Skip to content
Snippets Groups Projects
Select Git revision
0 results
Search by author
  • Any Author
  • Adithya R Adithya R adithya2306
  • Ali Ali ali-nasiri-80
  • Dhina17 Dhina17 Dhina17
  • electimon electimon electimon
  • Erfan Abdi Erfan Abdi erfanoabdi
  • Farzin Kazemzadeh Farzin Kazemzadeh itisFarzin
  • LMO BuildBot LMO BuildBot lmo-buildbot
  • LMO GerritBot LMO GerritBot lmo-gerritbot
  • Mohammad Hasan Keramat J Mohammad Hasan Keramat J ikeramat
  • Nick Nick nift4
10 authors
  1. Oct 14, 2024
    • Brian Delwiche's avatar
      Fix OOB writes in gatt_sr.cc · c7468e64
      Brian Delwiche authored 
      At various points in gatt_sr.cc, the output of the
gatt_tcb_get_payload_size function is used without checking for a
positive length.  However, in exceptional cases it is possible for the
channel to be closed at the time the function is called, which will lead
to a zero length and cause an OOB write in subsequent processing.

Fix all of these.

Bug: 364026473
Bug: 364027038
Bug: 364027949
Bug: 364025411
Test: m libbluetooth
Test: researcher POC
Flag: EXEMPT trivial validity checks
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from commit 7de5617f)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:130861eadc3d9eda593df949666e561dd1f020fc)
Merged-In: I9b30499d4aed6ab42f3cdb2c0de7df2c1a827404
Change-Id: I9b30499d4aed6ab42f3cdb2c0de7df2c1a827404
      c7468e64
  3. Oct 09, 2024
  5. Jan 11, 2024
  7. Dec 16, 2023
  9. Dec 06, 2023
  11. Aug 22, 2023
  13. May 16, 2023
    • Brian Delwiche's avatar
      Fix integer overflow in build_read_multi_rsp · badb8ffc
      Brian Delwiche authored 
      Local variables tracking structure size in build_read_multi_rsp are of
uint16 type but accept a full uint16 range from function arguments while
appending a fixed-length offset.  This can lead to an integer overflow
and unexpected behavior.

Change the locals to size_t, and add a check during reasssignment.

Bug: 273966636
Test: atest bluetooth_test_gd_unit, net_test_stack_btm
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I3a74bdb0d003cb6bf4f282615be8c68836676715
(cherry picked from commit 70a4d628)
      badb8ffc
  15. Apr 27, 2023
    • Henri Chataing's avatar
      Remove extern specifiers from function prototype declarations · 4e3bbe9a
      Henri Chataing authored 
      The extern specifier in this case has no effect as the default
for functions is to have external linkage. However the extern
specifier affects code search ability to explore function
declarations and occurences as the prototype differs from
the declaration.

Test: mmm packages/modules/Bluetooth
Bug: 279964152
Change-Id: I4f2e680d49068a0f708c40373bbe865e110f7db1
      4e3bbe9a
  17. Apr 26, 2023
    • Brian Delwiche's avatar
      Fix integer overflow in build_read_multi_rsp · 70a4d628
      Brian Delwiche authored 
      Local variables tracking structure size in build_read_multi_rsp are of
uint16 type but accept a full uint16 range from function arguments while
appending a fixed-length offset.  This can lead to an integer overflow
and unexpected behavior.

Change the locals to size_t, and add a check during reasssignment.

Bug: 273966636
Test: atest bluetooth_test_gd_unit, net_test_stack_btm
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I3a74bdb0d003cb6bf4f282615be8c68836676715
      70a4d628
    • Brian Delwiche's avatar
      Fix UAF in gatt_cl.cc · 5691da36
      Brian Delwiche authored 
      gatt_cl.cc accesses a header field after the buffer holding it may have
been freed.

Track the relevant state as a local variable instead.

Bug: 274617156
Test: atest: bluetooth, validated against fuzzer
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I085ecfa1a9ba098ecbfecbd3cb3e263ae13f9724
      5691da36
  19. Apr 18, 2023
  21. Apr 14, 2023
    • Rahul Arya's avatar
      [Connection Manager] Call into connection manager from C++ · b53199c9
      Rahul Arya authored 
      We are basically taking all the old entry points for the C++ connection manager,
as well as all other entrypoints into le_impl, and sending them to Rust instead.

Note that APIs are not implemented and so will crash on invocation.

Bug: 272572974
Test: compiles
Change-Id: I918d0ede0f42c74e1d00082c97854b0359b57ef6
      b53199c9
  23. Apr 11, 2023
    • Brian Delwiche's avatar
      Fix UAF in gatt_cl.cc · cbaa8362
      Brian Delwiche authored 
      gatt_cl.cc accesses a header field after the buffer holding it may have
been freed.

