OSDN Git Service
Cheney Ni [Sat, 11 Apr 2020 21:19:31 +0000 (05:19 +0800)]
A2DP: Fix integer sanitizer in SBC encoder
There were three potential integer overflow within SBC software encoder:
* embdrv/sbc/encoder/srce/sbc_packing.c:144:38: runtime error: unsigned
integer overflow:
4294967231 + 8192 cannot be represented in type
'unsigned int'
* embdrv/sbc/encoder/srce/sbc_packing.c:147:9: runtime error: signed
integer overflow: 37932 * 65535 cannot be represented in type 'int'
* embdrv/sbc/encoder/srce/sbc_packing.c:147:9: runtime error: signed
integer overflow:
178177545 +
2146959360 cannot be represented in type
'int'
They were caught by the integer sanitizer, and
1. (*ps32SbPtr >> 2) is either greater than 0xFF00,0000 or less than
0x007F,FFFF, so just cast to a signed integer explicitly.
2. Positive integer between 0x8000,0000 ~ 0xFFFF,FFFF can't be
represented in type 'int', but is still feasible in 32-bits.
3. s32OutLow is the lower byte of a 64 bits integer, but can't have the
carry values which is only for the higher byte.
This change gives the compiler a signed 64-bits variable, and trusts it
to do better optimization at multiplication.
Bug:
153402404
Test: make sure there are no integer sanitization errors.
Change-Id: I5046a42f9927c1aa7c25da2828c4f921ba7a5021
Merged-In: I5046a42f9927c1aa7c25da2828c4f921ba7a5021
(cherry picked from commit
a42db783434da238e4daade95ce2adb1bca0f138)
Chris Manton [Tue, 10 Mar 2020 15:59:02 +0000 (08:59 -0700)]
DO NOT MERGE Check a2dp packet length is zero
already in master
Bug:
142546668
Test: net_test_stack_a2dp_native
Change-Id: I105b445293c02cb4f37c759fd5b05758fd4e3646
Merged-In: I105b445293c02cb4f37c759fd5b05758fd4e3646
(cherry picked from commit
96392b0f2cfb2adc72cc7cad0d74dec8f4041582)
Jiyong Park [Fri, 17 Apr 2020 03:55:59 +0000 (03:55 +0000)]
Revert "Mark updatable APEXes"
This reverts commit
f3d123910b4c899b3aed8d82272fa5d24b6dc426.
Reason for revert: the BT apex is not yet updatable
Bug:
149805758
Test: m
Change-Id: I92cf6ac12f989726a797fec6a0c0f121346c188e
Joseph Pirozzo [Tue, 14 Apr 2020 22:58:56 +0000 (22:58 +0000)]
Merge "Fix potential OOB vulnerability when SBC framedata is prefetched" into rvc-dev
Sal Savage [Tue, 14 Apr 2020 19:22:21 +0000 (19:22 +0000)]
Merge "AVCRP Controller support Get Item Attributes" into rvc-dev
Cheney Ni [Wed, 19 Feb 2020 09:41:59 +0000 (17:41 +0800)]
A2DP: Wait for previous AVDTP instance to be clean up before re-enabling
Because more connections spend more time to disconnect, the stack may
still be busy at disabling AVDTP, if we re-enable the A2dpService
quickly. This change will defer BTA_AV_API_ENABLE and BTA_AV_API_REG
events if the stack is still disabling the previous instance, so gives
the stack half more seconds to handle its previous task.
Bug:
135655859
Test: manually
Change-Id: I8e700ce195aa634819ea1ad8cf5892cc35669e10
Merged-In: I8e700ce195aa634819ea1ad8cf5892cc35669e10
(cherry picked from commit
21fe257db23887b3000a6c8d38ee339fcccbdc2b)
Cheney Ni [Wed, 18 Mar 2020 08:37:29 +0000 (16:37 +0800)]
A2DP: Workaround to clean up previous AVDTP instance while re-enabling
If the user disables and re-enables A2dpService quickly, the stack has
chances to be still busy at dropping those out-of-date links, and this
is highly dependent on the handset. If the handset responds more slowly, it
spends more time to disable, but causes the new AVDTP instance won't
work. This change checks the previous disabling flag, and cleans up the
old instance up before re-enabling.
Bug:
135655859
Test: manually
Change-Id: I625cfffab6d4df327fb8159aa4b759a09d90e076
Merged-In: I625cfffab6d4df327fb8159aa4b759a09d90e076
(cherry picked from commit
07689d65f4c6fbc8b20dd0890657936fc6d6cb7b)
Cheney Ni [Fri, 27 Mar 2020 03:54:28 +0000 (11:54 +0800)]
A2DP: Be more careful in allocating a BtifAvPeer instance
While a new peer is coming either by in-coming or out-going connection,
the stack first tries to find or create an associated BtifAvPeer object
for it, but uses an unknown BTA handle if BTA_AV is still registering.
This handle will be updated after BTA_AV registered, but causes
a mismatch in the handle usage between BTIF and BTA layers since the
register process just finished. This change disallows to use an unknown
BTA handle, so it prevents such abnormal cases. Besides, it adds more
log messages about BTA_AV registering, and also makes sure the disabling
flag won't be activated after disabled.
