Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ble/bluedroid): BLE GAP/ACL/ISO/SCO null checks, evt_len and resource handling

Browse Source 
- btm_acl: malloc/list_append failure handling, remove/memset order in btm_acl_removed
- btm_ble: remove incorrect sec_flags in SMP_OOB/NC/SC_OOB fall-through
- btm_ble_5_gap: btm_ble_hci_status_to_str unreachable return,
  BTM_BleSetExtendedAdvParams/BleStartExtAdv leak and bounds
- btm_ble_addr: fix indent in btm_find_dev_by_identity_addr
- btm_ble_gap: null check p_service_data, pass evt_len to btm_ble_process_adv_pkt,
  bounds in process_adv_pkt
- btm_ble_iso: align param types with declaration
- btm_ble_privacy: handle BTM_BLE_IRK_LIST_INVALID_INDEX in update_resolving_list,
  comment fixes
- btm_devctl: fix btm_vsc_complete param order/type
- btm_sco: add evt_len to btm_sco_process_num_completed_pkts for bounds check
- btm_ble_int.h/btm_int.h: add evt_len to process_adv_pkt and
  process_num_completed_pkts declarations


(cherry picked from commit 65b2cb2728)

Co-authored-by: zhiweijian <zhiweijian@espressif.com>
This commit is contained in:
Zhi Wei Jian
2026-03-25 13:58:36 +08:00
parent 82782f853c
commit c03a27565c
11 changed files with 166 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files

