Snap for 6916203 from 5f90409c2472d8987e9c1dad842edd52c282fd4e to mainline-release

Change-Id: I38a040386584cf89078d77af74b24407cf5da6a3
diff --git a/gd/hal/hci_hal_host_rootcanal_test.cc b/gd/hal/hci_hal_host_rootcanal_test.cc
index 9783e84..aeff6a8 100644
--- a/gd/hal/hci_hal_host_rootcanal_test.cc
+++ b/gd/hal/hci_hal_host_rootcanal_test.cc
@@ -172,9 +172,9 @@
 
 void check_packet_equal(std::pair<uint8_t, HciPacket> hci_packet1_type_data_pair, H4Packet h4_packet2) {
   auto packet1_hci_size = hci_packet1_type_data_pair.second.size();
-  EXPECT_EQ(packet1_hci_size + 1, h4_packet2.size());
-  EXPECT_EQ(hci_packet1_type_data_pair.first, h4_packet2[0]);
-  EXPECT_EQ(memcmp(hci_packet1_type_data_pair.second.data(), h4_packet2.data() + 1, packet1_hci_size), 0);
+  ASSERT_EQ(packet1_hci_size + 1, h4_packet2.size());
+  ASSERT_EQ(hci_packet1_type_data_pair.first, h4_packet2[0]);
+  ASSERT_EQ(memcmp(hci_packet1_type_data_pair.second.data(), h4_packet2.data() + 1, packet1_hci_size), 0);
 }
 
 HciPacket make_sample_hci_cmd_pkt(uint8_t parameter_total_length) {
@@ -223,6 +223,16 @@
   return pkt;
 }
 
+size_t read_with_retry(int socket, uint8_t* data, size_t length) {
+  size_t bytes_read = 0;
+  ssize_t bytes_read_current = 0;
+  do {
+    bytes_read_current = read(socket, data + bytes_read, length - bytes_read);
+    bytes_read += bytes_read_current;
+  } while (length > bytes_read && bytes_read_current > 0);
+  return bytes_read;
+}
+
 TEST_F(HciHalRootcanalTest, init_and_close) {}
 
 TEST_F(HciHalRootcanalTest, receive_hci_evt) {
@@ -319,9 +329,9 @@
   hal_->sendHciCommand(hci_data);
   H4Packet read_buf(1 + 2 + 1 + hci_cmd_param_size);
   SetFakeServerSocketToBlocking();
-  auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
+  auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
 
-  EXPECT_EQ(size_read, 1 + hci_data.size());
+  ASSERT_EQ(size_read, 1 + hci_data.size());
   check_packet_equal({kH4Command, hci_data}, read_buf);
 }
 
@@ -331,9 +341,9 @@
   hal_->sendAclData(acl_packet);
   H4Packet read_buf(1 + 2 + 2 + acl_payload_size);
   SetFakeServerSocketToBlocking();
-  auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
+  auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
 
-  EXPECT_EQ(size_read, 1 + acl_packet.size());
+  ASSERT_EQ(size_read, 1 + acl_packet.size());
   check_packet_equal({kH4Acl, acl_packet}, read_buf);
 }
 
@@ -343,9 +353,9 @@
   hal_->sendScoData(sco_packet);
   H4Packet read_buf(1 + 3 + sco_payload_size);
   SetFakeServerSocketToBlocking();
-  auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
+  auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
 
-  EXPECT_EQ(size_read, 1 + sco_packet.size());
+  ASSERT_EQ(size_read, 1 + sco_packet.size());
   check_packet_equal({kH4Sco, sco_packet}, read_buf);
 }
 
@@ -359,8 +369,8 @@
   H4Packet read_buf(1 + 2 + 2 + acl_payload_size);
   SetFakeServerSocketToBlocking();
   for (int i = 0; i < num_packets; i++) {
-    auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
-    EXPECT_EQ(size_read, 1 + acl_packet.size());
+    auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
+    ASSERT_EQ(size_read, 1 + acl_packet.size());
     check_packet_equal({kH4Acl, acl_packet}, read_buf);
   }
 }
@@ -373,8 +383,8 @@
   for (int i = 0; i < num_packets; i++) {
     hal_->sendAclData(acl_packet);
     H4Packet read_buf(1 + 2 + 2 + acl_payload_size);
-    auto size_read = read(fake_server_socket_, read_buf.data(), read_buf.size());
-    EXPECT_EQ(size_read, 1 + acl_packet.size());
+    auto size_read = read_with_retry(fake_server_socket_, read_buf.data(), read_buf.size());
+    ASSERT_EQ(size_read, 1 + acl_packet.size());
     check_packet_equal({kH4Acl, acl_packet}, read_buf);
   }
 }
@@ -382,7 +392,7 @@
 TEST(HciHalHidlTest, serialize) {
   std::vector<uint8_t> bytes = {1, 2, 3, 4, 5, 6, 7, 8, 9};
   auto packet_bytes = hal::SerializePacket(std::unique_ptr<packet::BasePacketBuilder>(new packet::RawBuilder(bytes)));
-  EXPECT_EQ(bytes, packet_bytes);
+  ASSERT_EQ(bytes, packet_bytes);
 }
 }  // namespace
 }  // namespace hal
diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index fe1db3d..f2396b4 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -71,6 +71,8 @@
       break;
     }
     case AVRC_PDU_REGISTER_NOTIFICATION: /* 0x31 */
+      if (len < 5) return AVRC_STS_INTERNAL_ERR;
+
       BE_STREAM_TO_UINT8(p_result->reg_notif.event_id, p);
       BE_STREAM_TO_UINT32(p_result->reg_notif.param, p);
       break;
diff --git a/stack/sdp/sdp_server.cc b/stack/sdp/sdp_server.cc
index 9b9ad30..50bcfeb 100644
--- a/stack/sdp/sdp_server.cc
+++ b/stack/sdp/sdp_server.cc
@@ -116,9 +116,11 @@
 
