Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c038e3f4 authored by yamei du's avatar yamei du Committed by Jakub Pawłowski
Browse files

btm_sec: Fix crash caused by uncleared authentication collision info 

Authentication collision info was not cleared correctly after
authentication failure, the remaining data may cause crash in
btm_sec_link_key_request() in furture.

Bug: 323960893
Bug: 327208896
Test: m com.android.btservices
Test: Manual | Simultaneously initiate classic Bluetooth pairing from
both the local and remote devices, decline the pairing request on the
local device, and then repeat the test.
Flag: clear_collision_state_on_pairing_complete
Change-Id: I93297db7b833430b165bd68c0319bd5e00e545fa
parent 09b86f65

system/stack/btm/btm_sec.cc

+23 −2
Original line number Diff line number Diff line
@@ -2974,7 +2974,17 @@ void btm_sec_auth_complete(uint16_t handle, tHCI_STATUS status) { 
    return;

  }



  if (com::android::bluetooth::flags::clear_collision_state_on_pairing_complete()) {

    if (p_dev_rec && btm_sec_cb.p_collided_dev_rec &&

        p_dev_rec->bd_addr == btm_sec_cb.p_collided_dev_rec->bd_addr) {

      btm_sec_cb.collision_start_time = 0;

      btm_sec_cb.p_collided_dev_rec = NULL;

      if (alarm_is_scheduled(btm_sec_cb.sec_collision_timer))

        alarm_cancel(btm_sec_cb.sec_collision_timer);

    }

  } else {

    btm_sec_cb.collision_start_time = 0;

  }



  btm_restore_mode();
@@ -3705,6 +3715,16 @@ void btm_sec_disconnected(uint16_t handle, tHCI_REASON reason, std::string comme 
  /* clear unused flags */

  p_dev_rec->sm4 &= BTM_SM4_TRUE;



  if (com::android::bluetooth::flags::clear_collision_state_on_pairing_complete()) {

    if (btm_sec_cb.p_collided_dev_rec &&

        p_dev_rec->bd_addr == btm_sec_cb.p_collided_dev_rec->bd_addr) {

      log::debug("clear auth collision info after disconnection");

      btm_sec_cb.collision_start_time = 0;

      btm_sec_cb.p_collided_dev_rec = NULL;

      if (alarm_is_scheduled(btm_sec_cb.sec_collision_timer))

        alarm_cancel(btm_sec_cb.sec_collision_timer);

    }

  }

  /* If we are in the process of bonding we need to tell client that auth failed

   */

  const uint8_t old_pairing_flags = btm_sec_cb.pairing_flags;
@@ -4014,7 +4034,8 @@ void btm_sec_link_key_request(const RawAddress bda) { 
  }



  if ((btm_sec_cb.pairing_state == BTM_PAIR_STATE_WAIT_PIN_REQ) &&

      (btm_sec_cb.collision_start_time != 0) && (btm_sec_cb.p_collided_dev_rec->bd_addr == bda)) {

      (btm_sec_cb.collision_start_time != 0) &&

      (btm_sec_cb.p_collided_dev_rec && btm_sec_cb.p_collided_dev_rec->bd_addr == bda)) {

    log::verbose(

            "btm_sec_link_key_request() rejecting link key req State: {} "

            "START_TIMEOUT : {}",