Bug:
135655859
Bug:
152597903
Test: Switch BT state quickly between STATE_BLE_ON and STATE_ON
Change-Id: I9df3d64f301dffbecdeaf3de18dd455be1c63ce2
Merged-In: I9df3d64f301dffbecdeaf3de18dd455be1c63ce2
(cherry picked from commit
714e639cb7291ecfb9feb12acad9bc7c8f455ba0)
Sal Savage [Tue, 3 Mar 2020 22:43:06 +0000 (14:43 -0800)]
AVCRP Controller support Get Item Attributes
Add support for the GetItemAttributes command when the browsing chanel
is connected.
Bug:
149411071
Test: Play a song from a paired phone compare metadata and HCI logs.
Change-Id: I0ac3c3bb7c9d1c3c72f0e2bad13d276c836ecf6f
Merged-In: I0ac3c3bb7c9d1c3c72f0e2bad13d276c836ecf6f
Joseph Pirozzo [Tue, 31 Mar 2020 20:57:21 +0000 (13:57 -0700)]
Fix potential OOB vulnerability when SBC framedata is prefetched
Macros were filling a value buffer when reading bit stream data in
advance of any fetch being called, updated to only fetch data into
buffer when needed.
Bug:
110107252
Bug:
146032016
Bug:
146398979
Test: sbcdecoder_fuzzer
Change-Id: Ibb7793c9a015eaddcc8faa6ccfd8ec998d03ed86
Sterling Huber [Thu, 9 Apr 2020 17:39:35 +0000 (17:39 +0000)]
[automerger skipped] Merge "Check a2dp packet length is zero" into qt-dev am:
c909de62bf -s ours am:
db1917d8ae
Change-Id: Id1c8c3155d96ee1e050dd1d308ebeca838a22c8e
Sterling Huber [Thu, 9 Apr 2020 17:17:37 +0000 (17:17 +0000)]
[automerger skipped] Merge "Check a2dp packet length is zero" into qt-dev am:
c909de62bf -s ours
am skip reason: skipped by user cmanton
Change-Id: I8ff4f933b88c68473b378d0894b89ae8b10431fd
TreeHugger Robot [Wed, 8 Apr 2020 17:00:45 +0000 (17:00 +0000)]
Merge "btm: fixing oob write in multi-adv SetData." into qt-qpr1-dev am:
aeeb427c94
Change-Id: Ibb621c8984997088b6ec96cc61fc65733e73c673
TreeHugger Robot [Wed, 8 Apr 2020 16:40:55 +0000 (16:40 +0000)]
Merge "btm: fixing oob write in multi-adv SetData." into qt-qpr1-dev
Sterling Huber [Wed, 8 Apr 2020 00:13:33 +0000 (00:13 +0000)]
Merge "Check a2dp packet length is zero" into qt-dev
Jakub Pawlowski [Wed, 8 Apr 2020 00:10:53 +0000 (00:10 +0000)]
[automerger skipped] Fix potential stack overflow caused by integer overflow am:
1570b62c88 am:
5b4bf745e9 am:
6360e91bb3 am:
3cd74938d8 -s ours am:
db0c360dce -s ours am:
ca7a1eabe0 -s ours
am skip reason: Change-Id I0655b0b62301f78cd8705cc7b0e4fc11522f00ca with SHA-1
ec0d507ed2 is in history
Change-Id: Id31d6d296c0c76921d0b581362e7e1e0a75f7f48
Jakub Pawlowski [Tue, 7 Apr 2020 23:50:35 +0000 (23:50 +0000)]
[automerger skipped] Fix potential stack overflow caused by integer overflow am:
1570b62c88 am:
5b4bf745e9 am:
6360e91bb3 am:
3cd74938d8 -s ours am:
db0c360dce -s ours
am skip reason: Change-Id I0655b0b62301f78cd8705cc7b0e4fc11522f00ca with SHA-1
ec0d507ed2 is in history
Change-Id: I2748027eb3a50e6ed5130be43861fa69d794bee8
Jakub Pawlowski [Tue, 7 Apr 2020 23:38:36 +0000 (23:38 +0000)]
[automerger skipped] Fix potential stack overflow caused by integer overflow am:
1570b62c88 am:
5b4bf745e9 am:
6360e91bb3 am:
3cd74938d8 -s ours
am skip reason: Change-Id I0655b0b62301f78cd8705cc7b0e4fc11522f00ca with SHA-1
ec0d507ed2 is in history
Change-Id: Ife4a1d737088dbf51ac29f0a6411d9468b456593
Jakub Pawlowski [Tue, 7 Apr 2020 23:24:21 +0000 (23:24 +0000)]
Fix potential stack overflow caused by integer overflow am:
1570b62c88 am:
5b4bf745e9 am:
6360e91bb3
Change-Id: I1e23e75fd05e41b9cd31bb93b945135bef21c04f
Jakub Pawlowski [Tue, 7 Apr 2020 23:09:11 +0000 (23:09 +0000)]
Fix potential stack overflow caused by integer overflow am:
1570b62c88 am:
5b4bf745e9
Change-Id: I91417fff40a89042993a9fcbfaa6b7f45c162d89
Jakub Pawlowski [Tue, 7 Apr 2020 22:51:21 +0000 (22:51 +0000)]
Fix potential stack overflow caused by integer overflow am:
1570b62c88
Change-Id: Iaf75d5b63297d50e3115422f15fa8511133ef45a
Jakub Pawlowski [Tue, 7 Apr 2020 22:43:47 +0000 (22:43 +0000)]
[automerger skipped] Fix potential stack overflow caused by integer overflow am:
