Commits

Commit Message Author Age Changes
1862586e obexd: Add missing fall through declaration Marcel Holtmann 8 years ago 1 file, +1, -0
ca7544fd unit: Add missing break statement Marcel Holtmann 8 years ago 1 file, +1, -0
e2ae29f4 tools: Add missing break statements Marcel Holtmann 8 years ago 1 file, +2, -0
6a1cfef9 tools: Fix uninitialized memory array Marcel Holtmann 8 years ago 2 files, +2, -2
376c3433 tools: Fix wrong string buffer sizes Marcel Holtmann 8 years ago 2 files, +2, -2
cf17fba7 tools: Add missing fall through declaration Marcel Holtmann 8 years ago 2 files, +2, -1
608dffe9 autopair: Fix PIN string buffer size Marcel Holtmann 8 years ago 1 file, +1, -1
1d2cbb8a android: Add missing fall through declaration Marcel Holtmann 8 years ago 1 file, +1, -0
9c249a03 client: Add missing fall through declaration Marcel Holtmann 8 years ago 1 file, +2, -0
35803206 device: Fix crash freeing device Calling gatt_db_register with NULL pointers makes no sense since it does nothing when the callbacks are NULL so the callback are still reachable causing invalid memory to accessed: Invalid read of size 8 at 0x50EAFDC: g_slist_find_custom (in /usr/lib64/libglib-2.0.so.0.5000.3) by 0x46CDA1: gatt_service_removed (device.c:3563) by 0x4896F8: queue_foreach (queue.c:220) by 0x4951FB: notify_service_changed (gatt-db.c:268) by 0x4951FB: gatt_db_service_destroy (gatt-db.c:279) by 0x4898F5: queue_remove_all (queue.c:336) by 0x4952E2: gatt_db_clear_range (gatt-db.c:461) by 0x48F32B: discovery_op_unref (gatt-client.c:447) by 0x4979AA: bt_gatt_request_unref (gatt-helpers.c:594) by 0x490489: bt_gatt_client_cancel_all (gatt-client.c:2083) by 0x4904D8: bt_gatt_client_free (gatt-client.c:1752) by 0x46CF70: gatt_client_cleanup (device.c:561) by 0x46D01A: attio_cleanup (device.c:586) Address 0x86cb940 is 0 bytes inside a block of size 16 free'd at 0x4C2ED4A: free (vg_replace_malloc.c:530) by 0x50D16CD: g_free (in /usr/lib64/libglib-2.0.so.0.5000.3) by 0x50EA743: g_slice_free_chain_with_offset (in /usr/lib64/libglib-2.0.so.0.5000.3) by 0x46D18C: device_free (device.c:638) by 0x485B05: remove_interface (object.c:667) by 0x485FF9: g_dbus_unregister_interface (object.c:1391) by 0x45EFA9: btd_adapter_remove_device (adapter.c:1200) by 0x45FBC3: dev_disconnected (adapter.c:6800) by 0x48A1A5: request_complete (mgmt.c:261) by 0x48AC0B: can_read_data (mgmt.c:353) by 0x496954: watch_callback (io-glib.c:170) by 0x50CBE51: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.5000.3) Luiz Augusto von Dentz 8 years ago 1 file, +4, -3
006213cf device: Fix crashing when connecting ATT over BR/EDR When remote connects ATT over BR/EDR the code will attempt to resolve its attributes, but in the meantime a SDP session may be active to resolve the services exposed over SDP which can cause a crash since ATT may end up freeing the request causing the following trace: bluetoothd[31069]: attrib/gattrib.c:g_attrib_unref() 0x73aae0: g_attrib_unref=0 bluetoothd[31069]: src/device.c:connect_profiles() /org/bluez/hci0/dev_F4_5F_69_01_3D_69 (all), client :1.868 bluetoothd[31069]: src/device.c:connect_profiles() Resolving services for /org/bluez/hci0/dev_F4_5F_69_01_3D_69 bluetoothd[31069]: src/adapter.c:connected_callback() hci0 device F4:5F:69:01:3D:69 connected eir_len 13 bluetoothd[31069]: src/gatt-database.c:connect_cb() New incoming BR/EDR ATT connection bluetoothd[31069]: attrib/gattrib.c:g_attrib_ref() 0x73d280: g_attrib_ref=1 bluetoothd[31069]: src/device.c:load_gatt_db() Restoring F4:5F:69:01:3D:69 gatt database from file bluetoothd[31069]: No cache for F4:5F:69:01:3D:69 bluetoothd[31069]: src/gatt-client.c:btd_gatt_client_connected() Device connected. bluetoothd[31069]: src/device.c:gatt_debug() Primary service discovery failed. ATT ECODE: 0x0a bluetoothd[31069]: src/device.c:gatt_client_ready_cb() status: success, error: 0 bluetoothd[31069]: src/gatt-client.c:btd_gatt_client_ready() GATT client ready bluetoothd[31069]: src/gatt-client.c:create_services() Exporting objects for GATT services: F4:5F:69:01:3D:69 bluetoothd[31069]: src/device.c:device_svc_resolved() /org/bluez/hci0/dev_F4_5F_69_01_3D_69 err 0 bluetoothd[31069]: src/device.c:connect_profiles() /org/bluez/hci0/dev_F4_5F_69_01_3D_69 (all), client :1.868 Program received signal SIGSEGV, Segmentation fault. 0x000000000048eb8d in browse_cb () Luiz Augusto von Dentz 8 years ago 1 file, +8, -2
