Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22343125



Change-Id: Ib71e4715f6bf6c5f2c7954d06b1fd5e175df33b9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

btm_ble_periodic_av_sync_lost internally calls the function
btm_ble_get_psync_index_from_handle, which polls the internal periodic
sync buffer and returns a matching index if one exists.  If no matching
handle is found, it returns MAX_SYNC_TRANSACTION.

However, here the calling function lacks the check for this case present
in similar functions.  If no handle is matched, it will attempt to index
the buffer with MAX_SYNC_TRANSACTION, which will overrun it by a single
width and lead to OOB access.

Add handling for this case.

Bug: 273502002
Test: atest bluetooth_test_gd_unit, atest net_test_stack_btm, validated
against researcher POC
Tag: #security
Ignore-AOSP-First: Security

Change-Id: I2e1e95b277f81b2668f721a7693df50841968ec5

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21090924



Change-Id: Idfe58b567a3484ddcf8be45e1515b6349ed290f3
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Fix to the regression reported in b/264708304 and b/266585826 added:
The root cause of the regression, the sensor HAL layer expects the HID feature
reports to contain 40 bytes, even less bytes are contained in the data
field.

This updated fix restores the length of data fields with the len arg.

Bug: 259675705
Test: manual verification with a Pixel 6 and LinkBuds
Ignore-AOSP-First: security
Tag: security
Change-Id: I02f16c360965b049fc6c8fdfa0132b7aa54bc1d3

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21967012



Change-Id: Id55eb2d40d023aa7d56c947cef8c94d6b754ce21
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

This reverts commit 367ed057.

Reason for revert: Reverting from May QPR, will reinstate unchanged for a later release

Change-Id: I36ae57ec7e81ac0357fa1c6fb98dff219ee6dade

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20729913



Change-Id: Ia86f50d44f1cb5ddac7b04220142e760fb73bf39
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

sdpu_build_uuid_seq accepts a UUID sequence of arbitrary length
but does not validate against the boundaries of the buffer it's
filling.  This can lead to an OOB write.

Add validation.

Bug: 239414876
Test: atest: bluetooth, validated against POC
Tag: #security
Ignore-AOSP-First: Security

Change-Id: I6c0b91428bd37d73ae707b8a1843338998fb9562

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21047826



Change-Id: I2a66863b23eea5660bb6f561bb4c3271d6b57df5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20846745



Change-Id: I7c632b3e3a8ca16594871c269aa07598a25f38da
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21047823



Change-Id: I9081190a672336f2ea2fba94681d477682fb8850
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20933644



Change-Id: I0576317ac705926573ad15ec0f9730d41f9b32f2
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

For NCIS certification, we need to drop the connection or
reestablish encryption after receiving a command to disable link
layer encryption on an encrypted link.  However, dropping the
connection for all devices breaks compatibility during role switch
with devices running Bluetooth 2.1 or earlier, a category including
many cars still in the field.

Add a check forcing connections to drop in this case, conditioned on
Common Criteria mode..

Bug: 251436534
Test: atest: bluetooth, lab validation forthcoming
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I94654ebeb16774643107ee41473725cfae3764ab

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21047829



Change-Id: I937c885bd669dbb5644d793dc50f49b0ec87c206
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20992904



Change-Id: Ife06cd167ad2dd23a33ed456c4a03e6240a5d917
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21047825



Change-Id: Ib7c87f6349bbb0c7f7353eb438a3467394f26a97
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21148481



Change-Id: I468d55cdbc419d0b5ddde62d5b8750bacf90f3b2
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Bug: 261857395
Test: manual
Tag: #security
Ignore-AOSP-First: security
Change-Id: I1ba4d1f1e62b1d77ac635cfb6b16cf175bfbf254

Bug: 254445961
Test: manual
Ignore-AOSP-First: security
Change-Id: I1d3c208a5281b88ed25c0028f1a0000d6957637c

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20965587



Change-Id: Iffd6df75d9257e09f9ed44035950cefc82f3fa81
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/20995769



Change-Id: I3d1aae4eba2a0e08733ed5671d1413dab0cf997f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Bug: 245517503
Test: manual
Ignore-AOSP-First: security
Change-Id: If768b0b2e11bbc4444835fda28e246e285a7e8ab

Bug: 251427561
Test: manual
Ignore-AOSP-First: security

Change-Id: I2db2339631d521515cb34536e358ae72ebeaaa8b

Bug: 233879420
Test: manual
Ignore-AOSP-First: security
Change-Id: Ic740e5ff3ceabf3df1e78431f7d31adf356479f0

Bug: 236688764
Test: manul
Ignore-AOSP-First: security
Tag: #security
Change-Id: I0ef4855e715be8fa9a69916e35d3a6c97498a9cc

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21101261



Change-Id: Ie2c9dd674202a7f2d9fd73b3fc7487815735ebaf
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

This reverts commit d2e67f50.

Reason for revert: regression caused in  266585826

Change-Id: I86a5bb0b96332880a2a173ad57b96fb007e3ea83