ec0d507ed2 am:
8ccc0c8d5f -s ours
am skip reason: Change-Id I0655b0b62301f78cd8705cc7b0e4fc11522f00ca with SHA-1
4c0c93eb61 is in history
Change-Id: I2d54dc3becde918d809bfc2f970bc192bb562b1b
Jakub Pawlowski [Tue, 7 Apr 2020 22:31:00 +0000 (22:31 +0000)]
Fix potential stack overflow caused by integer overflow am:
ec0d507ed2
Change-Id: Ia8ae7d5d144e3a5e94728dc236d9e7af6ddd3dd2
Chris Manton [Tue, 10 Mar 2020 15:59:02 +0000 (08:59 -0700)]
Check a2dp packet length is zero
Bug:
142546668
Test: net_test_stack_a2dp_native
Change-Id: I105b445293c02cb4f37c759fd5b05758fd4e3646
Merged-In: I105b445293c02cb4f37c759fd5b05758fd4e3646
Joseph Pirozzo [Tue, 7 Apr 2020 19:32:41 +0000 (19:32 +0000)]
Merge "Remove BTA_HF_CLIENT_SCO_LISTEN_E fallthrough" into rvc-dev
Jakub Pawlowski [Mon, 16 Mar 2020 11:09:15 +0000 (12:09 +0100)]
Fix potential stack overflow caused by integer overflow
Bug:
151155194
Change-Id: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Joseph Pirozzo [Tue, 7 Apr 2020 16:00:03 +0000 (09:00 -0700)]
Remove BTA_HF_CLIENT_SCO_LISTEN_E fallthrough
Remove unintended fallthrough.
Bug:
143901894
Test: connect SCO from both HF and AG.
Change-Id: Ifa5363479d4c844ed0b6a8585c25147b23156599
Merged-In: Ifa5363479d4c844ed0b6a8585c25147b23156599
TreeHugger Robot [Mon, 6 Apr 2020 14:49:41 +0000 (14:49 +0000)]
Merge "A2DP: Do the connection task in the stack main thread" into rvc-dev
Jooyung Han [Sun, 5 Apr 2020 00:14:36 +0000 (00:14 +0000)]
Merge "Add min_sdk_version:R to updatable apexes" into rvc-dev
TreeHugger Robot [Fri, 3 Apr 2020 19:22:52 +0000 (19:22 +0000)]
Merge "BluetoothMetrics: Add SDP DI manufacturers info to Bluetooth config; Add SDP ID info and LMP info to Bluetooth log" into rvc-dev
Cheney Ni [Tue, 31 Mar 2020 10:38:49 +0000 (18:38 +0800)]
A2DP: Do the connection task in the stack main thread
There is a profile queue to handle connection tasks sequentially, and
invokes the connect API in JNI thread while the previous task finishes.
However, since BtifAvStateMachine is running in the stack main thread,
it brings a race condition about the BtifAVPeer object between the JNI
and stack main threads. This change does A2DP connection task in the
main thread, so has no such race conditions.
Bug:
152595833
Test: make sure the opening event is in main thread manually
Change-Id: Ib40dc7c5fa3e839a894d6f7947ac8266eacd2022
Merged-In: Ib40dc7c5fa3e839a894d6f7947ac8266eacd2022
(cherry picked from commit
367c497abbc0ff5551a1b3210db35ad6540e2dfe)
Rahul Sabnis [Fri, 3 Apr 2020 00:02:36 +0000 (17:02 -0700)]
Add rahulsabnis@ as an owner of bluetooth code to allow for owner
code reviews
Bug:
153115116
Test: Manual
Merged-In: I8153358384bbf18102f84f544551d358d95b45e7
Change-Id: I8153358384bbf18102f84f544551d358d95b45e7
Chen Chen [Wed, 1 Apr 2020 02:12:39 +0000 (19:12 -0700)]
BluetoothMetrics: Add SDP DI manufacturers info to Bluetooth config;
Add SDP ID info and LMP info to Bluetooth log
Bug:
142563377
Test: manually check Bluetooth config file
Change-Id: I4a7c348ac570a730cccc31e51bdc9669847f96a5
Jooyung Han [Mon, 30 Mar 2020 04:27:34 +0000 (13:27 +0900)]
Add min_sdk_version:R to updatable apexes
APEXes introduced in R need to set min_sdk_version to ensure that they
are built against correct version(30 or R) of stubs (libc/liblog/...).
Bug:
152655956
Test: /vendor/google/build/build_mainline_modules.sh
Change-Id: I055f46f574c7349f46b8c1cb6bb39a515ae69967
Ugo Yu [Tue, 31 Mar 2020 04:41:43 +0000 (04:41 +0000)]
Merge "Replacing updateBleAppCount to enableBle and disableBle" into rvc-dev
TreeHugger Robot [Mon, 30 Mar 2020 14:17:34 +0000 (14:17 +0000)]
Merge "Retry service discovery for Avrcp if due to sdp connection failed" into rvc-dev
Ugo Yu [Tue, 17 Mar 2020 11:52:41 +0000 (19:52 +0800)]
Replacing updateBleAppCount to enableBle and disableBle
Bug:
139454316
Test: enableBle() -> disableBle() and check Bluetooth is OFF.
