Google Git
Sign in
android / platform / system / bt / e7b978841deb331ff5e5849388fa92ee4c40f979
commite7b978841deb331ff5e5849388fa92ee4c40f979[log] [tgz]
authorBrian Delwiche <delwiche@google.com>Tue Oct 11 21:23:22 2022 +0000
committerAndroid Build Coastguard Worker <android-build-coastguard-worker@google.com>Thu Apr 06 00:39:37 2023 +0000
treed3e2e3650fb1eb86b6695f3bde66b12b862f2ea5
parent88da2721d4eae2610f4fc863d08b22d93b8bc951 [diff]
Prevent use-after-free of HID reports

BTA sends the the HID report pointer to BTIF and deallocates it immediately.
This is now prevented by providing a deep copy callback function for HID
reports when tranferring context from BTA to BTIF.

This is a backport of change Icef7a7ed1185b4283ee4fe4f812ca154d8f1b825,
already merged on T for b/227620181.

Bug: 228837201
Test: Validated against researcher POC, ran BT unit tests, played audio
manually.
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:874c495c886cd8722625756dc5fd0634b16b4f42)
Merged-In: Ib837f395883de2369207f1b3b974d6bff02dcb19
Change-Id: Ib837f395883de2369207f1b3b974d6bff02dcb19
1 file changed
tree: d3e2e3650fb1eb86b6695f3bde66b12b862f2ea5
  1. apex/
  2. audio_a2dp_hw/
  3. audio_bluetooth_hw/
  4. audio_hal_interface/
  5. audio_hearing_aid_hw/
  6. binder/
  7. bta/
  8. btcore/
  9. btif/
  10. build/
  11. common/
  12. conf/
  13. device/
  14. doc/
  15. embdrv/
  16. gd/
  17. hci/
  18. include/
  19. internal_include/
  20. linux_include/
  21. main/
  22. osi/
  23. packet/
  24. profile/
  25. service/
  26. stack/
  27. test/
  28. tools/
  29. types/
  30. udrv/
  31. utils/
  32. vendor_libs/
  33. vnd/
  34. .clang-format
  35. .gitignore
  36. .style.yapf
  37. Android.bp
  38. AndroidTestTemplate.xml
  39. BUILD.gn
  40. build.py
  41. Cargo.toml
  42. CleanSpec.mk
  43. EventLogTags.logtags
  44. METADATA
  45. MODULE_LICENSE_APACHE2
  46. NOTICE
  47. OWNERS
  48. PREUPLOAD.cfg
  49. README.md
  50. rustfmt.toml
  51. TEST_MAPPING
README.md

Fluoride Bluetooth stack

Building and running on AOSP

Just build AOSP - Fluoride is there by default.

Building and running on Linux

Instructions for a Debian based distribution:

  • Debian Bullseye or newer
  • Ubuntu 20.10 or newer
  • Clang-11 or Clang-12
  • Flex 2.6.x
  • Bison 3.x.x (tested with 3.0.x, 3.2.x and 3.7.x)

You‘ll want to download some pre-requisite packages as well. If you’re currently configured for AOSP development, you should have all required packages. Otherwise, you can use the following apt-get list:

sudo apt-get install repo git-core gnupg flex bison gperf build-essential \
  zip curl zlib1g-dev gcc-multilib g++-multilib \
  x11proto-core-dev libx11-dev lib32z-dev libncurses5 \
  libgl1-mesa-dev libxml2-utils xsltproc unzip liblz4-tool libssl-dev \
  libc++-dev libevent-dev \
  flatbuffers-compiler libflatbuffers1 \
  openssl openssl-dev

You will also need a recent-ish version of Rust and Cargo. Please follow the instructions on Rustup to install a recent version.

Download source

mkdir ~/fluoride
cd ~/fluoride
git clone https://android.googlesource.com/platform/system/bt

Install dependencies (require sudo access). This adds some Ubuntu dependencies and also installs GN (which is the build tool we're using).

cd ~/fluoride/bt
build/install_deps.sh

The following third-party dependencies are necessary but currently unavailable via a package manager. You may have to build these from source and install them to your local environment.

  • libchrome
  • modp_b64

We provide a script to produce debian packages for those components, please follow the instructions in build/dpkg/README.txt.

The googletest packages provided by Debian/Ubuntu (libgmock-dev and libgtest-dev) do not provide pkg-config files, so you can build your own googletest using the steps below:

$ git clone https://github.com/google/googletest.git -b release-1.10.0
$ cd googletest        # Main directory of the cloned repository.
$ mkdir build          # Create a directory to hold the build output.
$ cd build
$ cmake ..             # Generate native build scripts for GoogleTest.
$ sudo make install -DCMAKE_INSTALL_PREFIX=/usr

Stage your build environment

For host build, we depend on a few other repositories:

Clone these all somewhere and create your staging environment.

export STAGING_DIR=path/to/your/staging/dir
mkdir ${STAGING_DIR}
mkdir -p ${STAGING_DIR}/external
ln -s $(readlink -f ${PLATFORM2_DIR}/common-mk) ${STAGING_DIR}/common-mk
ln -s $(readlink -f ${PLATFORM2_DIR}/.gn) ${STAGING_DIR}/.gn
ln -s $(readlink -f ${RUST_CRATE_DIR}) ${STAGING_DIR}/external/rust
ln -s $(readlink -f ${PROTO_LOG_DIR}) ${STAGING_DIR}/external/proto_logging

Build

We provide a build script to automate building assuming you've staged your build environment already as above.

./build.py --output ${OUTPUT_DIR} --platform-dir ${STAGING_DIR} --clang

This will build all targets to the output directory you've given. You can also build each stage separately (if you want to iterate on something specific):

  • prepare - Generate the GN rules
  • tools - Generate host tools
  • rust - Build the rust portion of the build
  • main - Build all the C/C++ code
  • test - Build all targets and run the tests
  • clean - Clean the output directory

You can choose to run only a specific stage by passing an arg via --target.

Currently, Rust builds are a separate stage that uses Cargo to build. See gd/rust/README.md for more information.

Run

By default on Linux, we statically link libbluetooth so you can just run the binary directly:

cd ~/fluoride/bt/out/Default
./bluetoothtbd -create-ipc-socket=fluoride