Track the relevant state as a local variable instead.

Bug: 274617156
Test: atest: bluetooth, validated against fuzzer
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I085ecfa1a9ba098ecbfecbd3cb3e263ae13f9724
      cbaa8362
  25. Mar 28, 2023
    • tyiu's avatar
      Fix gatt_end_operation buffer overflow · 7236e449
      tyiu authored 
      Added boundary check for gatt_end_operation to prevent writing out of
boundary.

Since response of the GATT server is handled in
gatt_client_handle_server_rsp() and gatt_process_read_rsp(), the maximum
lenth that can be passed into the handlers is bounded by
GATT_MAX_MTU_SIZE, which is set to 517, which is greater than
GATT_MAX_ATTR_LEN which is set to 512. The fact that there is no spec
that gaurentees MTU response to be less than or equal to 512 bytes can
cause a buffer overflow when performing memcpy without length check.

Bug: 261068592
Test: No test since not affecting behavior
Tag: #security
Ignore-AOSP-First: security

Change-Id: I49e2797cd9300ee4cd69f2c7fa5f0073db78b873
      7236e449
  27. Mar 26, 2023
  29. Mar 24, 2023
  31. Mar 23, 2023
    • Łukasz Rymanowski's avatar
      gatt: Fix handling MTU Exchange request · e778518d
      Łukasz Rymanowski authored 
      With this patch Android will always do only one MTU Exchange request as
per specification. For this reason Android always uses
GATT_MAX_MTU_SIZE as this is what easly GATT can handle in the Bluetooth
Stack.

This is done so the single application request cannot block other
applications from using bigger MTU than the one requested by the first
application.

For backward compatibility, the for Data Length Extension the MTU from
the User is used and not the one which was internally requested by the GATT

Bug: 257250188
Bug: 239776509
Test: atest BluetoothInstrumentationTests
Test: manual testing
Tag: #feature
Change-Id: I157d40040b53cd4595403d99e58e105709099684
      e778518d
  33. Mar 20, 2023
    • David Duarte's avatar
      Remove dependency on libprocessgroup.so · 80610593
      David Duarte authored 
      libprocessgroup.so was pulling in libcgrouprc.so
which added a requireNativeLib to our apex requiring
coverage for it.

libprocessgroup.so was only used to raise the priority
of a uipc task, which is a legacy way of the stack to send
audio and should be replaced by HIDL or AIDL.

Test: libcgrouprc is not part of requireNativeLibs in apex_manifest
Fix: 274006628
Fix: 274008074
Fix: 274008052
Fix: 274008062
Fix: 274006620
Fix: 274004991
Change-Id: I5f38bf4c80b29c3c603b59f641ec86cdac608204
      80610593
  35. Mar 17, 2023
  37. Mar 09, 2023
    • Rahul Arya's avatar
      [Private GATT] Add support for MTU Exchange · 189169e5
      Rahul Arya authored 
      Snoop MTU_REQ/RSP packets from legacy stack, and use them to track the
MTU used in the isolated server.