Change-Id: Ifa0b26af7b5c1eef65658948cffe6e409a787344
Chen Chen [Sat, 28 Mar 2020 00:54:26 +0000 (00:54 +0000)]
Merge "Bluetooth Metric Id: Add metric id allocation to Bluetooth metric calls" into rvc-dev
TreeHugger Robot [Fri, 27 Mar 2020 21:06:22 +0000 (21:06 +0000)]
Merge "BluetoothAudioHAL: Have full initialization for audio hardware objects" into rvc-dev
weichinweng [Thu, 12 Mar 2020 06:47:27 +0000 (14:47 +0800)]
HFP: Cleanup bt_hf_callbacks on the jni thread.
For the race condition, the bt_hf_callbacks will be set null on main
thread when doing btif_hf_upstreams_evt on jni thread. Then it will
trigger crash due to btif_hf_upstreams_evt calling a null point.
The patch is cleanup bt_hf_callbacks on the jni thread to avoid the race
condition.
Bug:
140781191
Test: manual, unit test, auto script stress test.
Change-Id: I67400749120aebe13fa3e791f624c8e595d63379
Merged-In: I67400749120aebe13fa3e791f624c8e595d63379
Chris Manton [Fri, 27 Mar 2020 00:49:20 +0000 (00:49 +0000)]
[automerger skipped] Merge "DO NOT MERGE Fix potential overflow in btif_rc" into qt-qpr1-dev am:
6a91b4d117 -s ours
am skip reason: subject contains skip directive
Change-Id: Ieff23e6c5693306d2c8b9402ed7788808f812ac3
Chris Manton [Fri, 27 Mar 2020 00:36:19 +0000 (00:36 +0000)]
Merge "DO NOT MERGE Fix potential overflow in btif_rc" into qt-qpr1-dev
TreeHugger Robot [Thu, 26 Mar 2020 21:58:22 +0000 (21:58 +0000)]
Merge "Fix potential OOB vulnerability when an HCI event is received" into qt-qpr1-dev am:
ee0e886a89
Change-Id: I18a2a32e6f34602f76d3e018a29e9bd24694c7c5
Kelly Rossmoyer [Thu, 26 Mar 2020 21:58:08 +0000 (21:58 +0000)]
[automerger skipped] Revert "DO NOT MERGE Ensure hci command status event has sufficient packet length" am:
006e8e481c -s ours
am skip reason: subject contains skip directive
Change-Id: Idb50aa70e42f832df92cdaaaf705a6cec38f67dd
TreeHugger Robot [Thu, 26 Mar 2020 21:45:36 +0000 (21:45 +0000)]
Merge "Fix potential OOB vulnerability when an HCI event is received" into qt-qpr1-dev
Chris Manton [Wed, 4 Mar 2020 04:04:51 +0000 (20:04 -0800)]
DO NOT MERGE Fix potential overflow in btif_rc
Bug:
142878416
Test: net_test_btif_rc
Change-Id: Ia263bd5c863644f2adde759a103d79b812a9a5de
(cherry picked from commit
e5dd9c735a30188286c7c9b88c247e4f629bdd54)
Kelly Rossmoyer [Thu, 26 Mar 2020 20:57:42 +0000 (20:57 +0000)]
Revert "DO NOT MERGE Ensure hci command status event has sufficient packet length"
This reverts commit
179e1ee138a8811deffd49eae77f85246e5092a9.
Reason for revert: build breakage (b/
152543627)
Change-Id: I437c99613732a5feb4ecbd082598f2efa5853c1e
TreeHugger Robot [Thu, 26 Mar 2020 19:43:52 +0000 (19:43 +0000)]
[automerger skipped] Merge "DO NOT MERGE Ensure hci command status event has sufficient packet length" into qt-qpr1-dev am:
466138189c -s ours
am skip reason: subject contains skip directive
Change-Id: I3e56d0584e861ec214834a7568cf48c8b2d65f19
TreeHugger Robot [Thu, 26 Mar 2020 19:27:55 +0000 (19:27 +0000)]
Merge "DO NOT MERGE Ensure hci command status event has sufficient packet length" into qt-qpr1-dev
Ted Wang [Tue, 17 Mar 2020 12:35:02 +0000 (20:35 +0800)]
Retry service discovery for Avrcp if due to sdp connection failed
Some remote devices are not allow multiple l2cap connection with same
psm, so service discovery for Avrcp might failed due to this reason,
causing absolute volume not enable on this device.
Retry one time if the reason of service discovery fail reason is sdp
connection failed.
Bug:
150354122
Test: Manually Test
Merged-In: I3bb511434788211950884f72ff0a1256533aaa05
Change-Id: I3bb511434788211950884f72ff0a1256533aaa05
Cheney Ni [Wed, 25 Mar 2020 10:37:33 +0000 (18:37 +0800)]
BluetoothAudioHAL: Have full initialization for audio hardware objects
Audio frameworks usually check whether a module has specific features by
particular function pointers, and must be null if unsupported. If a
module is not fully initialized, some pointers would be undefined, but
causes abnormal crashes when accessed by audio frameworks.
