sdpu_build_uuid_seq accepts a UUID sequence of arbitrary length
but does not validate against the boundaries of the buffer it's
filling.  This can lead to an OOB write.

Add validation.

Bug: 239414876
Test: atest: bluetooth, validated against POC
Tag: #security
Ignore-AOSP-First: Security

(cherry picked from commit 367ed057)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:7a62a311d1a0c229ba75529dbedcb47a7af18142)
Merged-In: Ibce32cc09ad2991789569f35ef2f71f90537fdce
Change-Id: Ibce32cc09ad2991789569f35ef2f71f90537fdce

Change-Id: I59465d02e61e1207eb4dc985fb96dbce1921311f

When p_buf->len is mtu - 1 and p_cmd->multi_req.variable_len
evaluates to true, integer underflow is triggered
in the following line, resulting OOB access.

```
 len = p_rsp->attr_value.len - (total_len - mtu);
```

Bug: 273874525
Test: manual
Ignore-AOSP-First: security
Tag: #security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:85f4d53c7bf90b806639a3a302f0007ffb3b9f23)
Merged-In: Ia60dd829ff9152c083de1f4c1265bb3ad595dcc4
Change-Id: Ia60dd829ff9152c083de1f4c1265bb3ad595dcc4

Change-Id: Ifbaf06c256fdf2147c4c829cf90e39bf4599516c

This reverts commit d5ec5273.

Reason for revert: b/281788858
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:97c9c472f6b63b86bdf9cfd054490051e881c013)
Merged-In: If6fb57064b5b2da40842e2c1cf95aadc6f0351b6
Change-Id: If6fb57064b5b2da40842e2c1cf95aadc6f0351b6

Merge cherrypicks of ['googleplex-android-review.googlesource.com/23695904', 'googleplex-android-review.googlesource.com/23695905'] into udc-release.

Change-Id: I293c802ca4aa84b1d6f9ccd53630959d504748bf

Current logging adds support to measure for A2DP and HFP profile
attempts along with their result and reasons for profile connection
attempts.

Test: m followed by connecting to BT device supporting A2DP and HFP
and then statsd_testdrive 696

Bug: 285027829
(cherry picked from https://android-review.googlesource.com/q/commit:1d02bb3a5f095c162155425acd61812f76b66d56)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:0964e2c746232e21e66843fe7587e92921a6cc0c)
Merged-In: Ie70c5a40a00b57d8c65857151774e6346acced85
Change-Id: Ie70c5a40a00b57d8c65857151774e6346acced85

APCF Feature Selection for AD Type check is bit 8(0x100)

Bug: 281790117
Test: manual
(cherry picked from https://android-review.googlesource.com/q/commit:ea54fff1792c08169ff911467ad666c5a8add796)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:35042736eaeb4b41093bd058a42950656b587440)
Merged-In: I64f301137797a44c69e06e744a653bda72c85b18
Change-Id: I64f301137797a44c69e06e744a653bda72c85b18

Change-Id: Iba1f97239552d846e676158f156e08b5d0443228

* changes:
  Revert "Add direct Telecom check for call state in HFP service"
  Don't treat pthread_t as a signed value type
  Close uhid file and polling thread together

Change-Id: If68cba2d0a4ca3eef17fe31eb0e1301a92db5741

am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23669519



Change-Id: I4b23c6c284bfe86df7eaaaae6e49372ad76b39a8
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Auto-generated-cl: translation import
Change-Id: I56af61079ab855810bdb922cbb10a713374bdd2d

Auto-generated-cl: translation import
Change-Id: Ia50a05708e2332fe52c5784d9e37d26e1c4b28a5

Change-Id: I421fbb1ed35251d0f2bf6af1a495037cf70d4a24

Change-Id: I5e0fc45276bae03c983590bfb99a23a491681366

Automotive team is unable to use full size device-tests package, and instead is using smaller team owned package replacement called 'automotive-tests'

Test: zip file built and checked for `APK build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=cf_x86_64_auto TARGET_BUILD_VARIANT=userdebug droid dist automotive-tests`
Bug: 284663915
(cherry picked from https://android-review.googlesource.com/q/commit:762dede13d07d7ac3f8497e1ac257d6d70c0ec6a)
Merged-In: I406e1d0ac09016980937832e95bbf0ea770cbba6
Change-Id: I406e1d0ac09016980937832e95bbf0ea770cbba6

