GitLab

* commit '8d88b1b7':
  Allocate large enough buffers when copying AVRC packets

AVRC response is created by copying the original received packet.
When allocating a buffer for the response, the buffer length
should be large enough to contain the response.

Bug: 22437809
Change-Id: I862d633e76d3c5221582459f19935a45e53577c7

Implemented a check to grab the ro.boot.btmacaddr property in case the
device fails to receive an address beforehand.

Bug: 22618015
Change-Id: Ie322888e114a732f8e85c81793e3e5e5eacffc7a

* commit 'aa3be1a6':
  Implement Bluetooth settings factory reset (3/5)

Implemented the factory reset function to be used to reset all bluetooth
settings on device to factory default

Bug: 16161518

* commit 'd63f7c0b':
  Add Dialog mouse & KB to blacklist for LE secure connections

* commit '84d13eda':
  Add an explicit check for AVRCP vendor data

This change allows the host to mask the Cross key bit in
the key distribution fields of the pairing request and
response while pairing with the Dialog keyboard and mouse
to prevent the remote from rejecting the DUT's pairing request.

Bug: 22799966
Change-Id: I89420e77875957c78e915c508de311d779fd03df

Add an explicit check for AVRCP vendor data when parsing received vendor
commands or responses.

Bug: 21768387
Change-Id: I715de6fc7348d063c448971a8dae6dd1b00c7062

* commit 'caaa00f5':
  Fix a crash for a race condition during Bluetooth shutdown

This is same race condition observed in btif_media_task_aa_tx_flush_req()
because btif_media_task_aa_tx_flush_req() and btif_media_task_stop_aa_req()
are called back-to-bach.

This race condition is triggered when A2DP audio is streaming on shutdown:
"btif_a2dp_on_stopped() -> btif_media_task_stop_aa_req()" is called
to stop the particular audio stream, and this happens right after
the "cleanup() -> btif_a2dp_stop_media_task()" processing during
the shutdown of the Bluetooth stack.

Bug: 22700411
Change-Id: Ia0c98d44a108cf0f57731ac8129e4d76c9934542

* commit '9de273d9':
  Fix CTS Verifier test for insecure RFCOMM connection.

Closing an RFCOMM server socket does not remove the corresponding
service record from the security database. However, the RFCOMM
channel becomes free for reuse. The next RFCOMM server socket will
therefore "inherit" the service record for the closed one if it
happens to reuse the same channel.

Bug: 22880207
Change-Id: Ida3fee49e5f40667d9992dc4c4442f9289adae9e

* commit 'efa5991f':
  Fix a NULL-pointer crash

It seems that the current implementation of btm_sec_encrypt_change()
does not handle the case when it is called with an invalid handle,
such as inside file btu_hcif.c :

  case HCI_SET_CONN_ENCRYPTION:
    /* Device refused to start encryption. ... */
    btm_sec_encrypt_change(BTM_INVALID_HCI_HANDLE, ...)

Bug: 22791224

Change-Id: Ide9404d0c82819399cf258ae3f90c25b352f1e20

* commit '48a4b9cd':
  Assign pseudo address for host-based RPA resolution matches

Bug: 21963935
Change-Id: Id72001ce17996ea04c3eba32cebcac4dbbe317bc

* commit 'b61d25c5':
  Fix memory leak in A2DP event handler

btif_av_event_free_data() was not called in all states (idle state only)
leading to potential memory leaks.

Bug: 22822688
Change-Id: I40520c605c9a806e6cd5ee6e36c101d0aa8d4355

* commit '82c8b927':
  Reset LE encryption key size at LE disconnection only

This change checks the transport type on receiving the disconnection
and resets the encryption key size only if the LE disconnection
has taken place.
This fixes the issue where read request to characteristics that
require encryption,  fails after cross key derivation due to
disconnection of BR/EDR transport.

Bug: 22515016
Change-Id: If6aad91a628eabbb5a4b7f5c22812fe94d4c5db2

* commit 'dab356e3':
  Promote AVCTP version to 1.4

Promoting AVCTP version to 1.4 from 1.2 as Bluedroid stack
already has got support for the same.
Below changes are incorporated as part of this:
 - AVCTP version in SDP entry is upgraded to 1.4 for both AVRCP
   Target and controller role.
 - Service class #1 is added in extra for AVRCP Controller SDP
   entry to be in sync with AVCTP version change.
 - Browsing support is not enabled as that needs corresponding
   profile level implementation, which is currently unavailable.

Change-Id: I72f7f67eb0a789fd321e9468f2a51bb5e9385a89

* commit '2ac9ae06':
  Fix a bug allocating buffers for fragmented AVRC packets

Use the correct offset_len when allocating buffers for AVRC
packets that need to be fragmented.

Bug: 22156175

Change-Id: I7db12474c84edacb4f0739d50a43e8cebdcca676

* commit '1500b8d9':
  Fix for uhid_event size check

The uhid_event function used to expect that the return value of each
read function call to match with the size of the struct uhid_event.
Since the header file doesn't match the kernel driver, these two size
don't always match. The exact size check is replaced with expecting
the minimum required size.

Bug: 20108348
Change-Id: Ib61537092b109296f8290d802b68fc2efe78888c

* commit '760aa99b':
  Unpair HID device cleanup

* commit 'c6137426':
  Fix the logic for stopping the Power Management timers.

When unparing HID devices, the attr_mask was not cleared.
By not clearing this data, some HID device will never be able
to connect again. (E.g. the Apple Magic Mouse)

Bug: 15566403
Change-Id: Ic80909dcecdf48d967c1a936b31554653761fa42
Signed-off-by: Casper Bonde <c.bonde@samsung.com>

Previously, the logic for stopping the timers didn't take
into account whether each timer was already running.

Bug: 22666419
Change-Id: Ia99bf8be917e9ea69f478a954085336fc899040a

* commit '196413f5':
  Fix TX queue overflow detection

- Prevent possible endless loop if |nb_frame| is too high
- Remove off-by-one calculation before sending frames
- Remove log spam and add better debug info

Bug: 22658329
Change-Id: I374ee980aec48763beb49b4f6f8b076124cadf40

* commit '1076b7b0':
  Customize Bluetooth sniff interval

Fix an earlier commit that prevents from customizing some of
the Bluetooth sniff parameters - those cannot be overwritten
anymore in the bdroid_buildcfg.h file.

Also, fixed the indexing in tables bta_dm_pm_cfg[]
and bta_dm_pm_spec[]

Bug: 22676670
Change-Id: I3a7074b9a9c91d312dc5d4314b7c304baf4ae20d

* commit '197ee685':
  Fix a crash for a race condition during Bluetooth shutdown

* commit 'ac72840a':
  Update device type correctly in the NVRAM at inquiry result

This race condition is triggered when A2DP audio is streaming on shutdown:
"btif_a2dp_on_stopped() -> btif_media_task_aa_tx_flush_req()" is called
to stop the particular audio stream, and this happens right after
the "cleanup() -> btif_a2dp_stop_media_task()" processing during
the shutdown of the Bluetooth stack.

Bug: 22602117
Change-Id: I5de6a8f15b6a2771dde2e299a5b60554063696a2

This patch checks for the NVRAM data when inquiry result
is received from the remote device. In case the device is
marked as LE only or BR/EDR only, and inquiry result is
received from the alternate transport, the device type is
marked as Dual mode in the NVRAM

Bug: 22604450
Change-Id: Id925e8bad152a33c2bd3c371ca42a6f9c694e3b0