185
components/bt/host/bluedroid/stack/btm/btm_acl.c
View File

@@ -362,128 +362,131 @@ void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, UINT8 bdn[BTM_MAX_REM_BD_NAME_L
}
else {
p = (tACL_CONN *)osi_malloc(sizeof(tACL_CONN));
if (p && !list_append(btm_cb.p_acl_db_list, p)) {
if (p == NULL) {
BTM_TRACE_ERROR("btm_acl_created: osi_malloc failed for tACL_CONN\n");
return;
}
if (!list_append(btm_cb.p_acl_db_list, p)) {
BTM_TRACE_ERROR("btm_acl_created: list_append failed\n");
osi_free(p);
return;
}
if (p) {
memset(p, 0, sizeof(tACL_CONN));
p->in_use = TRUE;
p->hci_handle = hci_handle;
p->link_role = link_role;
p->link_up_issued = FALSE;
memcpy (p->remote_addr, bda, BD_ADDR_LEN);
/* Set the default version of the peer device to version4.0 before exchange the version with it.
If the peer device act as a master and don't exchange the version with us, then it can only use the
legacy connect instead of secure connection in the pairing step. */
p->lmp_version = HCI_PROTO_VERSION_4_0;
memset(p, 0, sizeof(tACL_CONN));
p->in_use = TRUE;
p->hci_handle = hci_handle;
p->link_role = link_role;
p->link_up_issued = FALSE;
memcpy (p->remote_addr, bda, BD_ADDR_LEN);
/* Set the default version of the peer device to version4.0 before exchange the version with it.
If the peer device act as a master and don't exchange the version with us, then it can only use the
legacy connect instead of secure connection in the pairing step. */
p->lmp_version = HCI_PROTO_VERSION_4_0;
#if BLE_INCLUDED == TRUE
p->transport = transport;
p->transport = transport;
#if BLE_PRIVACY_SPT == TRUE
if (transport == BT_TRANSPORT_LE) {
btm_ble_refresh_local_resolvable_private_addr(bda,
btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
}
if (transport == BT_TRANSPORT_LE) {
btm_ble_refresh_local_resolvable_private_addr(bda,
btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
}
#else
p->conn_addr_type = BLE_ADDR_PUBLIC;
memcpy(p->conn_addr, &controller_get_interface()->get_address()->address, BD_ADDR_LEN);
BTM_TRACE_DEBUG ("conn_addr: RemBdAddr: %02x%02x%02x%02x%02x%02x\n",
p->conn_addr[0], p->conn_addr[1], p->conn_addr[2], p->conn_addr[3], p->conn_addr[4], p->conn_addr[5]);
p->conn_addr_type = BLE_ADDR_PUBLIC;
memcpy(p->conn_addr, &controller_get_interface()->get_address()->address, BD_ADDR_LEN);
BTM_TRACE_DEBUG ("conn_addr: RemBdAddr: %02x%02x%02x%02x%02x%02x\n",
p->conn_addr[0], p->conn_addr[1], p->conn_addr[2], p->conn_addr[3], p->conn_addr[4], p->conn_addr[5]);
#endif
#endif
#if (CLASSIC_BT_INCLUDED == TRUE)
p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
p->p_pm_mode_db = btm_pm_sm_alloc();
p->p_pm_mode_db = btm_pm_sm_alloc();
#if BTM_PM_DEBUG == TRUE
BTM_TRACE_DEBUG( "btm_pm_sm_alloc handle:%d st:%d", hci_handle, p->p_pm_mode_db->state);
BTM_TRACE_DEBUG( "btm_pm_sm_alloc handle:%d st:%d", hci_handle, p->p_pm_mode_db->state);
#endif // BTM_PM_DEBUG
#endif // (CLASSIC_BT_INCLUDED == TRUE)
#if (CLASSIC_BT_INCLUDED == TRUE)
btm_sec_update_legacy_auth_state(p, BTM_ACL_LEGACY_AUTH_NONE);
btm_sec_update_legacy_auth_state(p, BTM_ACL_LEGACY_AUTH_NONE);
#endif
if (dc) {
memcpy (p->remote_dc, dc, DEV_CLASS_LEN);
}
if (dc) {
memcpy (p->remote_dc, dc, DEV_CLASS_LEN);
}
if (bdn) {
memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
}
if (bdn) {
memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
}
/* if BR/EDR do something more */
if (transport == BT_TRANSPORT_BR_EDR) {
btsnd_hcic_read_rmt_clk_offset (p->hci_handle);
btsnd_hcic_rmt_ver_req (p->hci_handle);
}
p_dev_rec = btm_find_dev_by_handle (hci_handle);
/* if BR/EDR do something more */
if (transport == BT_TRANSPORT_BR_EDR) {
btsnd_hcic_read_rmt_clk_offset (p->hci_handle);
btsnd_hcic_rmt_ver_req (p->hci_handle);
}
p_dev_rec = btm_find_dev_by_handle (hci_handle);
#if (BLE_INCLUDED == TRUE)
if (p_dev_rec ) {
BTM_TRACE_DEBUG ("device_type=0x%x\n", p_dev_rec->device_type);
}
if (p_dev_rec ) {
BTM_TRACE_DEBUG ("device_type=0x%x\n", p_dev_rec->device_type);
}
#endif