* changes:
  Battery: Only connect or disconnect BAS for BLE ACL link
  Check LE audio support before resetting the pairing state
  CSIP: Fix notifying about connected devices
  Ensure services are searched over BR/EDR transport after BR/EDR pairing
  bt: Fix getting device type.
  LE Audio: Return SDP services if GATT discovery on LE transport fails
  LeAudioService: Fix starting scanner
  leaudio: Remove CIG when all ASEs are in the Releasing state
  Fix for infinite loop in free_gatt_resources

This reverts commit ae963f1c.

Reason for revert: b/286003442, b/285806759

Some Bluetooth devices will disconnect if there is no call at the time of open SCO. The change also did not fix the original bug as this seems not to come from Bluetooth.

Bug: 286003442
Bug: 285806759
(cherry picked from https://android-review.googlesource.com/q/commit:2b8630d2f6cde52f8ccaf573311b18411deb70cd)
Merged-In: Ib920e67358ba46e14f646a0c69897abcb38f50ec
Change-Id: Ib920e67358ba46e14f646a0c69897abcb38f50ec

1. HID host treats pthread_t as a signed value. Some platform may define
it as unsigned type.
2. HID host uses -1 as invalid pthread ID. pthread does not define
invalid thread ID.


Bug: 285750089
Test: Floss test "Two BLE connections"
(cherry picked from https://android-review.googlesource.com/q/commit:791d9aa87fa0a1503077a81fa80c51e4c6b620ee)
Merged-In: I77eb1596910ee1a6c9c2244beff7ff382ca57ba0
Change-Id: I77eb1596910ee1a6c9c2244beff7ff382ca57ba0

UHID file descriptor is closed by btif_hh in jni thread on disconnection
or open failure while the UHID polling thread is closed by bta_hh in the
main thread on disconnection.
Closing UHID file descriptor without stopping polling thread can result
in high battery drain.
This change ensures that UHID fd closure is aligned  with closing of the
polling thread.

Bug: 280170626
Test: Regression
(cherry picked from https://android-review.googlesource.com/q/commit:5d0360323fc9157397ddfa035e987c1e9c5258ad)
Merged-In: I64daa836351f1ab3766947353d7824364eb9530f
Change-Id: I64daa836351f1ab3766947353d7824364eb9530f

* Restrict BAS usage to BLE only to avoid affecting BR/EDR link

Bug: 285628594
Test: none
(cherry picked from https://android-review.googlesource.com/q/commit:a10e36a11a0efbb5d417af5e8d4fb97bfe35ff78)
Merged-In: Id4f52a490938e8084ea3dc0c277cb4782c747ddd
Change-Id: Id4f52a490938e8084ea3dc0c277cb4782c747ddd

Bug: 282851784
Test: Pair only left bud
(cherry picked from https://android-review.googlesource.com/q/commit:e1175892b5f6d6d215f42d4b052258b3d5e2ce94)
Merged-In: Ib4fac3bd7c54ec5fe868804fb32ca94f2e15928c
Change-Id: Ib4fac3bd7c54ec5fe868804fb32ca94f2e15928c

Bug: 283910297
Test: atest CsipSetCoordinatorServiceTest
(cherry picked from https://android-review.googlesource.com/q/commit:9fa2190a469e5995aeb0f9b66a9971b3c1ed82e3)
Merged-In: I72878dad690dbd017b32f20521278b94d843aee1
Change-Id: I72878dad690dbd017b32f20521278b94d843aee1

After pairing over BR/EDR transport, service search is scheduled over the transport depending upon device type. If device type is not correct for any reason, service search may get started over LE transport. In such case, btif_dm may continue to wait for SDP search results for reseting pairing state, thus blocking further pairing attempts.

