__time_t is not a portable data type, and can cause sign mismatch on
some compares.
Fixes:
CC src/bluetoothd-device.o
src/device.c: In function ‘device_is_name_resolve_allowed’:
src/device.c:4092:17: error: comparison of integer expressions of
different signedness: ‘__time_t’ {aka ‘long int’} and
‘long unsigned int’ [-Werror=sign-compare]
if (now.tv_sec >= device->name_resolve_failed_time +
^~
cc1: all warnings being treated as errors
bt_uuid_t is defined as a byte array, so it can cause alignment errors
on some architectures, when the two 64 bit halves are treated as u64s.
This patch ensures proper alignment across all architectures.
Fixes:
src/adapter.c: In function ‘bt_uuid_hash’:
src/adapter.c:3617:8: error: cast increases required alignment of
target type [-Werror=cast-align]
val = (uint64_t *)&uuid_128.value.u128;
^
cc1: all warnings being treated as errors
For received CTL mesh messages, the wrong network ID variable was
passed to ctl_received. This patch changes to the correct variable.
Also, changed type of net_key_id argument in ctl_received function
to be consistent wich the whole call chain.
This fix regression introduced by "monitor: Fix memory leaks".
J-Link shared library is in use if jlink_init() returns 0 and thus
handle shall not be closed.
This patch fixes the null dereference reported by the scan-build.
tools/mgmt-tester.c:12025:28: warning: Access to field 'cap_len' results
in a dereference of a null pointer (loaded from variable 'rp')
[core.NullDereference]
if (sizeof(rp->cap_len) + rp->cap_len != length) {
^~~~~~~~~~~
This fixes the following errors:
client/advertising.c:129:4: warning: Value stored to 'n' is never read
[deadcode.DeadStores]
n = sizeof(str) - 1;
^ ~~~~~~~~~~~~~~~
client/advertising.c:1012:25: warning: Dereference of null pointer
(loaded from variable 'min') [core.NullDereference]
if (ad.min_interval != *min) {
^~~~
This fixes the following errors:
client/player.c:1406:44: warning: Dereference of null pointer
[core.NullDereference]
reply = endpoint_select_config_reply(msg, p->data.iov_base,
^~~~~~~~~~~~~~~~
client/player.c:1866:2: warning: 3rd function call argument is an
uninitialized value [core.CallAndMessage]
iov_append(&cfg->caps, data, len);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This patch adds a test case to test if the scan response data is updated
when the following scenarios are performed.
1. Add Extended Advertising Parameters Command
2. Add Extended Advertising Data Command w/ Scan Resp Data
3. Remove Advertising Command
4. Add Extended Advertising Parameters Command
5. Add Extended Advertising Data Command w/ Scan Resp Data
6. Host should set Scan Resp Data
When there is a backlog of mesh packets to be sent, the packet sender
Fix bug where bluetooth-meshd stops sending
When there is a backlog of mesh packets to be sent, the packet sender
incorrectly infers that the tx worker thread is already running
and therefore needn't be invoked. As a result, the mesh daemon will
sometimes stop broadcasting while there are still packets in the queue.
It will not resume broadcasting.
This patch will invoke the tx worker thread correctly in that case.
The logic to send packets at least twice when the transmitter is idle
was slightly modified accordingly, and should behave the same way as
before.
When send_request returns an error, session->discover should
be released here, so that the next time the program enters
avdtp_discover, the -EBUSY error will not be returned.
This prints the attribute information on ATT_REQ_RSP to make it easier
to identify to which handle the response is for:
> ACL Data RX: Handle 42 flags 0x02 dlen 9
Channel: 65 len 5 sdu 3 [PSM 39 mode Enhanced Credit (0x81)] {chan 1}
ATT: Read Response (0x0b) len 2
Value: 0300
Handle: 0x0030 Type: Source ASE (0x2bc5)
ASE ID: 3
State: Idle (0x00)
snprintf performs it's own range checking and returns a negative value
if string construction fails. Not checking the return value throws a
warning at compile time on GCC 12 and later. This patch removes
redundent range chacking and checks all snprintf return values.
BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2450
• If extended advertising PDU types are being used (bit 4 = 0) then:
The advertisement shall not be both connectable and scannable.
So instead this attempts to set name as part of Advertising Data rather
then setting it as Scan Response:
bluetoothctl> advertise.secondary 2M
bluetoothctl> advertise.name Intel-3
bluetoothctl> advertise on
< HCI Command: LE Set Extended Advertising Parameters (0x08|0x0036) plen 25
Handle: 0x01
Properties: 0x0001
Connectable
Min advertising interval: 1280.000 msec (0x0800)
Max advertising interval: 1280.000 msec (0x0800)
Channel map: 37, 38, 39 (0x07)
Own address type: Public (0x00)
Peer address type: Public (0x00)
Peer address: 00:00:00:00:00:00 (OUI 00-00-00)
Filter policy: Allow Scan Request from Any, Allow Connect Request from Any (0x00)
TX power: Host has no preference (0x7f)
Primary PHY: LE 1M (0x01)
Secondary max skip: 0x00
Secondary PHY: LE 2M (0x02)
SID: 0x00
Scan request notifications: Disabled (0x00)
> HCI Event: Command Complete (0x0e) plen 5
LE Set Extended Advertising Parameters (0x08|0x0036) ncmd 1
Status: Success (0x00)
TX power (selected): 7 dbm (0x07)
< HCI Command: LE Set Extended Advertising Data (0x08|0x0037) plen 4
Handle: 0x01
Operation: Complete extended advertising data (0x03)
Fragment preference: Minimize fragmentation (0x01)
Data length: 0x00
@ MGMT Event: Command Complete (0x0001) plen 7
Add Extended Advertising Parameters (0x0054) plen 4
Status: Success (0x00)
Instance: 1
TX power: 7 dbm (0x07)
Available adv data len: 31
Available scan rsp data len: 31
> HCI Event: Command Complete (0x0e) plen 4
LE Set Extended Advertising Data (0x08|0x0037) ncmd 1
Status: Success (0x00)
@ MGMT Command: Add Extended Advertising Data (0x0055) plen 23
Instance: 1
Advertising data length: 12
Name (complete): Intel-3
Flags: 0x06
LE General Discoverable Mode
BR/EDR Not Supported
Scan response length: 0
< HCI Command: LE Set Extended Advertising Data (0x08|0x0037) plen 16
Handle: 0x01
Operation: Complete extended advertising data (0x03)
Fragment preference: Minimize fragmentation (0x01)
Data length: 0x0c
Name (complete): Intel-3
Flags: 0x06
LE General Discoverable Mode
BR/EDR Not Supported
> HCI Event: Command Complete (0x0e) plen 4
LE Set Extended Advertising Data (0x08|0x0037) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Extended Scan Response Data (0x08|0x0038) plen 4
Handle: 0x01
Operation: Complete scan response data (0x03)
Fragment preference: Minimize fragmentation (0x01)
Data length: 0x00
> HCI Event: Command Complete (0x0e) plen 4
LE Set Extended Scan Response Data (0x08|0x0038) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Extended Advertising Enable (0x08|0x0039) plen 6
Extended advertising: Enabled (0x01)
Number of sets: 1 (0x01)
Entry 0
Handle: 0x01
Duration: 0 ms (0x00)
Max ext adv events: 0
> HCI Event: Command Complete (0x0e) plen 4
LE Set Extended Advertising Enable (0x08|0x0039) ncmd 2
Status: Success (0x00)
@ MGMT Event: Command Complete (0x0001) plen 4
Add Extended Advertising Data (0x0055) plen 1
Status: Success (0x00)
Instance: 1
This fixes the regression introduced by
ab31e2f7e8 which causes tests using
add_advertising_mgmt_cmd_arr:
Add Advertising - Success (Name+data+appear) Timed out
Add Ext Advertising - Success (Name+data+appear) Timed out
xfer_complete (obex=0x557d242c8cf0, err=0x557d242ca470,
user_data=0x557d242ca300) at obexd/client/transfer.c:659
659 obexd/client/transfer.c:
(gdb) n
661 in obexd/client/transfer.c
(gdb) n
663 in obexd/client/transfer.c
(gdb) p callback->func
$1 = (transfer_callback_t) 0x0
(gdb) n
668 in obexd/client/transfer.c
(gdb) n
671 in obexd/client/transfer.c
(gdb) n
672 in obexd/client/transfer.c
(gdb) n
676 in obexd/client/transfer.c
(gdb) n
677 in obexd/client/transfer.c
(gdb) n
0x0000000000000000 in ?? ()
(gdb) s
Cannot find bounds of current function
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
When running on a computer with a real Bluetooth controller (e.g. hci0) and
multiple emulators (e.g. hci1 and hci2) it isn't possible to use the
emulators with 2 test-runner vms.