if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
if (!p_dev_rec->remote_secure_connection_previous_state) {
/* If remote features already known, copy them and continue connection setup */
if ((p_dev_rec->num_read_pages) &&
(p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
memcpy (p->peer_lmp_features, p_dev_rec->features,
(HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
p->num_read_pages = p_dev_rec->num_read_pages;
if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
if (!p_dev_rec->remote_secure_connection_previous_state) {
/* If remote features already known, copy them and continue connection setup */
if ((p_dev_rec->num_read_pages) &&
(p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
memcpy (p->peer_lmp_features, p_dev_rec->features,
(HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
p->num_read_pages = p_dev_rec->num_read_pages;
#if (CLASSIC_BT_INCLUDED == TRUE)
const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
#endif ///CLASSIC_BT_INCLUDED == TRUE
/* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */
/* Store the Peer Security Capabilities (in SM4 and rmt_sec_caps) */
#if (SMP_INCLUDED == TRUE)
btm_sec_set_peer_sec_caps(p, p_dev_rec);
btm_sec_set_peer_sec_caps(p, p_dev_rec);
#endif ///SMP_INCLUDED == TRUE
#if (CLASSIC_BT_INCLUDED == TRUE)
BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend);
if (req_pend) {
/* Request for remaining Security Features (if any) */
l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
}
#endif ///CLASSIC_BT_INCLUDED == TRUE
btm_establish_continue (p);
return;
BTM_TRACE_API("%s: pend:%d\n", __FUNCTION__, req_pend);
if (req_pend) {
/* Request for remaining Security Features (if any) */
l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
}
} else {
/* If remote features indicated secure connection (SC) mode, check the remote features again*/
/* this is to prevent from BIAS attack where attacker can downgrade SC mode*/
btm_read_remote_features (p->hci_handle);
#endif ///CLASSIC_BT_INCLUDED == TRUE
btm_establish_continue (p);
return;
}
}
#if (BLE_INCLUDED == TRUE)
/* If here, features are not known yet */
if (p_dev_rec && transport == BT_TRANSPORT_LE) {
#if BLE_PRIVACY_SPT == TRUE
btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr,
&p->active_remote_addr_type);
#endif
if (link_role == HCI_ROLE_MASTER) {
btsnd_hcic_ble_read_remote_feat(p->hci_handle);
} else if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array)
&& link_role == HCI_ROLE_SLAVE) {
btsnd_hcic_rmt_ver_req (p->hci_handle);
} else {
btm_establish_continue(p);
}
} else
#endif
{
} else {
/* If remote features indicated secure connection (SC) mode, check the remote features again*/
/* this is to prevent from BIAS attack where attacker can downgrade SC mode*/
btm_read_remote_features (p->hci_handle);
}
/* read page 1 - on rmt feature event for buffer reasons */
return;
}
#if (BLE_INCLUDED == TRUE)
/* If here, features are not known yet */
if (p_dev_rec && transport == BT_TRANSPORT_LE) {
#if BLE_PRIVACY_SPT == TRUE
btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr,
&p->active_remote_addr_type);
#endif
if (link_role == HCI_ROLE_MASTER) {
btsnd_hcic_ble_read_remote_feat(p->hci_handle);
} else if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array)
&& link_role == HCI_ROLE_SLAVE) {
btsnd_hcic_rmt_ver_req (p->hci_handle);
} else {
btm_establish_continue(p);
}
} else
#endif
{
btm_read_remote_features (p->hci_handle);
}
/* read page 1 - on rmt feature event for buffer reasons */
return;
}
}
@@ -593,11 +596,9 @@ void btm_acl_removed (BD_ADDR bda, tBT_TRANSPORT transport)
#if (CLASSIC_BT_INCLUDED == TRUE)
list_remove(btm_cb.p_pm_mode_db_list, p->p_pm_mode_db);
#endif // #if (CLASSIC_BT_INCLUDED == TRUE)
/* Clear the ACL connection data */
memset(p, 0, sizeof(tACL_CONN));
if (list_remove(btm_cb.p_acl_db_list, p)) {
p = NULL;
}
/* Remove and free the ACL connection data */
list_remove(btm_cb.p_acl_db_list, p);
p = NULL;
}
}

