GitLab

- Handled Buffer over flow for uint16_t
- Discard invalid HCI packets from Codenomican test
  tool as data length and actual data not matching
  during reassembly

Use case:
Execute L2CAP test suit from Defensics Codenomican

Steps:
1. Pair and connect DUT to Codenomican tool
2. Execute L2CAP test suit from Defensics Codenomican

Failure:
Crash observed on DUT and Codenomican tool stuck in execution.

Root cause:
Codenomican tool sending invalid HCI packets to DUT and
there are no checks to handle buffer over flow and other invalid data
from Codenomican tool.

Bug: 29498064
Change-Id: I6f93c80244fc39d607ad285185136bbbca83d7ae

Each pointer that was freed by one of the following functions should
be reset to NULL:
 - config_free()
 - data_dispatcher_free()
 - fixed_queue_free()
 - list_free()

Bug: 29421693
Change-Id: Ie55a04ed986393994564edcf872d7413b0767a85
(cherry picked from commit 8cbc2910)

By polling, we ensure the socket buffer is nearly always full,
as blocking socket writes may not wake in time to avoid underflow.

Bug: 28286313
Change-Id: I056768dbd860993c41d44c33a4846d62c50db933

Some HID devices will accept both write request and write command.
Prefer write commands when possible.

This is due to bug in some hardware, that will not send write response
when too many commands are queued.

Bug: 29184976
Change-Id: I5bafc067f044a48f152c60b8e17722067bc1453e

Id field is equal to attribute handle, so it must be 16bits.
Otherwise only piece of GATT database can be used.

Bug: 29253825
Change-Id: Ia88e3ad3eb96ca8e97349aa5e852e66c57072b49

GATT Service is contained between start and end handle. If
characteristic definition is at end handle, and it's value definition is
after end handle, it will not be properly discovered. That's because we
use value_handle instead of attribute_handle to identify
characteristics.

As a workaround, increase service boundary if value is defined after
it's definition.

Bug: 29253825
Change-Id: Ib145aea4f5cf38a1fbb977c301136e16f8f900f7

If there are any HID operations scheduled after disconnect, mark the
device as no longer executing after establishing connection. Otherwise
we'll be unable to send any HID commands to it.

Change-Id: Ie1bb622388a3bcb574dec3dde76ef4518ee1102f

If there are any GATT operations interrupted by a disconnect, mark the
device as no longer executing. Otherwise we'll stil receive data from
the device, but we'll be unable to send any HID commands to it.

Bug: 29184976
Change-Id: I489f41c970abad0ff1145005d3250beafa83d27e

Also fixed AVRC_PDU_GET_PLAY_STATUS timeout response.

Bug: 28177785
Change-Id: Icde64a5c1806453850abe101f9707fff61566566
(cherry picked from commit 1c512b85)

Use Case: Disable time out when atleast one active ACL connections

Steps:
1. Turn ON Bluetooth
2. Connect to any Headset
3. Turn OFF bluetooth.

Failure: Turn OFF bluetooth is failed when atleast one active ACL connections

Root Cause:i If we have one or more active ACL links, so it is not notitying
BTA_DM_DISABLE_EVT to upper layer.

Fix: Set disable timer in case of any active ACL connection

Bug: 29217385

Change-Id: Ica47717119f1ab9fa9f4f5244e8483c408276a2a
(cherry picked from commit 3e4f01ad)

Payload size for GATT Read by type request for UUID32 and UUID128
are incorrectly allocated. This leads to memory overflow when
Read by type request is sent for them and eventually results
in crash during free. This change makes sure that the payload
can accomodate upto 128 bit UUID.

This crash is observed while running TC_GAR_CL_BV_03_C Qual test
case.

Bug: 29011042
Change-Id: Ib2b41b769b394670099f4549f204e2972f7df876
(cherry picked from commit 7da98621)

Steps:
Execute TC_LE_REJ_BI_02_C

Failure:
PTS stuck after sending INFO RSP, ECHO RSP on the LE signaling channel

Root Cause:
The Bluetooth stack is not rejecting INFO RSP, ECHO RSP even though
these commands are invalid for the LE signaling Channel.

Fix:
Reject the INFO RSP, ECHO RSP with error L2CAP_CMD_REJ_NOT_UNDERSTOOD.

Bug: 27852645
Change-Id: Ie09f658d606206cbdbea928e8cb6d10332743cf4
(cherry picked from commit d35bb40d)

The spec only allows one result per event.
Abort processing and return if the spec is not followed.

Bug: 29141745
Change-Id: Ic414b28adadec274779b0d953d12d499a619aff6
Signed-off-by: Myles Watson <mylesgw@google.com>

Use Case:
Certification test cases for SMP require various scenarios
where the remote device needs to show a specific behavior
where it fails the pairing in a certain way, and the DUT is
required to abort the pairing properly.
In abcense of a proper PTS suite to execute these test cases,
we can use another device running the same host by configuring
certain run time property.

Test Cases:
TP/SCJW/BI-02-C
TP/SCJW/BV-02-C
TP/SCPK/BI-03-C
TP/SCPK/BI-04-C
TP/SCPK/BV-02-C
TP/SCPK/BV-03-C
TP/SCJW/BI-01-C
TP/SCCT/BV-01-C
TP/SCCT/BV-02-C
TP/SCPK/BI-01-C
TP/SCPK/BI-02-C
TP/SCPK/BV-04-C
TP/SCPK/BV-01-C

Fix:
Added a property in the bt_stack.conf file. The property name
is "SmpFailureCase". The values 2 to 6(inclusive), are forcausing SMP
failures with various failure reasons.
Failure case 1 and 9 are for producing error "Confirm value failure".
Cases 7 and 8 are for generating specific errors at pair cancel.

