1. The size of `p_src->attr_value.value` is dependent on
   `p_src->attr_value.len`. While copying `p_src->attr_value.value`,
   to `p_dest->attr_value.value`, it always copies GATT_MAX_ATTR_LEN
   bytes, it may result in OOB read in `p_src->attr_value.value`;

2. As the `p_dest->attr_value.len` does not map the length of
   `p_dest->attr_value.value`, it may result in OOB read in
   attp_build_value_cmd;

Bug: 276898739
Test: manual
Tag: #security
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:59c9e84bd31d4935a875d588bf4d2cc5bfb07d59)
Merged-In: Iefa66f3a293ac2072ba79853a9ec23cdfe4c1368
Change-Id: Iefa66f3a293ac2072ba79853a9ec23cdfe4c1368

Merge cherrypicks of ['googleplex-android-review.googlesource.com/23398897'] into security-aosp-udc-release.

Change-Id: Ib6e9ccf6442e64b3b341fb22bc61b192c25755ba

Some HCI BLE events are missing bounds checks, leading to possible OOB
access.  Add the appropriate bounds checks on the packets.

Bug: 279169188
Test: atest bluetooth_test_gd_unit, net_test_stack_btm
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:66e2be0585514de92e8a31df09ab31528fd67e20)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5d1a3febede9f835797cf5feff978a9f007f2593)
Merged-In: If7752f6edd749d6d5a4bb957b4824c22b5602737
Change-Id: If7752f6edd749d6d5a4bb957b4824c22b5602737

Merge cherrypicks of ['googleplex-android-review.googlesource.com/22932491', 'googleplex-android-review.googlesource.com/22919959', 'googleplex-android-review.googlesource.com/24737769', 'googleplex-android-review.googlesource.com/24737770', 'googleplex-android-review.googlesource.com/24668801', 'googleplex-android-review.googlesource.com/24704938', 'googleplex-android-review.googlesource.com/24706103', 'googleplex-android-review.googlesource.com/23353294', 'googleplex-android-review.googlesource.com/24234506', 'googleplex-android-review.googlesource.com/24994487', 'googleplex-android-review.googlesource.com/25011463', 'googleplex-android-review.googlesource.com/25012272', 'googleplex-android-review.googlesource.com/25020212'] into security-aosp-udc-release.

Change-Id: I49f857cdecf0f62cbf39b33d81de00d631d4b70f

BTM_BleVerifySignature uses a stock memcmp, allowing signature contents
to be deduced through a side-channel attack.

Change to CRYPTO_memcmp, which is hardened against this attack, to
eliminate this attack.

Bug: 274478807
Test: atest bluetooth_test_gd_unit
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from commit 7a960ac1)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:d011f54d04e7ff732d4dc467079574b4e1c7b72d)
Merged-In: Iddeff055d9064f51a1e0cfb851d8b74135a714c2
Change-Id: Iddeff055d9064f51a1e0cfb851d8b74135a714c2

Bug: 277590580
bug: 275553827
Test: atest net_test_main_shim
Ignore-AOSP-First: security
Tag: #security
(cherry picked from commit 0d7e3d8f)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:462fc9465fafce4a055d0dadb451b3d71bf05289)
Merged-In: I7fcb7c46f668f48560a72399a3c5087c6da3827f
Change-Id: I7fcb7c46f668f48560a72399a3c5087c6da3827f

This change is intended to be used to factor out
dup code for parsing GapData in StartAdvertisingSet
and make it easier to be tested.

Backport of Ia39886c415218353b6f9d59d7d3f6d1160477d6c

Bug: 296291440
Test: atest net_test_main_shim
(cherry picked from commit 08690d66)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:cfc86f8d13d6e5585f2b535bf5225000c6ceaf8e)
Merged-In: Ia39886c415218353b6f9d59d7d3f6d1160477d6c
Change-Id: Ia39886c415218353b6f9d59d7d3f6d1160477d6c

[conflict] Merge "Add bounds checks in btif_avrcp_audio_track.cc" into tm-dev am: 0b68bd68 am: 52d169b1

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23356997



Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:3d7c7f4c2c514b6a62f827615cb75ba61319b115)
Merged-In: I0389f56ae210b4976821e0ceeb21a7a0c2965a62
Change-Id: I0389f56ae210b4976821e0ceeb21a7a0c2965a62

com_android_bluetooth_btservice_AdapterService does not null its local
JNI environment variable after detaching the thread (which frees the
environment context), allowing UAF under certain conditions.

Null the variable in this case.

Testing here was done through a custom unit test; see patchsets 4-6 for
contents.  However, unit testing of the JNI layer is problematic in
production, so that part of the patch is omitted for final merge.

Bug: 291500341
Test: atest bluetooth_test_gd_unit, atest net_test_stack_btm
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:7a5c71c32d382c0e14083f0d093ae4f5420968ff)
Merged-In: I3e5e3c51412640aa19f0981caaa809313d6ad030
Change-Id: I3e5e3c51412640aa19f0981caaa809313d6ad030

a2dp_vendor_opus_decoder_decode_packet calls opus_decode() to decode
frames.  If initial decoding fails, it retries with a different set of
parameters; however, no further checks are included after the retry, and
the return value is then used to generate frame size.  If the retry
fails, the return value will be negative, which when converted to
unsigned to scale the frame buffer will lead to an enormous size which
easily overflows the frame buffer.