4
components/bt/host/bluedroid/stack/btm/btm_ble.c
View File

@@ -2173,9 +2173,7 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data)
case SMP_OOB_REQ_EVT:
case SMP_NC_REQ_EVT:
case SMP_SC_OOB_REQ_EVT:
/* fall through */
p_dev_rec->sec_flags |= BTM_SEC_LE_AUTHENTICATED;
/* fall through */
case SMP_SEC_REQUEST_EVT:
if (event == SMP_SEC_REQUEST_EVT && btm_cb.pairing_state != BTM_PAIR_STATE_IDLE) {
BTM_TRACE_DEBUG("%s: Ignoring SMP Security request", __func__);

22
components/bt/host/bluedroid/stack/btm/btm_ble_5_gap.c
View File

@@ -203,8 +203,6 @@ static const char *btm_ble_hci_status_to_str(tHCI_STATUS status)
default:
return "Invalid HCI status code.";
}
return NULL;
}
#endif /* !UC_BT_STACK_NO_LOG */
@@ -384,6 +382,7 @@ tBTM_STATUS BTM_BleSetExtendedAdvParams(UINT8 instance, tBTM_BLE_GAP_EXT_ADV_PAR
if ((status = btm_ble_ext_adv_params_validate(params)) != BTM_SUCCESS) {
BTM_TRACE_ERROR("%s, invalid extend adv params.", __func__);
goto end;
}
if (params->type & BTM_BLE_GAP_SET_EXT_ADV_PROP_CONNECTABLE) {
@@ -567,10 +566,6 @@ tBTM_STATUS BTM_BleStartExtAdv(BOOLEAN enable, UINT8 num, tBTM_BLE_EXT_ADV *ext_
BTM_TRACE_ERROR("LE EA En=%d: cmd err=0x%x", enable, err);
status = BTM_HCI_ERROR | err;
}
osi_free(instance);
osi_free(duration);
osi_free(max_events);
} else {
// enable = false, num == 0 or ext_adv = NULL
@@ -584,6 +579,15 @@ tBTM_STATUS BTM_BleStartExtAdv(BOOLEAN enable, UINT8 num, tBTM_BLE_EXT_ADV *ext_
end:
if (instance) {
osi_free(instance);
}
if (duration) {
osi_free(duration);
}
if (max_events) {
osi_free(max_events);
}
if (!enable && status == BTM_SUCCESS) {
// disable all ext adv
@@ -602,6 +606,9 @@ end:
for (uint8_t i = 0; i < num; i++)
{
uint8_t index = ext_adv[i].instance;
if (index >= MAX_BLE_ADV_INSTANCE) {
continue;
}
adv_record[index].invalid = false;
adv_record[index].enabled = false;
adv_record[index].instance = INVALID_VALUE_8BIT;
@@ -616,6 +623,9 @@ end:
for (uint8_t i = 0; i < num; i++)
{
uint8_t index = ext_adv[i].instance;
if (index >= MAX_BLE_ADV_INSTANCE) {
continue;
}
adv_record[index].invalid = true;
adv_record[index].enabled = true;
adv_record[index].instance = ext_adv[i].instance;

4
components/bt/host/bluedroid/stack/btm/btm_ble_addr.c
View File

@@ -441,12 +441,12 @@ tBTM_SEC_DEV_REC *btm_find_dev_by_identity_addr(BD_ADDR bd_addr, UINT8 addr_type
context.free_check = FALSE;
p_node = list_foreach(btm_cb.p_sec_dev_rec_list, btm_find_sec_dev_in_list, &context);
if (p_node) {
p_dev_rec = list_node(p_node);
p_dev_rec = list_node(p_node);
if ((p_dev_rec->ble.static_addr_type & (~BLE_ADDR_TYPE_ID_BIT)) !=
(addr_type & (~BLE_ADDR_TYPE_ID_BIT))) {
BTM_TRACE_WARNING("%s find pseudo->random match with diff addr type: %d vs %d",
__func__, p_dev_rec->ble.static_addr_type, addr_type);
}
}
}
return p_dev_rec;
#endif