   if (p_req + sizeof(pdu_id) + sizeof(trans_num) > p_req_end) {
     android_errorWriteLog(0x534e4554, "69384124");
+    android_errorWriteLog(0x534e4554, "169342531");
     trans_num = 0;
     sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX,
                             SDP_TEXT_BAD_HEADER);
+    return;
   }
 
   /* The first byte in the message is the pdu type */
@@ -129,8 +131,10 @@
 
   if (p_req + sizeof(param_len) > p_req_end) {
     android_errorWriteLog(0x534e4554, "69384124");
+    android_errorWriteLog(0x534e4554, "169342531");
     sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX,
                             SDP_TEXT_BAD_HEADER);
+    return;
   }
 
   BE_STREAM_TO_UINT16(param_len, p_req);
diff --git a/stack/smp/smp_act.cc b/stack/smp/smp_act.cc
index 22d9958..bfce7cb 100644
--- a/stack/smp/smp_act.cc
+++ b/stack/smp/smp_act.cc
@@ -1254,7 +1254,17 @@
     /* state check to prevent re-entrant */
     if (smp_get_state() == SMP_STATE_BOND_PENDING) {
       if (p_cb->derive_lk) {
-        smp_derive_link_key_from_long_term_key(p_cb, NULL);
+        tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(p_cb->pairing_bda);
+        if (!(p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_AUTHED) &&
+            (p_dev_rec->sec_flags & BTM_SEC_LINK_KEY_AUTHED)) {
+          SMP_TRACE_DEBUG(
+              "%s BR key is higher security than existing LE keys, don't "
+              "derive LK from LTK",
+              __func__);
+          android_errorWriteLog(0x534e4554, "158854097");
+        } else {
+          smp_derive_link_key_from_long_term_key(p_cb, NULL);
+        }
         p_cb->derive_lk = false;
       }
 
diff --git a/test/rootcanal/bluetooth_hci.cc b/test/rootcanal/bluetooth_hci.cc
index 908554b..963f1a7 100644
--- a/test/rootcanal/bluetooth_hci.cc
+++ b/test/rootcanal/bluetooth_hci.cc
@@ -112,8 +112,11 @@
         hidl_vec<uint8_t> hci_event(packet->begin(), packet->end());
         auto ret = cb->hciEventReceived(hci_event);
         if (!ret.isOk()) {
-          CHECK(death_recipient_->getHasDied())
-              << "Error sending event callback, but no death notification.";
+          LOG_ERROR("Error sending event callback");
+          if (!death_recipient_->getHasDied()) {
+            LOG_ERROR("Closing");
+            close();
+          }
         }
       });
 
@@ -122,8 +125,11 @@
         hidl_vec<uint8_t> acl_packet(packet->begin(), packet->end());
         auto ret = cb->aclDataReceived(acl_packet);
         if (!ret.isOk()) {
-          CHECK(death_recipient_->getHasDied())
-              << "Error sending acl callback, but no death notification.";
+          LOG_ERROR("Error sending acl callback");
+          if (!death_recipient_->getHasDied()) {
+            LOG_ERROR("Closing");
+            close();
+          }
         }
       });
 
@@ -132,8 +138,11 @@
         hidl_vec<uint8_t> sco_packet(packet->begin(), packet->end());
         auto ret = cb->aclDataReceived(sco_packet);
         if (!ret.isOk()) {
-          CHECK(death_recipient_->getHasDied())
-              << "Error sending sco callback, but no death notification.";
+          LOG_ERROR("Error sending sco callback");
+          if (!death_recipient_->getHasDied()) {
+            LOG_ERROR("Closing");
+            close();
+          }
         }
       });
 
@@ -143,8 +152,11 @@
           hidl_vec<uint8_t> iso_packet(packet->begin(), packet->end());
           auto ret = cb_1_1->isoDataReceived(iso_packet);
           if (!ret.isOk()) {
-            CHECK(death_recipient_->getHasDied())
-                << "Error sending iso callback, but no death notification.";
+            LOG_ERROR("Error sending iso callback");
+            if (!death_recipient_->getHasDied()) {
+              LOG_ERROR("Closing");
+              close();
+            }
           }
         });
   }