Bug:
152379666
Test: manually
Change-Id: Id6a79b651f2acbd35bd509ba36a80adea5c13e05
Merged-In: Id6a79b651f2acbd35bd509ba36a80adea5c13e05
(cherry picked from commit
7397c51ac706d3577b277d7b5bcdc78c78fcc6ac)
Cheney Ni [Mon, 23 Mar 2020 14:40:39 +0000 (22:40 +0800)]
A2DP: Remember every peer's AVDTP delay reporting
Almost every headset has its own delay reporting. This change remembers
those particular values individually, and applies when the peer is the
active device.
Bug:
152276107
Test: manually
Change-Id: I634dfd18a034fe4020f48139d7e0f14a1309098a
Merged-In: I634dfd18a034fe4020f48139d7e0f14a1309098a
(cherry picked from commit
0bf47fa2cf71188728aac2d232e2f02e8661d92c)
Chen Chen [Tue, 24 Mar 2020 21:52:52 +0000 (14:52 -0700)]
BluetoothMetrics: Return true if SaveDevice is called twice. Add more
logging
Test: atest BluetoothMetricIdAllocatorTest
Bug:
152251473
Change-Id: I3d5ee8d086a4e589e84a766d3d0923d3ae2278ba
TreeHugger Robot [Mon, 23 Mar 2020 05:53:51 +0000 (05:53 +0000)]
[automerger skipped] Merge "AVDTP: Prevent OOB read when parsing rejected response" into qt-qpr1-dev am:
f021675ca6 -s ours
am skip reason: Change-Id Iddb887c79bd8a2caa2ae5f21af15219807f9dd63 with SHA-1
c49665a9f9 is in history
Change-Id: I68f5adcc7dc7f005c3d484ae68472635cbda02b1
TreeHugger Robot [Mon, 23 Mar 2020 05:36:25 +0000 (05:36 +0000)]
Merge "AVDTP: Prevent OOB read when parsing rejected response" into qt-qpr1-dev
Rahul Sabnis [Fri, 20 Mar 2020 02:40:40 +0000 (19:40 -0700)]
Re-add binder method for getPriority in IBluetoothA2dp.aidl as well as
getPriority and setPriority in IBluetoothHeadset.aidl
Bug:
148689314
Test: Manual
Change-Id: Id9efe237b24dbf24e91491826d34f61cbb761991
Chen Chen [Sat, 14 Mar 2020 00:00:24 +0000 (17:00 -0700)]
Bluetooth Metrics: Init and Close MetricIdAllocator and use its APIs
Test: Manually pair device and cat config file
Bug:
142563377
Change-Id: I4492dc9b4c9d810e7919e97ef36ea151b76b2dbc
Merged-In: I4492dc9b4c9d810e7919e97ef36ea151b76b2dbc
(cherry picked from commit
f6a356ead8e711e3b94e0e915a5b94cfac978ffa)
Joseph Pirozzo [Fri, 20 Mar 2020 17:28:47 +0000 (17:28 +0000)]
[automerger skipped] Merge changes I685873b0,Iac3078fa into qt-qpr1-dev am:
2c4f9ef514 -s ours
am skip reason: Change-Id I685873b0c4c74ddb4e273e2a38307ec2af0bbd13 with SHA-1
daa34793f2 is in history
Change-Id: Ia10cdd7d6309e64bae3d59de1a77620eccb6d86e
Joseph Pirozzo [Fri, 20 Mar 2020 17:19:37 +0000 (17:19 +0000)]
Merge changes I685873b0,Iac3078fa into qt-qpr1-dev
* changes:
HF_Client: Send BTA_HF_CLIENT_RFC_CLOSE_EVT when client_cb == NULL
HF_Client: Free the RFC if the handle doesn't match
Jakub Pawlowski [Fri, 20 Mar 2020 14:24:00 +0000 (15:24 +0100)]
Fix potential stack overflow caused by integer overflow
Bug:
151155194
Merged-In: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Change-Id: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Jakub Pawlowski [Mon, 16 Mar 2020 11:09:15 +0000 (12:09 +0100)]
Fix potential stack overflow caused by integer overflow
Bug:
151155194
Merged-In: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
Change-Id: I0655b0b62301f78cd8705cc7b0e4fc11522f00ca
TreeHugger Robot [Fri, 20 Mar 2020 03:44:15 +0000 (03:44 +0000)]
[automerger skipped] Merge "Fix bluetooth can't turn off during network reset (3/3)" into qt-qpr1-dev am:
60af186b8e -s ours
am skip reason: Change-Id Ic36ffd63c376f84e3c9f0388820da86f63465c8f with SHA-1
9adf47f6c8 is in history
Change-Id: I20a62a958b5d6ce65712af48eb31fe7d0bf489c3
TreeHugger Robot [Fri, 20 Mar 2020 03:43:16 +0000 (03:43 +0000)]
Merge "avrc: Validating msg size before accessing fields" into qt-qpr1-dev am:
49437a62bd
Change-Id: I6ff012808218c6026584d4dc9217b99d8c6a3169
TreeHugger Robot [Fri, 20 Mar 2020 03:33:52 +0000 (03:33 +0000)]
Merge "Fix bluetooth can't turn off during network reset (3/3)" into qt-qpr1-dev
TreeHugger Robot [Fri, 20 Mar 2020 03:29:10 +0000 (03:29 +0000)]
Merge "avrc: Validating msg size before accessing fields" into qt-qpr1-dev
TreeHugger Robot [Fri, 20 Mar 2020 03:03:23 +0000 (03:03 +0000)]
Merge "Fix potential OOB vulnerability when an HCI event is received" into rvc-dev
Joseph Pirozzo [Thu, 19 Mar 2020 18:06:19 +0000 (18:06 +0000)]
[automerger skipped] Merge changes from topic "AutomotiveQBTSync" into qt-qpr1-dev am:
b204c00caa -s ours
am skip reason: Change-Id If5802418f6069dbc72824745307342776175d9d8 with SHA-1
7661c2a8b9 is in history
Change-Id: I0c194570d0c8e3049a2c550f69c45865e033789c
Joseph Pirozzo [Thu, 19 Mar 2020 17:54:22 +0000 (17:54 +0000)]
Merge changes from topic "AutomotiveQBTSync" into qt-qpr1-dev
* changes:
AVRCP Controller manage focus while disconnected
AVRCP Controller refresh track data on Interim
AVRCP Controller get play status
ServiceDiscoveryProtocol DB Full
AVRCP Position Changed Notification
DO NOT MERGE: AVRCP Controller Shuffle/Repeat support
jonerlin [Mon, 2 Mar 2020 11:13:31 +0000 (19:13 +0800)]
Fix potential OOB vulnerability when an HCI event is received
* Check the minimum length of Hci Events to avoid OOB vulnerability
Bug:
142546104
Bug:
142546561
Bug:
142544089
Bug:
142638492
Bug:
142638392
Bug:
142544079
Bug:
142543497
Test: inject function, Bluetooth regression test PASS.