Add a check for this case.

Bug: 275626001
Test: atest bluetooth_test_gd_unit, net_test_stack_btm
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c7b6e560eda0e43dcac6ca8298fe01ee0762f508)
Merged-In: Ie8ec891bf5e2537eeee9272f550ae23f8797a878
Change-Id: Ie8ec891bf5e2537eeee9272f550ae23f8797a878

Original bug
Bug: 294854926

regressions:
Bug: 299570702
Bug: 299561281

Test: m com.android.btservices
Test: QA validation
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:7db69a79091ec0199ddbac2a7b8cf1e0b57631d9)
Merged-In: I0370ed2e3166d56f708e1981c2126526e1db9eaa
Change-Id: I0370ed2e3166d56f708e1981c2126526e1db9eaa

Original bug
Bug: 294854926

regressions:
Bug: 299570702

Test: Test: m com.android.btservices
Test: QA validation
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:916b6d3899908ed09f81be131e48933637e4c9ef)
Merged-In: I976a5a6d7bb819fd6accdc71eb1501b9606f3ae4
Change-Id: I976a5a6d7bb819fd6accdc71eb1501b9606f3ae4

Allow access to rfcomm PSM by default

Original bug
Bug: 294854926

Nearby regressions:
Bug: 298539299

Test: m com.android.btservices
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c11c2a2bead295edf18cecf682255a498e84133a)
Merged-In: If1f7c9278a9e877f64ae78b6f067c597fb5d0e66
Change-Id: If1f7c9278a9e877f64ae78b6f067c597fb5d0e66

Reject access to service running on rfcomm

this is a backport of
I10fcc2dcd78fc22ffbe3c425669fc9889b94a166

Bug: 294854926
Test: m com.android.btservices
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:47e6e149f1d4dc557e10033ac9b147d24b37bea9)
Merged-In: I10fcc2dcd78fc22ffbe3c425669fc9889b94a166
Change-Id: I10fcc2dcd78fc22ffbe3c425669fc9889b94a166

Rejecct access to services running on l2cap

Backport of
Idef4ea28eb3d17b0807ab7dc6849433ddc5581b3

Bug: 294854926
Test: m com.android.btservices
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:1f08f638c91169df84a43b6cd4e04d1aa3a5d554)
Merged-In: Idef4ea28eb3d17b0807ab7dc6849433ddc5581b3
Change-Id: Idef4ea28eb3d17b0807ab7dc6849433ddc5581b3

Bug: 275057843
Bug: 275057678
Test: manual
Tag: #security
Ignore-AOSP-First: security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:3bb913ee8c7da4602798db754045c0fac57afecf)
Merged-In: I4c8ec50c15e2727839a49da0e582164557bcd38a
Change-Id: I4c8ec50c15e2727839a49da0e582164557bcd38a

Bug: 275340684
Bug: 282234870
Test: manual
Ignore-AOSP-First: security
Tag: #security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5f9059acdfed500ea5ff4b159795280d5fa2ecbf)
Merged-In: Ia8e9c3a3e534f419b6bd6c902a35d2caf4c7727b
Change-Id: Ia8e9c3a3e534f419b6bd6c902a35d2caf4c7727b

Change-Id: Ia92ddd808beafff9d375d6b7e400ed46ef204113

sdpu_build_uuid_seq accepts a UUID sequence of arbitrary length
but does not validate against the boundaries of the buffer it's
filling.  This can lead to an OOB write.

Add validation.

Bug: 239414876
Test: atest: bluetooth, validated against POC
Tag: #security
Ignore-AOSP-First: Security

(cherry picked from commit 367ed057)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:7a62a311d1a0c229ba75529dbedcb47a7af18142)
Merged-In: Ibce32cc09ad2991789569f35ef2f71f90537fdce
Change-Id: Ibce32cc09ad2991789569f35ef2f71f90537fdce

Change-Id: I59465d02e61e1207eb4dc985fb96dbce1921311f

When p_buf->len is mtu - 1 and p_cmd->multi_req.variable_len
evaluates to true, integer underflow is triggered
in the following line, resulting OOB access.

```
 len = p_rsp->attr_value.len - (total_len - mtu);
```

Bug: 273874525
Test: manual
Ignore-AOSP-First: security
Tag: #security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:85f4d53c7bf90b806639a3a302f0007ffb3b9f23)
Merged-In: Ia60dd829ff9152c083de1f4c1265bb3ad595dcc4
Change-Id: Ia60dd829ff9152c083de1f4c1265bb3ad595dcc4

Change-Id: Ifbaf06c256fdf2147c4c829cf90e39bf4599516c

This reverts commit d5ec5273.

