Merge "Revert "Revert "Validate buffer length in sdpu_build_uuid_seq""" into tm-dev am: bdcc9b8a am: 9d6e514e

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22188831



Change-Id: If564b2839a739ba0c08e8efc6f9c91406831c64c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22188831



Change-Id: I3896da1ac7eca27d1fae53c2c63159513ecaa909
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Merge "RESTRICT AUTOMERGE: Move BMW Carkit(9c:df:03) into IOP table to only use AVRCP 1.3 from 1.4 to resolve interop issues." into tm-qpr-dev

Auto-generated-cl: translation import
Change-Id: I8b62d67e327fc7ac6e98c481c161a21fccb44fc2

RESTRICT AUTOMERGE: Move BMW Carkit(9c:df:03) into IOP table to only use AVRCP 1.3 from 1.4 to resolve interop issues.

Bug: 272518730
Bug: 234548635
Tag: #compatibility
Test: Manual. Refer: go/bmw-x5-car-kit-audio
Ignore-AOSP-First: This change is the tm version of aosp/2514656
Merged-In: Ia3216810f2814b10218981e9ecbe962bfc5e6754
Change-Id: Ibc4ebe01f3d408c72a4d8b9c36118cf0acc7d655

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22343125



Change-Id: I4a333da79dedbfe03b0c6b8253cdf1839f7bd57a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22343125



Change-Id: Ib71e4715f6bf6c5f2c7954d06b1fd5e175df33b9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

btm_ble_periodic_av_sync_lost internally calls the function
btm_ble_get_psync_index_from_handle, which polls the internal periodic
sync buffer and returns a matching index if one exists.  If no matching
handle is found, it returns MAX_SYNC_TRANSACTION.

However, here the calling function lacks the check for this case present
in similar functions.  If no handle is matched, it will attempt to index
the buffer with MAX_SYNC_TRANSACTION, which will overrun it by a single
width and lead to OOB access.

Add handling for this case.

Bug: 273502002
Test: atest bluetooth_test_gd_unit, atest net_test_stack_btm, validated
against researcher POC
Tag: #security
Ignore-AOSP-First: Security

Change-Id: I2e1e95b277f81b2668f721a7693df50841968ec5

Merge "[BluetoothMetrics] Adding dependent changes for direct LE-ACL L2CAP fixed channel" into tm-qpr-dev

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21090924



Change-Id: I72949a74e23dbbb0fd2dbee7bd7eee0b2f0c316a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/21090924



Change-Id: Idfe58b567a3484ddcf8be45e1515b6349ed290f3
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Fix to the regression reported in b/264708304 and b/266585826 added:
The root cause of the regression, the sensor HAL layer expects the HID feature
reports to contain 40 bytes, even less bytes are contained in the data
field.

This updated fix restores the length of data fields with the len arg.

Bug: 259675705
Test: manual verification with a Pixel 6 and LinkBuds
Ignore-AOSP-First: security
Tag: security
Change-Id: I02f16c360965b049fc6c8fdfa0132b7aa54bc1d3

direct LE-ACL L2CAP fixed channel

Bug: 268252025
Change-Id: Ie40ce994abe8bb6023cf039fc3716ac0f35b11c1
Merged-In: Ie40ce994abe8bb6023cf039fc3716ac0f35b11c1

Bug: 264937355
Test: atest BluetoothInstrumentationTests
(cherry picked from https://android-review.googlesource.com/q/commit:c5a164cfbf2771d49ccfa2a501fd8e6fcc490745)
Merged-In: Ica31ffcc22d5a75aa82b9e2f91b9239d63506a40
Change-Id: Ica31ffcc22d5a75aa82b9e2f91b9239d63506a40

Bug: 264937355
Test: atest BluetoothInstrumentationTests
(cherry picked from https://android-review.googlesource.com/q/commit:41d98ac1632528f4a4aa240748773780e5236085)
Merged-In: If7d8aa463decc99cf95437d7a608ed2612323560
Change-Id: If7d8aa463decc99cf95437d7a608ed2612323560

Success Rate as per go/bluetooth-le-connection-metrics.