Change-Id: I761fc56dae45bd1fe24e55669adf6a9965717830
jonerlin [Mon, 2 Mar 2020 11:13:31 +0000 (19:13 +0800)]
Fix potential OOB vulnerability when an HCI event is received
* Check the minimum length of Hci Events to avoid OOB vulnerability
Bug:
142546104
Bug:
142546561
Bug:
142544089
Bug:
142638492
Bug:
142638392
Bug:
142544079
Bug:
142543497
Test: inject function, Bluetooth regression test PASS.
Change-Id: I761fc56dae45bd1fe24e55669adf6a9965717830
Jakub Pawlowski [Thu, 19 Mar 2020 10:19:13 +0000 (10:19 +0000)]
Merge "Randomize the time between rotations of BLE Random Address" into rvc-dev
More Kuo [Thu, 19 Mar 2020 02:28:43 +0000 (02:28 +0000)]
Merge "Notify remote name failed for LE device" into qt-qpr1-dev am:
fba6af3495
Change-Id: I3f70c6d6f3c8ddace2b0e3dda47a09409d0313eb
More Kuo [Thu, 19 Mar 2020 02:05:39 +0000 (02:05 +0000)]
Merge "Notify remote name failed for LE device" into qt-qpr1-dev
TreeHugger Robot [Wed, 18 Mar 2020 23:05:17 +0000 (23:05 +0000)]
Merge "Make sure only valid packet fields are accessed in VendorPacketHandler" into qt-qpr1-dev am:
0535ce8c6a
Change-Id: Ib85f65466fd49c6290e2ed395ea56f63827d953b
TreeHugger Robot [Wed, 18 Mar 2020 22:52:14 +0000 (22:52 +0000)]
Merge "Make sure only valid packet fields are accessed in VendorPacketHandler" into qt-qpr1-dev
Jakub Pawlowski [Tue, 17 Mar 2020 15:37:36 +0000 (16:37 +0100)]
Randomize the time between rotations of BLE Random Address
Bug:
150394435
Bug:
151485516
Change-Id: I342f3e34f12a200db0a5c3aab23efabac5626825
Chen Chen [Mon, 9 Mar 2020 23:19:24 +0000 (16:19 -0700)]
Bluetooth Metric Id: Add metric id allocation to Bluetooth
metric calls
Test: Build successfully
Bug:
142563377
Change-Id: I5d34d745fc09fcfac38e583765c6762bc943d7b0
Song Gao [Thu, 12 Dec 2019 18:32:27 +0000 (10:32 -0800)]
HF_Client: Send BTA_HF_CLIENT_RFC_CLOSE_EVT when client_cb == NULL
Bug:
146086992
Test: manual
Change-Id: I685873b0c4c74ddb4e273e2a38307ec2af0bbd13
Merged-In: I685873b0c4c74ddb4e273e2a38307ec2af0bbd13
(cherry picked from commit
daa34793f2e076be3bf600e079128754a0cb8576)
Song Gao [Thu, 12 Dec 2019 18:28:36 +0000 (10:28 -0800)]
HF_Client: Free the RFC if the handle doesn't match
Bug:
146086995
Test: manual
Change-Id: Iac3078fa2d10373f295fe9c6fd49ddc39f15eb98
Merged-In: Iac3078fa2d10373f295fe9c6fd49ddc39f15eb98
(cherry picked from commit
8da3a9ed0886821be7fb4a9fa71abbb112e7a95f)
TreeHugger Robot [Mon, 16 Mar 2020 16:25:40 +0000 (16:25 +0000)]
Merge "DO NOT MERGE Fix potential overflow for gatt process write" into rvc-dev
Ugo Yu [Mon, 9 Mar 2020 06:54:14 +0000 (14:54 +0800)]
Fix bond list mismatch between Java and native
When a paired device is diconnected while authenticating, do not report
bond state change to Java since the stack does not remove the device in
this situation.