Bug: 255880936
Test: unit

Change-Id: Ifcaa35be47abdbf714b592318184701645b55800
      189169e5
  39. Mar 01, 2023
  41. Feb 28, 2023
  43. Feb 17, 2023
    • William Escande's avatar
      Fix some tidy error · 103c8cdb
      William Escande authored 
      ```
warning: argument name 'chg_aware' in comment does not match parameter
name 'chg_unaware' [bugprone-argument-comment]
    if (tcb.in_use) gatt_sr_update_cl_status(tcb, /* chg_aware= */ false);
                                                  ^~~~~~~~~~~~~~~~
                                                  /* chg_unaware= */
note: 'chg_unaware' declared here
extern void gatt_sr_update_cl_status(tGATT_TCB& tcb, bool chg_unaware);
                                                          ^
warning: the parameter 'name' is copied for each invocation but only
used as a const reference; consider making it a const reference
tGATT_IF GATT_Register(const Uuid& app_uuid128, std::string name,
                                                            ^
                                                const      &
warning: the parameter 's' is copied for each invocation but only used
as a const reference; consider making it a const reference
  void Push(std::string s) {
                        ^
            const      &
```

Test: build with tidy
Change-Id: I0827dd82bb90505a63e0ad4a87b6dfb1f78dd3b5
      103c8cdb
    • Josh Wu's avatar
      gatts load bonded for service change · 9d8e896a
      Josh Wu authored 
      Prepare list of bonded devices that will need service change updates
after BT restarted.

Cherry-picked from wear os

Bug: 263323082
Bug: 162948473
Bug: 251157966
Test: atest net_test_stack
Change-Id: I7f3541a21e2c4a629498fd91d3a6438135a760e0
(cherry picked from commit 5f3719499b6ca547086d5a2ad8f6d3fca748deb3)
(cherry picked from commit 3d83a0ff)
Merged-In: I7f3541a21e2c4a629498fd91d3a6438135a760e0
      9d8e896a
  45. Feb 16, 2023
    • Chris Manton's avatar
      Canonicalize include stack::gatt::gatt_api · ec97ceec
      Chris Manton authored 
      Bug: 197478351
Tag: #refactor
Test: gd/cert/run
Bug: 263323082
Change-Id: I69dd0bb22521face4c6186e2ddca4b184e47d751
(cherry picked from commit 04418c97)
Merged-In: I69dd0bb22521face4c6186e2ddca4b184e47d751
      ec97ceec
    • Josh Wu's avatar
      gatts load bonded for service change · 3d83a0ff
      Josh Wu authored 
      Prepare list of bonded devices that will need service change updates
after BT restarted.

Cherry-picked from wear os

Bug: 263323082
Bug: 162948473
Bug: 251157966
Test: atest net_test_stack
Change-Id: I7f3541a21e2c4a629498fd91d3a6438135a760e0
(cherry picked from commit 5f3719499b6ca547086d5a2ad8f6d3fca748deb3)
      3d83a0ff
  47. Feb 14, 2023
    • Mehmet Murat Sevim's avatar
      Omit SDP records for GATT services if GATT over BR/EDR is disabled. · c30d78a6
      Mehmet Murat Sevim authored 
      Adding these records would be misleading since the services are not
available over BR/EDR. In particular, Generic Attribute Profile
record is an indicator that GATT over BR/EDR is supported.

Renaming the property for homogeneity

Cherry-picked from wear-os

Bug: 263323082
Bug: 234331631
Bug: 248147531
Test: manual - verified iOS no longer tries to use GATT over BR/EDR
Change-Id: I3f608352b3ae78769ac8d087f19ed7494109d214
(cherry picked from commit afb96e955b55b9f33fd08cc05235ff15573e428c)
(cherry picked from commit b059caa9)
Merged-In: I3f608352b3ae78769ac8d087f19ed7494109d214
      c30d78a6
  49. Feb 13, 2023
    • Mehmet Murat Sevim's avatar
      Omit SDP records for GATT services if GATT over BR/EDR is disabled. · b059caa9
      Mehmet Murat Sevim authored 
      Adding these records would be misleading since the services are not
available over BR/EDR. In particular, Generic Attribute Profile
record is an indicator that GATT over BR/EDR is supported.

Renaming the property for homogeneity

Cherry-picked from wear-os

Bug: 263323082
Bug: 234331631
Bug: 248147531
Test: manual - verified iOS no longer tries to use GATT over BR/EDR
Change-Id: I3f608352b3ae78769ac8d087f19ed7494109d214
(cherry picked from commit afb96e955b55b9f33fd08cc05235ff15573e428c)
      b059caa9
  51. Feb 06, 2023
  53. Feb 04, 2023
    • William Escande's avatar
      GATT HANDLE: from build time to runtime config · 5b390edc
      William Escande authored 
      replace GATT_DEFAULT_START_HANDLE and GATT_LAST_HANDLE with system
properties to allow configuration on wear target. New properties are:
  bluetooth.gatt.default_start_handle.value
  bluetooth.gatt.last_handle.value

Bug: 263323082
Test: Build + manual on watches / no-op for phone
Change-Id: I816766103db26bcfbbf3dd1bfc7544bdb491ea31
(cherry picked from commit 19b74ec9)
Merged-In: I816766103db26bcfbbf3dd1bfc7544bdb491ea31
      5b390edc
  55. Feb 03, 2023
  57. Feb 02, 2023
    • William Escande's avatar
      GATT HANDLE: from build time to runtime config · 19b74ec9
      William Escande authored 
      replace GATT_DEFAULT_START_HANDLE and GATT_LAST_HANDLE with system
properties to allow configuration on wear target. New properties are:
  bluetooth.gatt.default_start_handle.value
  bluetooth.gatt.last_handle.value

Bug: 263323082
Test: Build + manual on watches / no-op for phone
Change-Id: I816766103db26bcfbbf3dd1bfc7544bdb491ea31
      19b74ec9
  59. Jan 28, 2023
  61. Jan 20, 2023