Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2739627 authored by Treehugger Robot's avatar Treehugger Robot Committed by Gerrit Code Review
Browse files

Merge changes from topic "bt_SQ1A.220205.002" 

* changes:
  Reset the IRK after all devices are unpaired
  security: Use-After-Free in btm_sec_[dis]connected
parents 8553416a 45179bdc

system/bta/dm/bta_dm_act.cc

+8 −0
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ 
#include "bta/dm/bta_dm_int.h"

#include "bta/gatt/bta_gattc_int.h"

#include "bta/include/bta_dm_ci.h"

#include "btif/include/btif_config.h"

#include "btif/include/btif_dm.h"

#include "btif/include/btif_storage.h"

#include "btif/include/stack_manager.h"
@@ -658,6 +659,13 @@ void bta_dm_remove_device(const RawAddress& bd_addr) { 
  if (!other_address_connected && !other_address.IsEmpty()) {

    bta_dm_process_remove_device(other_address);

  }



  /* Check the length of the paired devices, and if 0 then reset IRK */

  auto paired_devices = btif_config_get_paired_devices();

  if (paired_devices.empty()) {

    LOG_INFO("Last paired device removed, resetting IRK");

    btm_ble_reset_id();

  }

}



/*******************************************************************************

system/stack/btm/btm_sec.cc

+1 −1
Original line number Diff line number Diff line
@@ -3378,7 +3378,6 @@ static void btm_sec_connect_after_reject_timeout(UNUSED_ATTR void* data) { 
void btm_sec_connected(const RawAddress& bda, uint16_t handle,

                       tHCI_STATUS status, uint8_t enc_mode,

                       tHCI_ROLE assigned_role) {

  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bda);

  tBTM_STATUS res;

  bool is_pairing_device = false;

  bool addr_matched;
@@ -3386,6 +3385,7 @@ void btm_sec_connected(const RawAddress& bda, uint16_t handle, 


  btm_acl_resubmit_page();



  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bda);

  if (!p_dev_rec) {

    LOG_DEBUG(

        "Connected to new device state:%s handle:0x%04x status:%s "

system/test/mock/mock_stack_btm_ble.cc

+3 −0
Original line number Diff line number Diff line
@@ -252,3 +252,6 @@ void read_phy_cb( 
    uint8_t* data, uint16_t len) {

  mock_function_count_map[__func__]++;

}

void btm_ble_reset_id(void) {

  mock_function_count_map[__func__]++;

}