37
components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
View File

@@ -1979,7 +1979,7 @@ UINT8 *btm_ble_build_adv_data(tBTM_BLE_AD_MASK *p_data_mask, UINT8 **p_dst,
}
/* 16bits/32bits/128bits Service Data */
if (len > MIN_ADV_LENGTH && data_mask & BTM_BLE_AD_BIT_SERVICE_DATA &&
p_data && p_data->p_service_data->len != 0 && p_data->p_service_data->p_val) {
p_data && p_data->p_service_data && p_data->p_service_data->len != 0 && p_data->p_service_data->p_val) {
if (len > (p_data->p_service_data->service_uuid.len + MIN_ADV_LENGTH)) {
if (p_data->p_service_data->len > (len - MIN_ADV_LENGTH)) {
cp_len = len - MIN_ADV_LENGTH - p_data->p_service_data->service_uuid.len;
@@ -3063,7 +3063,7 @@ static void btm_adv_pkt_handler(void *arg)
STREAM_TO_UINT8 (hci_evt_len, p);
STREAM_TO_UINT8 (ble_sub_code, p);
if (ble_sub_code == HCI_BLE_ADV_PKT_RPT_EVT) {
btm_ble_process_adv_pkt(p);
btm_ble_process_adv_pkt(p, hci_evt_len);
} else if (ble_sub_code == HCI_BLE_ADV_DISCARD_REPORT_EVT) {
btm_ble_process_adv_discard_evt(p);
} else if (ble_sub_code == HCI_BLE_DIRECT_ADV_EVT) {
@@ -3083,7 +3083,6 @@ static void btm_adv_pkt_handler(void *arg)
}
UNUSED(hci_evt_code);
UNUSED(hci_evt_len);
}
/*******************************************************************************
@@ -3099,7 +3098,7 @@ static void btm_adv_pkt_handler(void *arg)
** Returns void
**
*******************************************************************************/
void btm_ble_process_adv_pkt (UINT8 *p_data)
void btm_ble_process_adv_pkt (UINT8 *p_data, UINT8 evt_len)
{
BD_ADDR bda;
UINT8 evt_type = 0, *p = p_data;
@@ -3119,10 +3118,22 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
return;
}
/* sub_code(1) already consumed by caller, need at least num_reports(1) */
if (evt_len < 2) {
BTM_TRACE_ERROR("btm_ble_process_adv_pkt: evt too short (len=%u)", evt_len);
return;
}
/* Extract the number of reports in this event. */
STREAM_TO_UINT8(num_reports, p);
UINT8 remaining = evt_len - 2;
while (num_reports--) {
/* Per-report minimum: evt_type(1) + addr_type(1) + bda(6) + data_len(1) + rssi(1) = 10 */
if (remaining < 10) {
BTM_TRACE_ERROR("btm_ble_process_adv_pkt: remaining %u too short for report", remaining);
break;
}
#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
/* Save current report start position for address resolution callback */
UINT8 *pp = p;
@@ -3131,8 +3142,6 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
STREAM_TO_UINT8 (evt_type, p);
STREAM_TO_UINT8 (addr_type, p);
STREAM_TO_BDADDR (bda, p);
//BTM_TRACE_ERROR("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x\n",
// bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]);
#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
#if (!CONTROLLER_RPA_LIST_ENABLE)
@@ -3142,17 +3151,21 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
/* map address to security record */
match = btm_identity_addr_to_random_pseudo(bda, &addr_type, FALSE);
// BTM_TRACE_ERROR("btm_ble_process_adv_pkt:bda= %0x:%0x:%0x:%0x:%0x:%0x\n",
// bda[0],bda[1],bda[2],bda[3],bda[4],bda[5]);
/* always do RRA resolution on host */
#endif
/* Validate data_len before any path (callee reads 1 + data_len + 1 = data_len+2 bytes from p) */
data_len = *p; /* read without advancing; p points to data_len byte */
if (data_len + 2 > remaining - 8) {
BTM_TRACE_ERROR("btm_ble_process_adv_pkt: data_len %u + data + rssi exceeds remaining %u", data_len, (UINT16)(remaining - 8));
break;
}
#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE)
/* RRA path: resolve first, btm_ble_process_adv_pkt_cont will be called from callback; else process now */
if (!match && BTM_BLE_IS_RESOLVE_BDA(bda)) {
btm_ble_resolve_random_addr(bda, btm_ble_resolve_random_addr_on_adv, pp);
} else
#endif
btm_ble_process_adv_pkt_cont(bda, addr_type, evt_type, p);
#if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == TRUE && (!CONTROLLER_RPA_LIST_ENABLE))
//save current adv addr information if p_dev_rec!= NULL
tBTM_SEC_DEV_REC *p_dev_rec = btm_find_dev (bda);
if(p_dev_rec) {
p_dev_rec->ble.current_addr_type = temp_addr_type;
@@ -3161,9 +3174,11 @@ void btm_ble_process_adv_pkt (UINT8 *p_data)
}
#endif
STREAM_TO_UINT8(data_len, p);
remaining -= 9; /* evt_type(1) + addr_type(1) + bda(6) + data_len(1) */
/* Advance to the next event data_len + rssi byte */
p += data_len + 1;
remaining -= (data_len + 1);
}
}

