4fa885cddce4d28a1
Scott Bauer [Thu, 12 Oct 2017 00:24:24 +0000 (00:24 +0000)]
Read the correct amount of attributes am:
4d1470eb54 am:
48e5396b99 am:
57f958e7e3 am:
e69e6e0fab am:
1e67cf4b2e
am:
930d16464f
Change-Id: I99851e43afe1fa26d9efa4eccea583250586dc0d
Scott Bauer [Thu, 12 Oct 2017 00:21:50 +0000 (00:21 +0000)]
Read the correct amount of attributes am:
636b754cfa am:
5ec93991d7 am:
6e7c360c85
am:
a51aaf2366
Change-Id: Ie8dfa4cff72aef91a87b4dbbc5b82f88213994e2
Scott Bauer [Thu, 12 Oct 2017 00:21:26 +0000 (00:21 +0000)]
Read the correct amount of attributes am:
8eb6493ad5 -s ours
am:
95b2e35d5d
Change-Id: I0956d72a77cfd13dd6dca526cad54c402991ab44
Scott Bauer [Thu, 12 Oct 2017 00:20:01 +0000 (00:20 +0000)]
Read the correct amount of attributes am:
4d1470eb54 am:
48e5396b99 am:
57f958e7e3 am:
e69e6e0fab
am:
1e67cf4b2e
Change-Id: Ic0858b82dd5c15b824a74e53817e42e1945d1a7d
Scott Bauer [Thu, 12 Oct 2017 00:19:36 +0000 (00:19 +0000)]
Read the correct amount of attributes am:
636b754cfa am:
5ec93991d7
am:
6e7c360c85
Change-Id: Icb1240a22b2cfc7fa32b3ab23652fa1510b3c590
Scott Bauer [Thu, 12 Oct 2017 00:18:39 +0000 (00:18 +0000)]
Read the correct amount of attributes
am:
8eb6493ad5 -s ours
Change-Id: I73a8ff63af23863be10d8cdd4da73234fcd25e3d
Scott Bauer [Wed, 11 Oct 2017 23:30:54 +0000 (23:30 +0000)]
Merge "Read the correct amount of attributes" into oc-dev am:
83aee7b3ba
am:
c7706eef3e
Change-Id: Icede213590da36c16291cfa0fd001265f2728da4
Scott Bauer [Wed, 11 Oct 2017 23:23:47 +0000 (23:23 +0000)]
Merge "Read the correct amount of attributes" into oc-dev
am:
83aee7b3ba
Change-Id: I633e4d7fbcb48387ca092e5e19a6f5c0ba015072
TreeHugger Robot [Wed, 11 Oct 2017 23:11:13 +0000 (23:11 +0000)]
Merge "Read the correct amount of attributes" into oc-dev
Scott Bauer [Wed, 11 Oct 2017 22:38:19 +0000 (22:38 +0000)]
Read the correct amount of attributes am:
4d1470eb54 am:
48e5396b99 am:
57f958e7e3
am:
e69e6e0fab
Change-Id: I4a4802e3bf181f09d8de652d991cc26686e467e4
Scott Bauer [Wed, 11 Oct 2017 22:37:12 +0000 (22:37 +0000)]
Read the correct amount of attributes am:
636b754cfa
am:
5ec93991d7
Change-Id: I69bd3d4e294765feade3840d9f1710cfa1cdc69b
Scott Bauer [Wed, 11 Oct 2017 22:34:23 +0000 (22:34 +0000)]
Read the correct amount of attributes am:
4d1470eb54 am:
48e5396b99
am:
57f958e7e3
Change-Id: I3a664ecfa9eebde0459f299fa3a26c70c528e3b8
Scott Bauer [Wed, 11 Oct 2017 22:33:55 +0000 (22:33 +0000)]
Read the correct amount of attributes
am:
636b754cfa
Change-Id: I43948bbb53b3075e7e7b016b9127f38245a8f9da
Scott Bauer [Wed, 11 Oct 2017 22:28:54 +0000 (22:28 +0000)]
Read the correct amount of attributes am:
4d1470eb54
am:
48e5396b99
Change-Id: I93404b4895d4609e9f0afbc9d020cfae20f4f820
Scott Bauer [Wed, 11 Oct 2017 22:26:14 +0000 (22:26 +0000)]
Read the correct amount of attributes
am:
4d1470eb54
Change-Id: I153a91a1aba1a78837c397d4ee01bea2d1696e4e
Myles Watson [Fri, 6 Oct 2017 18:22:51 +0000 (11:22 -0700)]
HCI: Restart 5 seconds after an HCI timeout
Bug:
67209266
Test: build
Change-Id: I69a4a17382742327268a80dbc5c5be49059ecb3c
(cherry picked from commit
d48d32d04ae9f4d81012f2146f8e746c4a05a0f9)
Merged-In: I69a4a17382742327268a80dbc5c5be49059ecb3c
android-build-team Robot [Mon, 9 Oct 2017 19:06:32 +0000 (19:06 +0000)]
Snap for
4384531 from
b9d1b4f15aa09e5f80b1a3f358da9e5a153d7ca1 to oc-m2-release
Change-Id: I4b024638c39b688addb453f3c53c1b2551ab7b86
android-build-team Robot [Fri, 6 Oct 2017 07:21:45 +0000 (07:21 +0000)]
Snap for
4380782 from
1a2ea0fb6b430074e90bf957b0c3c8e00c77004a to oc-mr1-release
Change-Id: I7290b613682720610124ac524226614be6c02af8
Jack He [Mon, 2 Oct 2017 21:07:33 +0000 (14:07 -0700)]
A2DP: Advance btif profile queue on OPENING->other_state transition
* Entering BTIF_AV_STATE_OPENING is only possible through
BTIF_AV_CONNECT_REQ_EVT (initiated by us) OR
BTA_AV_PENDING_EVT (initiated by remote)
from BTIF_AV_STATE_IDLE
* If we go from BTIF_AV_CONNECT_REQ_EVT, we must have a pending
connection request in btif_profile_queue that should be advanced when
we quit BTIF_AV_STATE_OPENING state
* This CL adds a flag to indicate whether an AV connection is initiated
by us and only advance queue when it is
* Also add queue advancement in BTA_AV_REJECT_EVT and BTA_AV_CLOSE_EVT
Bug:
67317954
Test: make
Change-Id: I16dc8ebf76c6edaacb1f7a4a44e604170ff9a8b0
(cherry picked from commit
a3626477587e99347dcf966087497e9a1c4732a4)
c_sdamga [Mon, 20 Jul 2015 13:47:04 +0000 (19:17 +0530)]
Handle Disconnect request in AV Opening State handler
Usecase:
1. Uncheck media from settings UI
2. initiate A2dp connection from remote, send AVRCP play from remote
Failure:
A2dp connection stuck in opening state.
