Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f81dae45 authored by En-Shuo Hsu's avatar En-Shuo Hsu
Browse files

Floss: Ignore SCO packets with invalid handle 

Print out the error log and ignore the invalid packet without crashing
the stack.

Bug: 249598812
Tag: #floss
Test: Build, deploy and verify SCO works
Change-Id: I03ae086153f30d753d2d59aacca1993c07f9eae9
parent cf6a4252

system/main/shim/hci_layer.cc

+11 −6
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ 
#include "src/bridge.rs.h"

#include "stack/include/bt_hdr.h"

#include "stack/include/bt_types.h"

#include "stack/include/hcimsgs.h"



/**

 * Callback data wrapped as opaque token bundled with the command
@@ -394,8 +395,9 @@ static void transmit_fragment(const uint8_t* stream, size_t length) { 
      handle_with_flags >> 12 & 0b11);

  auto bc_flag =

      static_cast<bluetooth::hci::BroadcastFlag>(handle_with_flags >> 14);

  uint16_t handle = handle_with_flags & 0xFFF;

  ASSERT_LOG(handle <= 0xEFF, "Require handle <= 0xEFF, but is 0x%X", handle);

  uint16_t handle = HCID_GET_HANDLE(handle_with_flags);

  ASSERT_LOG(handle <= HCI_HANDLE_MAX, "Require handle <= 0x%X, but is 0x%X",

             HCI_HANDLE_MAX, handle);

  length -= 2;

  // skip data total length

  stream += 2;
@@ -410,8 +412,10 @@ static void transmit_fragment(const uint8_t* stream, size_t length) { 
static void transmit_sco_fragment(const uint8_t* stream, size_t length) {

  uint16_t handle_with_flags;

  STREAM_TO_UINT16(handle_with_flags, stream);

  uint16_t handle = handle_with_flags & 0xFFF;

  ASSERT_LOG(handle <= 0xEFF, "Require handle <= 0xEFF, but is 0x%X", handle);

  uint16_t handle = HCID_GET_HANDLE(handle_with_flags);

  ASSERT_LOG(handle <= HCI_HANDLE_MAX, "Require handle <= 0x%X, but is 0x%X",

             HCI_HANDLE_MAX, handle);



  length -= 2;

  // skip data total length

  stream += 1;
@@ -432,8 +436,9 @@ static void transmit_iso_fragment(const uint8_t* stream, size_t length) { 
      handle_with_flags >> 12 & 0b11);

  auto ts_flag =

      static_cast<bluetooth::hci::TimeStampFlag>(handle_with_flags >> 14);

  uint16_t handle = handle_with_flags & 0xFFF;

  ASSERT_LOG(handle <= 0xEFF, "Require handle <= 0xEFF, but is 0x%X", handle);

  uint16_t handle = HCID_GET_HANDLE(handle_with_flags);

  ASSERT_LOG(handle <= HCI_HANDLE_MAX, "Require handle <= 0x%X, but is 0x%X",

             HCI_HANDLE_MAX, handle);

  length -= 2;

  // skip data total length

  stream += 2;

system/stack/btm/btm_sco.cc

+19 −3
Original line number Diff line number Diff line
@@ -212,11 +212,27 @@ void btm_route_sco_data(BT_HDR* p_msg) { 
    osi_free(p_msg);

    return;

  }

  uint16_t handle = handle_with_flags & 0xFFF;

  ASSERT_LOG(handle <= 0xEFF, "Require handle <= 0xEFF, but is 0x%X", handle);



  uint16_t handle = HCID_GET_HANDLE(handle_with_flags);

  if (handle > HCI_HANDLE_MAX) {

    LOG_ERROR(

        "Receive invalid SCO data with handle: 0x%X, required to be <= 0x%X, "

        "dropping",

        handle, HCI_HANDLE_MAX);

    osi_free(p_msg);

    return;

  }



  tSCO_CONN* active_sco = btm_get_active_sco();

  if (active_sco == nullptr || active_sco->hci_handle != handle) {

  if (active_sco == nullptr) {

    LOG_ERROR("Received SCO data when there is no active SCO connection");

    osi_free(p_msg);

    return;

  }

  if (active_sco->hci_handle != handle) {

    LOG_ERROR(

        "Drop packet with handle(0x%X) different from the active handle(0x%X)",

        handle, active_sco->hci_handle);

    osi_free(p_msg);

    return;

  }

system/stack/btu/btu_hcif.cc

+5 −0
Original line number Diff line number Diff line
@@ -1127,6 +1127,11 @@ static void btu_hcif_esco_connection_comp_evt(const uint8_t* p) { 
  STREAM_SKIP_UINT8(p);   // air_mode



  handle = HCID_GET_HANDLE(handle);

  ASSERT_LOG(

      handle <= HCI_HANDLE_MAX,

      "Received eSCO connection complete event with invalid handle: 0x%X "

      "that should be <= 0x%X",

      handle, HCI_HANDLE_MAX);



  data.bd_addr = bda;

  if (status == HCI_SUCCESS) {

system/stack/include/hcidefs.h

+3 −0
Original line number Diff line number Diff line
@@ -830,6 +830,9 @@ typedef enum : uint8_t { 
/* Define an invalid value for a handle */

#define HCI_INVALID_HANDLE 0xFFFF



/* Define the max valid value for a connection handle */

#define HCI_HANDLE_MAX 0xEFF



/* Define the preamble length for all HCI Commands.

 * This is 2-bytes for opcode and 1 byte for length

*/