563ac6f0 shared/gatt-server: Remove unwanted pointer validation Here the memory address pointed by the variable op is always valid. Syam Sidhardhan 8 years ago 1 file, +1, -2
24125599 device: Ensure browse request is reset to NULL when freed This makes the code simpler as browse_request_free always reset the device pointer to NULL when freeing its data. Luiz Augusto von Dentz 8 years ago 1 file, +6, -7
e0eeef10 client: Fix memory leak due to the option to register an agent When bluetoothctl runs with the command line option "-a <capability>", it does not free the variable auto_register_agent registering the initial agent and allocates new memory for it. This frees the allocated memory before allocating new memory. (The related commit id is 6db3470c2ea161b4b808ad1fc80dfd7e014fd359.) ERAMOTO Masaya 8 years ago 1 file, +1, -0
ded317e9 src/device: Fix bluetoothd crash DUT was trying to connect with carkit and due to some reason connection got aborted. SDP search got error and browse request was freed but device->browse is still pointing to freed memory. During clean up bluez removes all device and while removing it find reference to browse_req and it tries to free again which leads to the crash. Assign NULL to device browse_req before freeing the browse_req. Log: bluetooth: src/service.c:change_state() 0xb700a650: device XX:XX:XX:XX:XX:XX profile a2dp-sink state changed: connecting -> disconnected (-11) bluetooth: src/device.c:device_profile_connected() a2dp-sink Resource temporarily unavailable (11) bluetooth: src/device.c:device_profile_connected() returning response to :1.300 bluetooth: src/device.c:device_browse_sdp() bluetooth: src/device.c:browse_request_free() --Browse req is freed but device->browse is still pointing to freed memory -- While turning OFF freeing each devices: bluetoothd[2024]: src/adapter.c:adapter_remove() Removing adapter /org/bluez/hci0 bluetoothd[2024]: src/device.c:device_remove() Removing device /org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX bluetoothd[2024]: src/device.c:browse_request_cancel() (gdb) 0 0xb6f981ae in queue_remove_if (queue=0xb7007d70, function=0xb6f9a319 <match_disconn_id>, user_data=0xb7001ae0) at src/shared/queue.c:289 1 0xb6f9a87a in bt_att_unregister_disconnect (att=<optimized out>, id=<optimized out>) at src/shared/att.c:1161 2 0xb6f81bf6 in attio_cleanup (device=0xb6d4d810) at src/device.c:742 3 0xb6f81c3c in browse_request_cancel (req=0xb6fe3038) at src/device.c:777 4 0xb6f87066 in device_remove (device=0xb700ac00, remove_stored=0) at src/device.c:5238 5 0xb6f6b80c in adapter_remove (adapter=adapter@entry=0xb6fff2f0) at src/adapter.c:7822 6 0xb6f79068 in adapter_cleanup () at src/adapter.c:11707 Anurag Biradar 8 years ago 1 file, +1, -0
fd3868eb obexd: Fix memory leak in phonebook-dummy g_build_filename() returns a newly-allocated string that must be freed with g_free(). Syam Sidhardhan 8 years ago 1 file, +3, -0
c8961837 client: Add release-notify command This adds release-notify command which closes an existing fd unlocking the attribute: [Test peripheral:/service001f/char0020]# release-notify [CHG] Attribute /org/bluez/hci1/dev_69_16_5B_9A_06_CD/service001f/char0020 NotifyAcquired: no Luiz Augusto von Dentz 8 years ago 4 files, +35, -9
706f9cb6 client: Add acquire-notify command This adds acquire-notify command which uses D-Bus AcquireNotify method to acquire a file descriptor to read notifications locking the attribute: [Test peripheral:/service001f/char0020]# acquire-notify [CHG] Attribute /org/bluez/hci1/dev_56_A0_AA_D0_12_FF/service001f/char0020 NotifyAcquired: yes AcquireNotify success: fd 7 MTU 65 < ACL Data TX: Handle 3585 flags 0x00 dlen 9 ATT: Write Request (0x12) len 4 Handle: 0x0022 Data: 0200 [CHG] /org/bluez/hci1/dev_56_A0_AA_D0_12_FF/service001f/char0020 Notification: 00 > ACL Data RX: Handle 3585 flags 0x02 dlen 8 ATT: Handle Value Indication (0x1d) len 3 Handle: 0x0021 Data: 00 Luiz Augusto von Dentz 8 years ago 4 files, +154, -27
23ca5047 gatt: Add implementation of NotifyAcquired This property indicate if any client has acquire notify thus locking the access to StartNotify. Luiz Augusto von Dentz 8 years ago 1 file, +34, -1