Rootcause:
When A2dp is unchecked from settings UI and remote initiated
a2dp connection and AVRCP play, music starts streaming on DUT
since A2dp connection disconnected. As A2dp connection was not
completed, btif state stuck in opening state.
Fix:
Handled the disconnection request in the opening state
so that AV state machine moves to proper state before
processing AVRCP Play.
Test: 1. Uncheck media from settings UI
2. initiate A2dp connection from remote, send AVRCP play
Bug:
35415160
Change-Id: If1cda5b78100419fdc60c97349efafdd4a18d40c
(cherry picked from commit
ff1b9d26ca9a5a25d45bab09df1c0346104051a9)
android-build-team Robot [Thu, 5 Oct 2017 07:27:10 +0000 (07:27 +0000)]
Snap for
4378450 from
5f984c9fa3d58ccbbb3a2431f8c476b23eba1fca to oc-mr1-release
Change-Id: I47b2e8bb61812659d1ea36957abf2a718cf14e9b
Subramanian Srinivasan [Fri, 29 Sep 2017 01:41:03 +0000 (18:41 -0700)]
Fix adv instance validity check during suspend and resume of resolving list
When BT is shutdown, multi advertisement instance pointer is made
null by BleAdvertisingManager::CleanUp function.
Any subsequent BleAdvertisingManager::Get function call made at
this point(eg during suspension and resumption of resolving list
activity)leads to a crash as the instance pointer is null.
Hence, use BleAdvertisingManager::IsInitialized function instead
of BleAdvertisingManager::Get function to check the validity of
multi advertisement instance.
Bug:
67325491
Change-Id: Ibbae7fa546bb52494be78eaff6d4b7b15614ab15
TreeHugger Robot [Wed, 4 Oct 2017 23:21:12 +0000 (23:21 +0000)]
Merge "Added extra A2DP logging when there is an error" into oc-mr1-dev
Pavlin Radoslavov [Wed, 4 Oct 2017 12:36:25 +0000 (05:36 -0700)]
Added extra A2DP logging when there is an error
Bug:
64159791
Test: Manual
Change-Id: Ic1001892b7abc9784a21a183d141df51b1b92fc0
Pavlin Radoslavov [Wed, 4 Oct 2017 18:26:04 +0000 (11:26 -0700)]
Decrese the default verbosity for A2DP codec info logs
Bug:
64159791
Test: Manual
Change-Id: Ida10f5d2aa6643df136a41891d7775e175c06570
android-build-team Robot [Wed, 4 Oct 2017 07:26:25 +0000 (07:26 +0000)]
Snap for
4376088 from
bd8505b73ee2a86c64ea7a25f59611259efeb05b to oc-mr1-release
Change-Id: Ibc175b5417c3bbd074c79ef7341dbba5d4e2d5bb
Pavlin Radoslavov [Fri, 29 Sep 2017 01:11:06 +0000 (18:11 -0700)]
Remove casts to (tBTA_GATTC*) unions to avoid unaligned accesses
Bug:
65381426
Test: unit tests
Change-Id: I37e89ec7187ab1c61be4c736385a9fc5ec88d737
(cherry picked from commit
b147c652e90c60daa7113933c48a465491707213)
Pavlin Radoslavov [Tue, 3 Oct 2017 14:28:01 +0000 (14:28 +0000)]
Fixed the implementation of std::equal_to<bt_bdaddr_t> am:
181144a501
am:
eb9ba99523 -s ours
Change-Id: Ib581c7f9b6474c68956de8a41efadff9f8572545
android-build-team Robot [Tue, 3 Oct 2017 07:26:42 +0000 (07:26 +0000)]
Snap for
4373604 from
8e89469b5e223a48e1915f16862e81a3f4581259 to oc-mr1-release
Change-Id: I6676010766f362dd3512533f650f75be0e2519d5
OSDN Git Service