2
components/bt/host/bluedroid/stack/btm/btm_ble_iso.c
View File

@@ -46,7 +46,7 @@ void btm_ble_iso_read_iso_tx_sync_complete(UINT8 *p)
if (cb_params.btm_read_tx_sync.status != HCI_SUCCESS) {
cb_params.btm_read_tx_sync.status = (BTM_HCI_ERROR | cb_params.btm_read_tx_sync.status);
}
cb_params.btm_read_tx_sync.conn_hdl = (cb_params.btm_read_tx_sync.conn_hdl & 0xEFF);
cb_params.btm_read_tx_sync.conn_hdl = (cb_params.btm_read_tx_sync.conn_hdl & 0x0FFF);
cb_params.btm_read_tx_sync.time_offset = (cb_params.btm_read_tx_sync.time_offset & 0xFFFFFF);
BTM_TRACE_DEBUG("read tx sync cmpl, status 0x%x conn_hdl 0x%x pkt_seq_num %d tx_time_stamp %ld time_offset %ld\n",
cb_params.btm_read_tx_sync.status, cb_params.btm_read_tx_sync.conn_hdl, cb_params.btm_read_tx_sync.pkt_seq_num,

13
components/bt/host/bluedroid/stack/btm/btm_ble_privacy.c
View File

@@ -49,6 +49,7 @@
#define BTM_BLE_META_CLEAR_IRK_LEN 1
#define BTM_BLE_META_READ_IRK_LEN 2
#define BTM_BLE_META_ADD_WL_ATTR_LEN 9
#define BTM_BLE_IRK_LIST_INVALID_INDEX 0xFF
#if CONTROLLER_RPA_LIST_ENABLE && BLE_SMP_ID_RESET_ENABLE
static bool is_deleting_zero_addr;
@@ -166,7 +167,7 @@ void btm_ble_clear_irk_index(UINT8 index)
**
** Description find the first available IRK list index
**
** Returns index from 0 ~ max (127 default)
** Returns index from 0 ~ max-1, or BTM_BLE_IRK_LIST_INVALID_INDEX if full
**
*******************************************************************************/
UINT8 btm_ble_find_irk_index(void)
@@ -187,7 +188,7 @@ UINT8 btm_ble_find_irk_index(void)
}
BTM_TRACE_ERROR ("%s failed, list full", __func__);
return i;
return BTM_BLE_IRK_LIST_INVALID_INDEX;
}
/*******************************************************************************
@@ -209,7 +210,13 @@ void btm_ble_update_resolving_list(BD_ADDR pseudo_bda, BOOLEAN add)
if (add) {
p_dev_rec->ble.in_controller_list |= BTM_RESOLVING_LIST_BIT;
if (!controller_get_interface()->supports_ble_privacy()) {
p_dev_rec->ble.resolving_list_index = btm_ble_find_irk_index();
UINT8 irk_index = btm_ble_find_irk_index();
if (irk_index != BTM_BLE_IRK_LIST_INVALID_INDEX) {
p_dev_rec->ble.resolving_list_index = irk_index;
} else {
p_dev_rec->ble.in_controller_list &= ~BTM_RESOLVING_LIST_BIT;
BTM_TRACE_WARNING("%s: IRK list full, cannot add to resolving list", __func__);
}
}
} else {
p_dev_rec->ble.in_controller_list &= ~BTM_RESOLVING_LIST_BIT;

