DO NOT MERGE Fix potential DoS caused by delivering signal to BT process (dcde22ea) · Commits · e / os / android_packages_modules_Bluetooth

gki/ulinux/gki_ulinux.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -76,7 +76,7 @@ void GKI_delay(UINT32 timeout_ms) {

		int err;
		do {
		err = nanosleep(&delay, &delay);
		err = TEMP_FAILURE_RETRY(nanosleep(&delay, &delay));
		} while (err == -1 && errno == EINTR);
		}

system/audio_a2dp_hw/audio_a2dp_hw.c

+11 −11

Original line number	Diff line number	Diff line
		@@ -242,7 +242,7 @@ static int skt_read(int fd, void *p, size_t len)

		ts_log("skt_read recv", len, NULL);

		if ((read = recv(fd, p, len, MSG_NOSIGNAL)) == -1)
		if ((read = TEMP_FAILURE_RETRY(recv(fd, p, len, MSG_NOSIGNAL))) == -1)
		{
		ERROR("write failed with errno=%d\n", errno);
		return -1;
		@@ -264,12 +264,12 @@ static int skt_write(int fd, const void *p, size_t len)
		/* poll for 500 ms */

		/* send time out */
		if (poll(&pfd, 1, 500) == 0)
		if (TEMP_FAILURE_RETRY(poll(&pfd, 1, 500)) == 0)
		return 0;

		ts_log("skt_write", len, NULL);

		if ((sent = send(fd, p, len, MSG_NOSIGNAL)) == -1)
		if ((sent = TEMP_FAILURE_RETRY(send(fd, p, len, MSG_NOSIGNAL))) == -1)
		{
		ERROR("write failed with errno=%d\n", errno);
		return -1;
		@@ -300,14 +300,14 @@ static int skt_disconnect(int fd)

		static int a2dp_ctrl_receive(struct a2dp_stream_common common, void buffer, int length)
		{
		int ret = recv(common->ctrl_fd, buffer, length, MSG_NOSIGNAL);
		int ret = TEMP_FAILURE_RETRY(recv(common->ctrl_fd, buffer, length, MSG_NOSIGNAL));
		if (ret < 0)
		{
		ERROR("ack failed (%s)", strerror(errno));
		if (errno == EINTR)
		{
		/* retry again */
		ret = recv(common->ctrl_fd, buffer, length, MSG_NOSIGNAL);
		ret = TEMP_FAILURE_RETRY(recv(common->ctrl_fd, buffer, length, MSG_NOSIGNAL));
		if (ret < 0)
		{
		ERROR("ack failed (%s)", strerror(errno));
		@@ -334,7 +334,7 @@ static int a2dp_command(struct a2dp_stream_common *common, char cmd)
		DEBUG("A2DP COMMAND %s", dump_a2dp_ctrl_event(cmd));

		/* send command */
		if (send(common->ctrl_fd, &cmd, 1, MSG_NOSIGNAL) == -1)
		if (TEMP_FAILURE_RETRY(send(common->ctrl_fd, &cmd, 1, MSG_NOSIGNAL)) == -1)
		{
		ERROR("cmd failed (%s)", strerror(errno));
		skt_disconnect(common->ctrl_fd);
		@@ -407,13 +407,13 @@ static void a2dp_open_ctrl_path(struct a2dp_stream_common *common)
		break;

		ERROR("error : a2dp not ready, wait 250 ms and retry");
		usleep(250000);
		TEMP_FAILURE_RETRY(usleep(250000));
		skt_disconnect(common->ctrl_fd);
		common->ctrl_fd = AUDIO_SKT_DISCONNECTED;
		}

		/* ctrl channel not ready, wait a bit */
		usleep(250000);
		TEMP_FAILURE_RETRY(usleep(250000));
		}
		}

		@@ -576,7 +576,7 @@ static ssize_t out_write(struct audio_stream_out stream, const void buffer,

		DEBUG("emulate a2dp write delay (%d us)", us_delay);

		usleep(us_delay);
		TEMP_FAILURE_RETRY(usleep(us_delay));
		pthread_mutex_unlock(&out->common.lock);
		return -1;
		}
		@@ -950,7 +950,7 @@ static ssize_t in_read(struct audio_stream_in stream, void buffer,