If btproxy is started without index parameter the first test-runner will
use hci0, and btprox can't be started with multiple index parameters
(e.g. -i1 -i2).
This patch keeps the old beahvior when used without -i option, in this case
it will try to use the first controller available.
It also allows to select multiple controllers to be used by btproxy.
Using the remote SEP SetConfiguration DBus API, it's possible to make
multiple remote endpoints use the same local SEP, if they are endpoints
from different connected devices. This is invalid: successful
configuration shall prevent a different device configuring the same SEP
(AVDTP v1.3 Sec. 5.3). Moreover, this breaks the assumption in the
AVDTP code that each SEP has at most a single stream, and causes
misbehavior later on (subsequent transport acquires fail with EPERM).
Fix this by first checking the SEP is free before proceeding in the DBus
API call. Also add a sanity check in avdtp_set_configuration, to reject
configuring an already configured SEP similarly as in avdtp_setconf_cmd.
This stops calling hci_devba everytime the GATT db needs to be loaded
since that causes a raw socket to be open to read back the address
pointed by the index, instead this is done only once at assign_handle
and store in packet_conn_data.
This fixes the following build error:
CC tools/mgmt-tester.o
tools/mgmt-tester.c: In function ‘setup_command_generic’:
tools/mgmt-tester.c:7503:16: error: the comparison will always evaluate
as ‘true’ for the pointer operand in
‘(const struct setup_mgmt_cmd *)test->setup_mgmt_cmd_arr +
(sizetype)(i * 24)’ must not be NULL [-Werror=address]
7503 | for (; test->setup_mgmt_cmd_arr + i; ++i) {
| ^~~~
Following scenario happens when prov is false and we have double free as
mentioned in the below
bluez-5.64/tools/mesh-gatt/prov-db.c:847: freed_arg: "g_free" frees
"in_str".
bluez-5.64/tools/mesh-gatt/prov-db.c:867: double_free: Calling "g_free"
frees pointer "in_str" which has already been freed.
Reported by coverity tool as follows :
bluez-5.64/tools/meshctl.c:1968: freed_arg: "g_free" frees "mesh_dir".
bluez-5.64/tools/meshctl.c:2018: double_free: Calling "g_free" frees
pointer "mesh_dir" which has already been freed.
Reported by coverity tool as follows:
bluez-5.64/obexd/client/pbap.c:929: leaked_storage: Variable "apparam"
going out of scope leaks the storage it points to.
While performing static tool analysis using coverity found following
reports for resouse leak
bluez-5.64/tools/obex-client-tool.c:315: leaked_handle: Handle variable
"sk" going out of scope leaks the handle.
While performing static tool analysis using coverity found following
reports for resouse leak
bluez-5.64/tools/mesh/mesh-db.c:2388: leaked_handle: Handle variable
"fd" going out of scope leaks the handle.
bluez-5.64/tools/mesh/mesh-db.c:2388: leaked_storage: Variable "str"
going out of scope leaks the storage it points to.
While performing static tool analysis using coverity found following
reports for resouse leak
bluez-5.64/tools/l2cap-tester.c:1712: leaked_handle: Handle variable
"new_sk" going out of scope leaks the handle.