2
components/bt/host/bluedroid/stack/btm/btm_devctl.c
View File

@@ -780,8 +780,8 @@ void btm_vsc_complete (UINT8 *p, UINT16 opcode, UINT16 evt_len,
if(ble_cb && ble_cb->update_exceptional_list_cmp_cb) {
(*ble_cb->update_exceptional_list_cmp_cb)(status, subcode, length, p);
}
break;
#endif // ((BLE_42_SCAN_EN == TRUE) || (BLE_50_EXTEND_SCAN_EN == TRUE))
break;
}
case HCI_VENDOR_BLE_CLEAR_ADV: {
uint8_t status;

15
components/bt/host/bluedroid/stack/btm/btm_sco.c
View File

@@ -322,7 +322,7 @@ void btm_sco_check_send_pkts (UINT16 sco_inx)
}
}
void btm_sco_process_num_completed_pkts (UINT8 *p)
void btm_sco_process_num_completed_pkts (UINT8 *p, UINT8 evt_len)
{
UINT8 num_handles, xx;
UINT16 handle;
@@ -330,7 +330,20 @@ void btm_sco_process_num_completed_pkts (UINT8 *p)
UINT16 sco_inx;
tSCO_CB *p_cb = &btm_cb.sco_cb;
tSCO_CONN * p_ccb;
if (evt_len < 1) {
BTM_TRACE_ERROR ("btm_sco_process_num_completed_pkts: evt too short (len=%u)", evt_len);
return;
}
STREAM_TO_UINT8 (num_handles, p);
if (num_handles > (evt_len - 1) / 4) {
BTM_TRACE_ERROR ("btm_sco_process_num_completed_pkts: num_handles %u exceeds evt_len %u, truncating",
num_handles, evt_len);
num_handles = (evt_len - 1) / 4;
}
for (xx = 0; xx < num_handles; xx++) {
STREAM_TO_UINT16 (handle, p);
STREAM_TO_UINT16 (num_sent, p);

2
components/bt/host/bluedroid/stack/btm/include/btm_ble_int.h
View File

@@ -401,7 +401,7 @@ extern "C" {
void btm_ble_timeout(TIMER_LIST_ENT *p_tle);
#if (BLE_42_SCAN_EN == TRUE)
void btm_ble_process_adv_pkt (UINT8 *p);
void btm_ble_process_adv_pkt (UINT8 *p, UINT8 evt_len);
void btm_ble_process_adv_discard_evt(UINT8 *p);
void btm_ble_process_direct_adv_pkt (UINT8 *p);
bool btm_ble_adv_pkt_ready(void);

2
components/bt/host/bluedroid/stack/btm/include/btm_int.h
View File

@@ -1192,7 +1192,7 @@ void btm_pm_proc_ssr_evt (UINT8 *p, UINT16 evt_len);
void btm_sco_chk_pend_unpark (UINT8 hci_status, UINT16 hci_handle);
#if (BTM_SCO_HCI_INCLUDED == TRUE )
void btm_sco_process_num_bufs (UINT16 num_lm_sco_bufs);
void btm_sco_process_num_completed_pkts (UINT8 *p);
void btm_sco_process_num_completed_pkts (UINT8 *p, UINT8 evt_len);
#endif /* (BTM_SCO_HCI_INCLUDED == TRUE ) */
#else
#define btm_sco_chk_pend_unpark(hci_status, hci_handle)