1dba1868 gatt: Add implementation of AcquireNotify This implements AcquireNotify creating a pipe and passing the read fd to the application requesting it, at same time subscribe for notifications: bluetoothd[7279]: src/gatt-client.c:notify_client_ref() owner :1.461 bluetoothd[7279]: src/gatt-client.c:characteristic_create_pipe() AcquireNotify: sender :1.461 io 0x8a60540 Luiz Augusto von Dentz 8 years ago 1 file, +157, -15
25360fe3 client: Add release-write command This adds release-write command which closes an existing fd unlocking the attribute: [Test peripheral:/service001f/char0020]# release-write [CHG] Attribute /org/bluez/hci1/dev_00_1B_DC_07_31_88/service001f/char0020 WriteAcquired: no Luiz Augusto von Dentz 8 years ago 3 files, +26, -0
b41cf317 client: Add acquire-write command This adds acquire-write command which uses D-Bus AcquireWrite methods to acquire a file descriptor to write to locking the attribute: [Test peripheral:/service001f/char0020]# acquire-write [CHG] Attribute /org/bluez/hci1/dev_00_1B_DC_07_31_88/service001f/char0020 WriteAcquired: yes AcquireWrite success: fd 7 MTU 65 [Test peripheral:/service001f/char0020]# write 00 Attempting to write fd 7 < ACL Data TX: Handle 3585 flags 0x00 dlen 8 ATT: Write Command (0x52) len 3 Handle: 0x0021 Data: 00 Luiz Augusto von Dentz 8 years ago 3 files, +87, -0
9aedde40 gatt: Add implementation of WriteAcquired This property indicate if any client has acquire write thus locking the access to WriteValue. Luiz Augusto von Dentz 8 years ago 1 file, +34, -1
c6d9a1bb gatt: Add implementation of AcquireWrite This implements AcquireWrite creating a pipe and passing the write fd to the application requesting it: bluetoothd[29915]: src/gatt-client.c:characteristic_create_pipe() AcquireWrite: sender :1.378 io 0x89cdfe0 The fd is monitored and in case the client decides close it, or exit/crash, the daemon detects the HUP and cleanup properly: bluetoothd[29915]: src/gatt-client.c:characteristic_pipe_hup() /org/bluez/hci1/dev_00_1B_DC_07_31_88/service001f/char0020: io 0x89cdfe0 Luiz Augusto von Dentz 8 years ago 2 files, +168, -1
0f3f40ba shared/gatt-client: Allow multiple ready callbacks This makes the ready callbacks much more convenient to track when the client is ready since its is now possible to notify more than on client at the same time. Luiz Augusto von Dentz 8 years ago 6 files, +59, -25
f59f3ded doc/gatt-api: Add AcquireWrite and AcquireNotify This enables write and notify exclusive access via file descriptors in case the characteristic is actually trying to emulate a byte stream transfer or have a protocol on top of GATT. Luiz Augusto von Dentz 8 years ago 1 file, +62, -0
44bf4d2d client: Add unregister-descriptor command This adds unregister-descriptor which can be used to unregister descriptors registered with register-descriptor: unregister-descriptor /org/bluez/app/service0xf48150/chrc0xf49a40/desc0xf4d350 [DEL] Descriptor /org/bluez/app/service0xf48150/chrc0xf49a40/desc0xf4d350 8260c653-1a54-426b-9e36-e84c238bc669 Vendor specific Luiz Augusto von Dentz 8 years ago 3 files, +74, -0
7e41dd2d client: Add register-descriptor command This adds register-descriptor which can be used to register descriptors to a characteristic registered with register-characteristic: register-descriptor 8260c653-1a54-426b-9e36-e84c238bc669 read,write [NEW] Descriptor /org/bluez/app/service0x902610/chrc0x91d690/desc0x9095a0 8260c653-1a54-426b-9e36-e84c238bc669 Vendor specific [/org/bluez/app/service0x902610/chrc0x91d690/desc0x9095a0] Enter value: 00 Luiz Augusto von Dentz 8 years ago 3 files, +248, -22
5dbe7474 client: Add unregister-characteristic command This adds unregister-characteristic which can be used to unregister characteristics registered with register-characteristic: unregister-characteristic /org/bluez/app/service0xc80150/chrc0xc99960 [DEL] Characteristic /org/bluez/app/service0xc80150/chrc0xc99960 00002a06-0000-1000-8000-00805f9b34fb Alert Level Luiz Augusto von Dentz 8 years ago 3 files, +69, -0
68fa26fb client: Add register-characteristic command This adds register-characteristic which can be used to register characteristic to a service registered with register-service: register-characteristic 00002a06-0000-1000-8000-00805f9b34fb write-without-response [NEW] Characteristic /org/bluez/app/service0x1122150/chrc0x113fa40 00002a06-0000-1000-8000-00805f9b34fb Alert Level Luiz Augusto von Dentz 8 years ago 3 files, +335, -15