Note:
The default use of this feature is controlled using a compile
time flag BTM_BLE_SMP_CERTIFICATION.
The BTM_BLE_SMP_CERTIFICATION = TRUE is needed only while we
wait for the PTS support for the LE Secure connections.

Bug: 27852645
Change-Id: I1f7a8ff2659d85b5978b75870c57162a34d394d0
(cherry picked from commit 0bd0c8fc)

Use Case:
Pair and unpair LE remote device repeatedly. The repair
intermittently fails with the error "DHKey Check Failure"

Failure:
Pairing failure is observed when pairing is performed
after unpairing, without performing a BT reset.
Further analysis of the SMP logs indicate that DUT uses the
static address of the remote device for calculation of the
MacKey value. At the time of pairing, the remote RPA should
be used (and the static address has not yet been distributed either).
The problem is caused by the previous dev record which is left in
the stack, and at the time of repair, stack picks the old device
record and reuses it.

Fix:
This change removes the entire BLE block from the device record,
after the unpairing is performed, so that a new device record
is allocated, after the repairing is done.

Bug: 27852645
Change-Id: I8d605d1bb3b1c32061a8d8a7a7fe0fe200030abc

This reverts commit 2ed10d442266eade44be121cd24fd473c85007d0.

Original change needs to be reverted to align with Errata
ESR04 where "Section 8.17, General Reject Page 71" of adopted
AvDTP Spec is changed to have "Invalid Signal Identifier"
in first 6 bits of Octet 1.
This change helps passing PTS case TP/SIG/SMG/ESR04/BI-28-C

Bug: 27852645
Change-Id: Idfc960ce00662e8aacc26f3b3fdca9deca8a2aff

During 67212321

 patch, some code got missed while doing manual rebase.
This patch is adding that missing code.

Bug: 27852645
Change-Id: I2525908c29e3288e0ace1ee26c5f2aa6cfd59d68
Signed-off-by: Navin Kochar <navin.kochar@intel.com>

uhid_event() returns 0 in the normal case. Commit 3a2c2d61
results in the polling thread to be exited.

Bug: 28942565
Change-Id: Id0aff2958bc7c2704ba340aa0ff7848afb8dcf80

Bug: 28614494
Change-Id: I3f4a923f9e14faef57b2d694bfc253fd10749414
(cherry picked from commit 74963722)

Fixes: 28979841
Change-Id: I520608a13224601fb9101d00c08b34cdb0f8d374

Bug: 28849621
Change-Id: I3ce1c857d0d0a2c00c59d8f71b40685ae602dc29
(cherry picked from commit 1f9eb3d6)

Add fsync() calls to force sync to disk while saving configuration
file.  It is necessary to do a sync on the temp file before rename,
and to sync again on its parent directory to ensure both the
file content and the directory are up-to-date.

Bug: 27354612

Change-Id: I3a862ad59c8ae5beb8ea2c727eb5f275a2d5823e
(cherry picked from commit 95dbe03a)

- Calculate number of SBC frames to fit into single MTU for EDR capable
  remote devices. This makes sure the maximum utilization of the
  available bandwidth, keeping the bitrate at high quality.
- This change helps to address the discrepancy seen with a few available
  2 Mbps headsets which set the AVDTP media MTU size greater than the
  2DH5 packet payload size which eventually forces AVDTP packets to get
  fragmented in the controller. This change ensures packing of the SBC
  frames in a way that AVDTP packet size fits within the 2DH5 payload
  size.
- As packet size is restricted to meet the required bit rate more than
  one AVDTP packet can be sent to the controller in a given iteration
  based on the bit rate requirement.

Bug: 24875861
Change-Id: Icae7656ad563bbbdef65ecbfa15a89b26cf9edb2

Merge "Add guest mode functionality (2/3)" into mnc-dev am: 4439d380 am: 99bbe2ff  -s ours am: 34619f8e
am: 84970d13

* commit '84970d13':
  Add guest mode functionality (2/3)

Change-Id: I8e26f8bb0fa6898427507dfc888dfb6fd743fcac

am: 34619f8e

* commit '34619f8e':
  Add guest mode functionality (2/3)

Change-Id: I00a7ad9675ba8e3f68e2066aca2fd1a5baaf06db

am: 99bbe2ff  -s ours

* commit '99bbe2ff':
  Add guest mode functionality (2/3)

Change-Id: Ie493166a8d452f2892bb96323b23527efe053dd7

am: 4439d380

* commit '4439d380':
  Add guest mode functionality (2/3)

Change-Id: Ia13560babbc18e2ee290e16f9b03fb5202894c23

Instead of crashing whole stack when trying to post task to
uninitialized queue, log error message. This can happen in two cases:
stack is not initialized yet, or we're shutting down and already cleaned
up the workqueue thread.

Bug: 28889608
Change-Id: I9b8652d27abc2489b2489997c928634b68433a3e

Bug: 28721625
Change-Id: I2214fb2576f0f0794922ed9b47d8805839d69bfd