		DEBUG("emulate a2dp read delay (%d us)", us_delay);

		usleep(us_delay);
		TEMP_FAILURE_RETRY(usleep(us_delay));
		pthread_mutex_unlock(&in->common.lock);
		return -1;
		}
		@@ -1077,7 +1077,7 @@ static int adev_open_output_stream(struct audio_hw_device *dev,
		DEBUG("success");
		/* Delay to ensure Headset is in proper state when START is initiated
		from DUT immediately after the connection due to ongoing music playback. */
		usleep(250000);
		TEMP_FAILURE_RETRY(usleep(250000));
		return 0;

		err_open:

system/btif/co/bta_hh_co.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -47,7 +47,7 @@ static tBTA_HH_RPT_CACHE_ENTRY sReportCache[BTA_HH_NV_LOAD_MAX];
		static int uhid_write(int fd, const struct uhid_event *ev)
		{
		ssize_t ret;
		ret = write(fd, ev, sizeof(*ev));
		ret = TEMP_FAILURE_RETRY(write(fd, ev, sizeof(*ev)));
		if (ret < 0){
		int rtn = -errno;
		APPL_TRACE_ERROR("%s: Cannot write to uhid:%s",
		@@ -73,7 +73,7 @@ static int uhid_event(btif_hh_device_t *p_dev)
		APPL_TRACE_ERROR("%s: Device not found",__FUNCTION__)
		return -1;
		}
		ret = read(p_dev->fd, &ev, sizeof(ev));
		ret = TEMP_FAILURE_RETRY(read(p_dev->fd, &ev, sizeof(ev)));
		if (ret == 0) {
		APPL_TRACE_ERROR("%s: Read HUP on uhid-cdev %s", __FUNCTION__,
		strerror(errno));
		@@ -184,7 +184,7 @@ static void btif_hh_poll_event_thread(void arg)
		pfds[0].events = POLLIN;

		while(p_dev->hh_keep_polling){
		ret = poll(pfds, 1, 50);
		ret = TEMP_FAILURE_RETRY(poll(pfds, 1, 50));
		if (ret < 0) {
		APPL_TRACE_ERROR("%s: Cannot poll for fds: %s\n", __FUNCTION__, strerror(errno));
		break;
		@@ -276,7 +276,7 @@ void bta_hh_co_open(UINT8 dev_handle, UINT8 sub_class, tBTA_HH_ATTR_MASK attr_ma
		__FUNCTION__, p_dev->attr_mask, p_dev->sub_class, p_dev->app_id);

		if(p_dev->fd<0) {
		p_dev->fd = open(dev_path, O_RDWR \| O_CLOEXEC);
		p_dev->fd = TEMP_FAILURE_RETRY(open(dev_path, O_RDWR \| O_CLOEXEC));
		if (p_dev->fd < 0){
		APPL_TRACE_ERROR("%s: Error: failed to open uhid, err:%s",
		__FUNCTION__,strerror(errno));
		@@ -303,7 +303,7 @@ void bta_hh_co_open(UINT8 dev_handle, UINT8 sub_class, tBTA_HH_ATTR_MASK attr_ma

		btif_hh_cb.device_num++;
		// This is a new device,open the uhid driver now.
		p_dev->fd = open(dev_path, O_RDWR \| O_CLOEXEC);
		p_dev->fd = TEMP_FAILURE_RETRY(open(dev_path, O_RDWR \| O_CLOEXEC));
		if (p_dev->fd < 0){
		APPL_TRACE_ERROR("%s: Error: failed to open uhid, err:%s",
		__FUNCTION__,strerror(errno));

system/btif/co/bta_hl_co.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -34,6 +34,7 @@
		#include <fcntl.h>
		#include <ctype.h>
		#include <cutils/sockets.h>
		#include <unistd.h>
		#include "bta_api.h"
		#include "btm_api.h"
		#include "bta_sys.h"
		@@ -384,7 +385,7 @@ void bta_hl_co_put_rx_data (UINT8 app_id, tBTA_HL_MDL_HANDLE mdl_handle,
		{
		BTIF_TRACE_DEBUG("app_idx=%d mcl_idx=0x%x mdl_idx=0x%x data_size=%d",
		app_idx, mcl_idx, mdl_idx, data_size);
		r = send(p_dcb->p_scb->socket_id[1], p_dcb->p_rx_pkt, data_size, 0);
		r = TEMP_FAILURE_RETRY(send(p_dcb->p_scb->socket_id[1], p_dcb->p_rx_pkt, data_size, 0));

		if (r == data_size)
		{

system/btif/src/btif_core.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -29,6 +29,7 @@
		#include <ctype.h>
		#include <cutils/properties.h>
		#include <dirent.h>
		#include <errno.h>
		#include <fcntl.h>
		#include <hardware/bluetooth.h>
		#include <stdlib.h>
		@@ -330,10 +331,10 @@ static void btif_fetch_local_bdaddr(bt_bdaddr_t *local_addr)

		BTIF_TRACE_DEBUG("local bdaddr is stored in %s", val);

		if ((addr_fd = open(val, O_RDONLY)) != -1)
		if ((addr_fd = TEMP_FAILURE_RETRY(open(val, O_RDONLY))) != -1)
		{
		memset(val, 0, sizeof(val));
		read(addr_fd, val, FACTORY_BT_BDADDR_STORAGE_LEN);
		TEMP_FAILURE_RETRY(read(addr_fd, val, FACTORY_BT_BDADDR_STORAGE_LEN));
		string_to_bdaddr(val, local_addr);
		/* If this is not a reserved/special bda, then use it */
		if (memcmp(local_addr->address, null_bdaddr, BD_ADDR_LEN) != 0)