Unit Tests:
- Successful
- Failure
- Timeout
- Cancellation

Test: atest bluetooth_test_gd_unit:LEConnectionMetricsRemoteDeviceTest --host
Bug: b/268252025
Change-Id: Iddef3b0c873c9999e165078912339b97caf6b265
Merged-In: I7b8618c30d5f1e4dc5b9665e056934c2db888271

Structure length is checked in pan_api.cc after the structure may
be freed, leading to a potential use after free.

Save the buffer length to a local instead.  Note that BNEP_WriteBuf
may alter the length being written internally; this does not appear
to be an issue in this use case because the octet count being tracked
is used only for logging purposes within PAN.

Bug: 259939435
Test: atest bluetooth_test_gd_unit, validate against researcher POC
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I613b3dd3684182bdc725f9e1512061484448d367

sdpu_build_uuid_seq accepts a UUID sequence of arbitrary length
but does not validate against the boundaries of the buffer it's
filling.  This can lead to an OOB write.

Add validation.

Bug: 239414876
Test: atest: bluetooth, validated against POC
Tag: #security
Ignore-AOSP-First: Security

Change-Id: I6c0b91428bd37d73ae707b8a1843338998fb9562
(cherry picked from commit 367ed057)

This reverts commit e6cf2700.

Reason for revert: Reinstate original change for QPR

Change-Id: I3e039f1b8f8ffbcc4875b663d417462451fb76a0

Currently we are leaking GMCS instance every time BT is restarted.

Bug: 273361967
Test: manual, restart bluetooth, observe output of:
adb shell dumpsys bluetooth_manager | grep -A 10 "Server\:"
(cherry picked from https://android-review.googlesource.com/q/commit:db6561f3d907c74055fe74f8e8a5b979da5cd1aa)
Merged-In: I3fabbe267a380a1eae482bb54be5551db9f0029e
Change-Id: I3fabbe267a380a1eae482bb54be5551db9f0029e

Currently, because of aosp/683369 the device will initiate
Codec Negotiation even if the remote device does not send the
required AT+BAC command during Service Level Connection setup.

This enables in the following out-of-spec sequence:
1. Device sends Codec Negotiation NOT supported to a Headset which does.
2. Headset respects the feature not supported, and does not send AT+BAC.
3. Device initiates Codec Negotiation with the Headset anyway.

This check ensures that Device will not attempt to initiate
Codec Negotiation at all if the local feature is not enabled.

Bug: 267171863
Test: make
(cherry picked from https://android-review.googlesource.com/q/commit:4be3e5d58237cfdfa89a7c5324c26c986ef52239)
Merged-In: I446e071e3b66875a2bacde228841ca703acd5739
Change-Id: I446e071e3b66875a2bacde228841ca703acd5739
Bug: 263323082

There is a chance the callback gets invoked right after a AVRC
disconnection and bt_rc_ctrl_callbacks has been cleared.

Tag: stability
Bug: 242208896
Test: presubmit, Bluetooth calling test items
(cherry picked from https://android-review.googlesource.com/q/commit:722854df05ddad0567f5c30db2491afc90d15228)
Merged-In: I649ac336022a20894d2311313d7ed68687bc70a3
Change-Id: I649ac336022a20894d2311313d7ed68687bc70a3
Bug: 263323082

Power modes only work with classic/br_edr

Bug: 262479565
Tag: #refactor
Test: gd/cert/run
(cherry picked from https://android-review.googlesource.com/q/commit:272684810473fe72988475eb307f49305b45904a)
Merged-In: I2b28968159df873aabb2c12f7855beae89c6d653
Change-Id: I2b28968159df873aabb2c12f7855beae89c6d653
Bug: 263323082

Bug: 274037299
Test: presubmit tests
(cherry picked from https://android-review.googlesource.com/q/commit:6e179238dc3b3eaa5f8e26c9eff0d891decae5ea)
Merged-In: I993505cd6656d67362eeefd6bd3abd411e8f59ff
Change-Id: I993505cd6656d67362eeefd6bd3abd411e8f59ff

If doing gatt discovery, we should always send this event to the upper
layer on its conclusion. Otherwise we get the pairing_cb stuck.

Bug: 263050668
Test: manual
(cherry picked from https://android-review.googlesource.com/q/commit:3380f3ddf0dedc8d0cb3ca7256711bff5c2aee98)
Merged-In: I65aa5cddc3fe5a9f5c8b9e2d43d676bf3d9082b7
Change-Id: I07621dd098ad887c82927a3af9f41ac2b31c15b0