Reason for revert: b/281788858
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:97c9c472f6b63b86bdf9cfd054490051e881c013)
Merged-In: If6fb57064b5b2da40842e2c1cf95aadc6f0351b6
Change-Id: If6fb57064b5b2da40842e2c1cf95aadc6f0351b6

Merge cherrypicks of ['googleplex-android-review.googlesource.com/23695904', 'googleplex-android-review.googlesource.com/23695905'] into udc-release.

Change-Id: I293c802ca4aa84b1d6f9ccd53630959d504748bf

Current logging adds support to measure for A2DP and HFP profile
attempts along with their result and reasons for profile connection
attempts.

Test: m followed by connecting to BT device supporting A2DP and HFP
and then statsd_testdrive 696

Bug: 285027829
(cherry picked from https://android-review.googlesource.com/q/commit:1d02bb3a5f095c162155425acd61812f76b66d56)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:0964e2c746232e21e66843fe7587e92921a6cc0c)
Merged-In: Ie70c5a40a00b57d8c65857151774e6346acced85
Change-Id: Ie70c5a40a00b57d8c65857151774e6346acced85

APCF Feature Selection for AD Type check is bit 8(0x100)

Bug: 281790117
Test: manual
(cherry picked from https://android-review.googlesource.com/q/commit:ea54fff1792c08169ff911467ad666c5a8add796)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:35042736eaeb4b41093bd058a42950656b587440)
Merged-In: I64f301137797a44c69e06e744a653bda72c85b18
Change-Id: I64f301137797a44c69e06e744a653bda72c85b18

Change-Id: Iba1f97239552d846e676158f156e08b5d0443228

* changes:
  Revert "Add direct Telecom check for call state in HFP service"
  Don't treat pthread_t as a signed value type
  Close uhid file and polling thread together

Change-Id: If68cba2d0a4ca3eef17fe31eb0e1301a92db5741

am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/23669519



Change-Id: I4b23c6c284bfe86df7eaaaae6e49372ad76b39a8
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Auto-generated-cl: translation import
Change-Id: I56af61079ab855810bdb922cbb10a713374bdd2d

Auto-generated-cl: translation import
Change-Id: Ia50a05708e2332fe52c5784d9e37d26e1c4b28a5

Change-Id: I421fbb1ed35251d0f2bf6af1a495037cf70d4a24

Change-Id: I5e0fc45276bae03c983590bfb99a23a491681366

Automotive team is unable to use full size device-tests package, and instead is using smaller team owned package replacement called 'automotive-tests'

Test: zip file built and checked for `APK build/soong/soong_ui.bash --make-mode TARGET_PRODUCT=cf_x86_64_auto TARGET_BUILD_VARIANT=userdebug droid dist automotive-tests`
Bug: 284663915
(cherry picked from https://android-review.googlesource.com/q/commit:762dede13d07d7ac3f8497e1ac257d6d70c0ec6a)
Merged-In: I406e1d0ac09016980937832e95bbf0ea770cbba6
Change-Id: I406e1d0ac09016980937832e95bbf0ea770cbba6

* changes:
  Battery: Only connect or disconnect BAS for BLE ACL link
  Check LE audio support before resetting the pairing state
  CSIP: Fix notifying about connected devices
  Ensure services are searched over BR/EDR transport after BR/EDR pairing
  bt: Fix getting device type.
  LE Audio: Return SDP services if GATT discovery on LE transport fails
  LeAudioService: Fix starting scanner
  leaudio: Remove CIG when all ASEs are in the Releasing state
  Fix for infinite loop in free_gatt_resources

This reverts commit ae963f1c.

Reason for revert: b/286003442, b/285806759

Some Bluetooth devices will disconnect if there is no call at the time of open SCO. The change also did not fix the original bug as this seems not to come from Bluetooth.

Bug: 286003442
Bug: 285806759
(cherry picked from https://android-review.googlesource.com/q/commit:2b8630d2f6cde52f8ccaf573311b18411deb70cd)
Merged-In: Ib920e67358ba46e14f646a0c69897abcb38f50ec
Change-Id: Ib920e67358ba46e14f646a0c69897abcb38f50ec

1. HID host treats pthread_t as a signed value. Some platform may define
it as unsigned type.
2. HID host uses -1 as invalid pthread ID. pthread does not define
invalid thread ID.


Bug: 285750089
Test: Floss test "Two BLE connections"
(cherry picked from https://android-review.googlesource.com/q/commit:791d9aa87fa0a1503077a81fa80c51e4c6b620ee)
Merged-In: I77eb1596910ee1a6c9c2244beff7ff382ca57ba0
Change-Id: I77eb1596910ee1a6c9c2244beff7ff382ca57ba0

UHID file descriptor is closed by btif_hh in jni thread on disconnection
or open failure while the UHID polling thread is closed by bta_hh in the
main thread on disconnection.
Closing UHID file descriptor without stopping polling thread can result
in high battery drain.
This change ensures that UHID fd closure is aligned  with closing of the
polling thread.

Bug: 280170626
Test: Regression
(cherry picked from https://android-review.googlesource.com/q/commit:5d0360323fc9157397ddfa035e987c1e9c5258ad)
Merged-In: I64daa836351f1ab3766947353d7824364eb9530f
Change-Id: I64daa836351f1ab3766947353d7824364eb9530f