Bug: 282733852
Test: Pair with dual mode devices
(cherry picked from https://android-review.googlesource.com/q/commit:d6c6d68524ec26b0f9c243a7a6e9066f40a6aeee)
Merged-In: Ib5124fcf334a357495a57abee5bd6050248c7eb2
Change-Id: Ib5124fcf334a357495a57abee5bd6050248c7eb2

With this patch p_dev_rec will have updated device type based on the
inquire database.
This is needed for dual mode bonding, when first bond over LE and later
it triest to bond over BR/EDR.
Note: At that time BTM_GetPeerDeviceTypeFromFeatures will not return any
type as it is working only when BR/EDR is connected

Bug: 282733852
Test: manual
Tag: feature
(cherry picked from https://android-review.googlesource.com/q/commit:f6a115c6f386de1f40781eb12daeb84b434a947b)
Merged-In: I69d708153de45c9c503eb71915ac6ccdddf98c12
Change-Id: I69d708153de45c9c503eb71915ac6ccdddf98c12

Right now, if GATT discovery fails, we would prevent any services from
being connected in Settings on dual mode device.

After this patch, if LE GATT discovery fails, we will fall back to
SDP only services, which should keep the audio devices usable.

Bug: 278804760
Test: pair with LE Audio capable device that would fail to establish LE
connection, or time out during GATT service discovery
(cherry picked from https://android-review.googlesource.com/q/commit:4d5d871ab40ab59e25332be14e8d7187a7f95450)
Merged-In: I734f792cb841d44e04748fd421fbfe458bb4ff41
Change-Id: I734f792cb841d44e04748fd421fbfe458bb4ff41

Make sure to retry when registration does not happen, and in other case
clear the callback which indicates scan is ongoing.

Bug: 283228408
Test: manual
Tag: #feature
(cherry picked from https://android-review.googlesource.com/q/commit:8c02fa7af535428884f57d88e68e479087bec83d)
Merged-In: I2399058997b20ea3534951b25c4a8169211d7052
Change-Id: I2399058997b20ea3534951b25c4a8169211d7052

We should remove CIG only when there is no active ASEs.
In this patch we also add a guard which block creating CIS when CIG is
not exist.

Bug: 282506986
Test: atest bluetooth_le_audio_test bluetooth_le_audio_client_test
Test: BluetoothInstrumentationTests
Tag: #feature
(cherry picked from https://android-review.googlesource.com/q/commit:ada7d88af8b646cf0cccd226480ea0242a5818c1)
Merged-In: I4943ed9869945f6d63c4f77c8f9c199aaa345a08
Change-Id: I4943ed9869945f6d63c4f77c8f9c199aaa345a08

(cherry picked from https://android-review.googlesource.com/q/commit:c4b6d03982a04e9b42c02273b4b07a647884d3ba)
Bug: 285958436
Merged-In: Idecd58c6b8e2ad17e074cef82f04255910fc3c10
Change-Id: Idecd58c6b8e2ad17e074cef82f04255910fc3c10

Change-Id: I7094a36d64ec16e6a37d6030422e31a386959c60

[automerger skipped] Merge "Temporarily disable failing HeadsetServiceAndStateMachineTest" into tm-qpr-dev am: 9760d9ab am: 482dc036 -s ours

am skip reason: Merged-In I8be0a5bcbb8c26e3ef178bcb25973783045b9f31 with SHA-1 46013104 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23566096



Change-Id: Ib4252bec63b4fffd63ff0a75d4d6c9d4c5c67627
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Merge "Temporarily disable failing HeadsetServiceAndStateMachineTest" into tm-qpr-dev am: 9760d9ab

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23566096



Change-Id: I9f7aed128746be3010cdaf71b1de817ed3f91438
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

[automerger skipped] Merge "Temporarily disable failing HeadsetServiceAndStateMachineTest" into tm-qpr-dev am: 9760d9ab -s ours

am skip reason: Merged-In I8be0a5bcbb8c26e3ef178bcb25973783045b9f31 with SHA-1 95216457 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23566096



Change-Id: I66dd3a5eae394d23c9b4d59f05545c7acf8b5853
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

[automerger skipped] Temporarily disable failing HeadsetServiceAndStateMachineTest am: 46013104 -s ours

am skip reason: Merged-In I8be0a5bcbb8c26e3ef178bcb25973783045b9f31 with SHA-1 95216457 is already in history

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23566096



Change-Id: I38e50423f90b9dbdc04d0bbf6f258c4aa3f97992
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Change-Id: I244263c5bf02ab1d7c7edcd2ed9094491e9e57ed