Bug:
142842685
Test: Manual
Change-Id: I308320b0c10387d1cce27f709c8b2348c14dc423
Merged-In: I308320b0c10387d1cce27f709c8b2348c14dc423
More Kuo [Fri, 13 Mar 2020 06:43:29 +0000 (14:43 +0800)]
Notify remote name failed for LE device
When cancel discovery for LE device in BTA_DM_DISCOVER_ACTIVE state,
there is no notification to indicate the remote name request of LE
device is cancelled and change the search state back to
BTA_DM_SEARCH_IDLE state. Call btm_inq_rmt_name_failed_cancelled()
to notify in this situation.
Bug:
146840780
Test: Manual
Change-Id: I4ab2a2f413e4ac19765476039f4127ce045e84d9
Chris Manton [Tue, 3 Mar 2020 18:33:42 +0000 (10:33 -0800)]
DO NOT MERGE Ensure hci command status event has sufficient packet length
Bug:
141618611
Test: net_test_hci_native
Change-Id: I70a318b05d7781ddf8f82d7922a8ee7afc8d2e9f
(cherry picked from commit
6e25c5d81c4a43c2794a605c9fc8a194f37889af)
Chris Manton [Wed, 4 Mar 2020 19:26:31 +0000 (11:26 -0800)]
DO NOT MERGE Fix potential overflow for gatt process write
Bug:
143604331
Test: net_test_stack_gatt_native
Change-Id: I88704d74ba0c265872fbfd20c8bcd3bc1dd60360
(cherry picked from commit
af0919f967eef7fffaf698fa0a30f0efe7d941b5)
Joseph Pirozzo [Mon, 18 Nov 2019 19:44:37 +0000 (11:44 -0800)]
AVRCP Controller manage focus while disconnected
If Audio focus is lost(or gained) while A2DP is not connected there is the
possibility for states to get out of sync. Removing the check for
connectivity ensures that the state can be properly managed.
Bug:
144082798
Test: Disconnect BT device, lose audio focus, verify
btif_a2dp_sink_set_focus_state_event state gets updated.
Change-Id: If5802418f6069dbc72824745307342776175d9d8
(cherry picked from commit
7661c2a8b90bee7edcf7c1279abe06ed32e22a2c)
Change-Id: I22a7ee2a3e51c3dea441a6f185e1c993cd65c4a1
Merged-In: If5802418f6069dbc72824745307342776175d9d8
Joseph Pirozzo [Thu, 14 Nov 2019 00:02:06 +0000 (16:02 -0800)]
AVRCP Controller refresh track data on Interim
Upon receiving an interim track changed event fetch the now playing
track information. Resolves issues where track changes get out of sync.
Bug:
143954201
Test: connect a phone and change tracks rapidly on phone.
Change-Id: I1e4ce62df6839dd2b9cf40832556a9b2608593e7
(cherry picked from commit
a3d62166f685f5249b813bd110e894682c84da54)
Change-Id: Ia6cc2a7a0430d6d9e3ae6e911e3fc8834221b599
Merged-In: I1e4ce62df6839dd2b9cf40832556a9b2608593e7
Joseph Pirozzo [Mon, 21 Oct 2019 22:39:09 +0000 (15:39 -0700)]
AVRCP Controller get play status
Correct the parsing error in the GET_PLAY_STATUS message and call the
proper jni callback when it is received.
Bug:
139033614
Test: Connect AVRCP change media players, observe correct value parsed.
Change-Id: I8302b64efdd72bfa671cca5b8c512a436fa54ab3
(cherry picked from commit
86b473cae724e9db2efec9ed1ee50a71f2a2dd22)
Merged-In:
86b473cae724e9db2efec9ed1ee50a71f2a2dd22
Change-Id: I0c753fbc7bb62698cf23b9ded13497b6b60cda35
Merged-In: I8302b64efdd72bfa671cca5b8c512a436fa54ab3
Joseph Pirozzo [Tue, 1 Oct 2019 21:13:29 +0000 (14:13 -0700)]
ServiceDiscoveryProtocol DB Full
Increase the size of the local SDP DB to cope with newer phones supporting
more Bluetooth profiles.
Bug:
141889288
Test: pair Bluetooth device verify no warning "SDP - DB full add_attr"
Change-Id: I823ea6e178f098a0441efde4fb7d8e7fb68e38c0
(cherry picked from commit
e62a51a4d6a25de3629194bad7d1d42b739e231f)
Change-Id: I06259aa3aa9b1d034b8b60dd9dcbfffe0080bacc
Merged-In: I823ea6e178f098a0441efde4fb7d8e7fb68e38c0
Joseph Pirozzo [Fri, 28 Jun 2019 18:07:52 +0000 (11:07 -0700)]
AVRCP Position Changed Notification
Correct position change notification to be received every 2000 ms
instead of every 2000 s.
Bug:
133400561
Test: Connect to device and monitor avrcp traffic.
Change-Id: Id8a33670b207f4a9ac03da957075acbac0c7c052
(cherry picked from commit
f11c6baecf498b2f407c545ab8d9dcc34cc62c4d)
Change-Id: If5324d4ef5fe20c71c7b603d648fff82b81ce550
Merged-In: Id8a33670b207f4a9ac03da957075acbac0c7c052
Joseph Pirozzo [Fri, 26 Jul 2019 19:26:01 +0000 (12:26 -0700)]
DO NOT MERGE: AVRCP Controller Shuffle/Repeat support
Fetch player settings when the addressed player changes.
