Route legacy PAwR peripheral completion events through the active periodic
sync callback and accept the controller-established link without normal
advertising state.
bt_mesh_bta_gatts_cb did not always answer ATT Read/Write Requests:
- READ: on a callback error it only logged a warning and sent nothing; a
0-byte read (Read Blob at an offset equal to the value length) also sent
nothing, although it is a successful empty read.
- WRITE: on a callback error it sent nothing, and a partial/zero write was
treated as success.
- Both: when the handle was not found or the attribute had no read/write
callback, the request was silently dropped.
An ATT Request must always be answered:
- READ: len >= 0 is success -> Read Response (a 0-byte read yields an empty
value); len < 0 -> ATT Error Response carrying the callback's error code
(-len, since BLE_MESH_GATT_ERR(x) == -x). The copy length is clamped to
the source buffer size as a defensive bound. If the handle is unknown or
the attribute has no read callback, respond with INVALID_HANDLE /
READ_NOT_PERMITTED.
- WRITE: when need_rsp is set, always reply. len == write length -> Write
Response; otherwise (negative ATT error, partial write, or 0) -> ATT
Error Response (the negative code, or UNLIKELY for partial/0). If the
handle is unknown or the attribute has no write callback, respond with
INVALID_HANDLE / WRITE_NOT_PERMITTED. Write Without Response still sends
no response.
A non-success status passed to BTA_GATTS_SendRsp is turned into an ATT
Error Response by the GATT layer (gatt_sr_process_app_rsp ->
gatt_send_error_rsp).
fix(bt): Fixed memory-safety and DoS defects in BR/EDR controller on ESP32-S31
Closes BTQABR2023-853 and BTQABR2023-852
See merge request espressif/esp-idf!51299
- remmediate deep-review memory-saftey and DoS defects
- fix duplicated report of HCI mode change event
- fix conflicts in handling sniff subrate request when ACL link enters active mode
fix(bt): Fixed several issues on BR/EDR controller on ESP32-S31
Closes BTQABR2023-829, BTQABR2023-836, BTQABR2023-837, BTQABR2023-840, BTQABR2023-687, and BTQABR2023-697
See merge request espressif/esp-idf!51249
Fixed bug when BR/EDR ACL-U dynamic Tx buffer is enabled
Fixed infinite loop during connection set-up
Optimized the scheduling of SCO/eSCO and sniff events
- Add bt_osal: event queues, mutexes, semaphores, callouts, etc.
- Add the shared BLE profile task and event queue
- Bring both up and tear them down in the host init/deinit paths
- Add unit tests for the OSAL and the profile task
Rename uhci_ll_rx_set_eof_mode → uhci_ll_rx_enable_eof_modes and its
parameter eof_mode → eof_modes to reflect that multiple EOF modes can
be enabled simultaneously via bitmask. Add bool en parameter so callers
can enable or disable without an outer if-check.
related: obex, smp, pbap, sdp, rfcomm, stack_dm
- Deinit function doesn't delete connection when OBEX_DYNAMIC_MEMORY is on
- Union tGOEPC_DATA sometimes is free by osi_free in some cases when it contains mtu_id
- Add correct free and return solution after fail
- Fix symbol mistake in mod calculation
- Fix pointer-related UAF problems and memory free problems
- Fix buffer overflows and out-of-bounds access
- Fix infinite loops triggered by integer overflow wraparound
- Fix double free
- Change layer_specific usage to avoid heap overflow
- Add some NULL check for pointers
- Fix sdp_db free function
- Fix state table mismatch