Bug:
72495707
Test: AvrcpControllerStateMachineTest#testShuffle
AvrcpControllerStateMachineTest#testRepeat
Change-Id: I4df1f130dafb96708ec7a0a2c13c776affcc6318
(cherry picked from commit
60a193dfeb155aeb8428fb341737b385f8260899)
Change-Id: I944419ad0bd5e49bad8a988851c1a753c0753d01
Merged-In: I4df1f130dafb96708ec7a0a2c13c776affcc6318
IHLHO KIM [Tue, 5 Nov 2019 08:56:24 +0000 (08:56 +0000)]
Save reversed BR/EDR link key derived from LE LTK
Authentication is failed between Android Q and Android P or earlier when derived link key is used.
Repro steps:
1. Try to LE connect & pair(LE secure connection) with Android P device from Android Q device
2. Try to connect PAN from Android Q device to Android P device
3. Connection failed
This issue is caused by the following change.
https://android.googlesource.com/platform/system/bt/+/
ae57211e7c6ef25788369052817403e30cc9f06f
This fix just reverts removed line from the previous change.
Bug:
143940249
Change-Id: I5d18cdd76b6c436dad010caf514ab0d78997f091
Automerger Merge Worker [Fri, 13 Mar 2020 04:37:20 +0000 (04:37 +0000)]
[automerger skipped] Merge "While AVDT opened or its AVRC_TIMER_EVT expired, it is no needed to start the 2nd AVDT stream" into qt-qpr1-dev am:
5e6231c7b2 -s ours
am skip reason: Change-Id I75f39801e9779ee55fa574e30051e01966c61ea3 with SHA-1
ba432366f9 is in history
Change-Id: I182a3d57dca6c055487dc1cbd659e53eaab0f111
TreeHugger Robot [Fri, 13 Mar 2020 04:21:17 +0000 (04:21 +0000)]
Merge "While AVDT opened or its AVRC_TIMER_EVT expired, it is no needed to start the 2nd AVDT stream" into qt-qpr1-dev
weichinweng [Wed, 11 Mar 2020 06:51:27 +0000 (14:51 +0800)]
HFP: fix collision for the outgoing and incoming connection
Since the HF incoming connection and the HF outgoing connection use the
same HF control block (p_scb) at the same time, the case will cause the
btif_hf_cb flag going wrong due to collision. Then it will trigger a
crash due to a check failure when executing BTA_AG_OPEN_EVT. The patch
will ignore the outgoing connection when the connection
collision is happening.
Bug:
143128949
Test: manual
Change-Id: Id5495bd3ecb1ed9e03de5bd74a61ab102604eaae
Merged-In: Id5495bd3ecb1ed9e03de5bd74a61ab102604eaae
TreeHugger Robot [Thu, 12 Mar 2020 02:20:30 +0000 (02:20 +0000)]
Merge "DO NOT MERGE Fix potential overflow in btif_rc" into rvc-dev
TreeHugger Robot [Thu, 12 Mar 2020 00:27:39 +0000 (00:27 +0000)]
Merge "BluetoothMetricid: Add metric allocator api in java" into rvc-dev
Chris Manton [Wed, 4 Mar 2020 04:04:51 +0000 (20:04 -0800)]
DO NOT MERGE Fix potential overflow in btif_rc
Bug:
142878416
Test: net_test_btif_rc
Change-Id: Ia263bd5c863644f2adde759a103d79b812a9a5de
(cherry picked from commit
e5dd9c735a30188286c7c9b88c247e4f629bdd54)
Chris Manton [Tue, 3 Mar 2020 18:33:42 +0000 (10:33 -0800)]
DO NOT MERGE Ensure hci command status event has sufficient packet length
Bug:
141618611
Test: net_test_hci_native
Change-Id: I70a318b05d7781ddf8f82d7922a8ee7afc8d2e9f
(cherry picked from commit
6e25c5d81c4a43c2794a605c9fc8a194f37889af)
Chen Chen [Thu, 5 Mar 2020 23:02:46 +0000 (15:02 -0800)]
BluetoothMetricid: Add metric allocator api in java
Bug:
142563377
Test: Manual atest AdapterServiceTest
Change-Id: I46d1c1d5bf0c8beea1f46b1024cbd5ceb9c0b562
Merged-In: I46d1c1d5bf0c8beea1f46b1024cbd5ceb9c0b562
(cherry picked from commit
35292e66ecf1508ee64ef76ae297245fb157ff54)
Cheney Ni [Fri, 14 Feb 2020 12:29:54 +0000 (20:29 +0800)]
A2DP: SBC encoding counter errata
When the encoder interval is 20 milliseconds per tick for {44.1 kHz /
16 bits per sample / Stereo}, there were around three microseconds shift
every tick, but would cause one SBC frame mismatched after 20 seconds.
Here try to adjust the timeline to increase the accuracy by following
methods:
1. add the remainder back to the timeline when converting the time
period to data size.
2. change the timestamp to be presented by values in 1/10 microseconds.
Bug:
149546181
Test: manually
Change-Id: Ic42b2f331628c44aa927c7b9e35562be1fa750c7
Merged-In: Ic42b2f331628c44aa927c7b9e35562be1fa750c7
(cherry picked from commit
c8537f844d1c052e5c9d93981e270dd45d73a709)