bd35ab6b client: Add unregister-service command This adds unregister-service which can be used to unregister an application service registered with register-service: register-service 00001820-0000-1000-8000-00805f9b34fb [NEW] Primary Service /org/bluez/app/service0x92a150 00001820-0000-1000-8000-00805f9b34fb Internet Protocol Support [bluetooth]# unregister-service /org/bluez/app/service0x92a150 [DEL] Primary Service /org/bluez/app/service0x92a150 00001820-0000-1000-8000-00805f9b34fb Internet Protocol Support Luiz Augusto von Dentz 8 years ago 3 files, +66, -1
0f47058a client: Add register-service command This adds register-service command which can be used to add GATT services to the application: [bluetooth]# register-service 00001820-0000-1000-8000-00805f9b34fb [NEW] Primary Service /org/bluez/app/service0x8c2610 00001820-0000-1000-8000-00805f9b34fb Internet Protocol Support [/org/bluez/app/service0x8c2610] Primary (yes/no): yes [bluetooth]# register-application [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 00001112-0000-1000-8000-00805f9b34fb [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 00001801-0000-1000-8000-00805f9b34fb [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 0000110e-0000-1000-8000-00805f9b34fb [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 0000112d-0000-1000-8000-00805f9b34fb [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 00001800-0000-1000-8000-00805f9b34fb [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 00001820-0000-1000-8000-00805f9b34fb [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 00001200-0000-1000-8000-00805f9b34fb [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 0000110c-0000-1000-8000-00805f9b34fb [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 0000110a-0000-1000-8000-00805f9b34fb [CHG] Controller 00:1B:DC:07:31:88 UUIDs: 0000110b-0000-1000-8000-00805f9b34fb Note: register-application still has to be called at the end to register with bluetoothd as everything is done with ObjectManager. Luiz Augusto von Dentz 8 years ago 3 files, +155, -22
21ec1b51 client: Add generic way to request input from user This adds rl_prompt_input which can be used by different parts to ask user input. Luiz Augusto von Dentz 8 years ago 3 files, +66, -0
8dc3d021 client: Allow register-application without any UUID This means that GattProfile1 should not be registered but there could still be services that needs registered with bluetoothd. Luiz Augusto von Dentz 8 years ago 2 files, +16, -15
7e19bfdb monitor: Add missing UUID and EIR definitions Marcel Holtmann 8 years ago 2 files, +104, -1
3467bb83 obexd: Fix null pointer dereference. By sending OPP Put request before CONNECT we were able to cause SIGSEGV in obexd. Crash was caused by null pointer dereference. Crash was found using Synopsys Defensics Obex Server test suite. This was fixed by calling os->service->connect if CONNECT was not done before. Matias Karhumaa 8 years ago 1 file, +11, -0
de478609 client: Output a long message by two lines This outputs the help message by two lines as follows if the string of a command and a argument is long. set-alias <alias> Set device alias select-attribute <attribute/UUID> Select attribute attribute-info [attribute/UUID] Select attribute read Read attribute value ERAMOTO Masaya 8 years ago 1 file, +9, -1
090e626a client: Add a description to all commands ERAMOTO Masaya 8 years ago 1 file, +8, -6
18ef6425 client: Compare a input string and each command only once This compares a input string and each command only once in rl_handler(). ERAMOTO Masaya 8 years ago 1 file, +11, -8
9d4658a2 obexd/map: msg dummy implement message listing For messages dummy, message listing functionality in implemented in this patch. The inputs for message listing is derived from the mlisting.xml file that is to be present in each folder(inbox, sent, drafts) > ACL Data RX: Handle 256 flags 0x02 dlen 78 Channel: 64 len 74 [PSM 3 mode 0] {chan 0} RFCOMM: Unnumbered Info with Header Check (UIH) (0xef) Address: 0x83 cr 1 dlci 0x20 Control: 0xff poll/final 1 Length: 69 FCS: 0xc4 Credits: 1 83 00 45 cb 00 00 00 02 01 00 0d 00 73 00 65 00 ..E.........s.e. 6e 00 74 00 00 42 00 18 78 2d 62 74 2f 4d 41 50 n.t..B..x-bt/MAP 2d 6d 73 67 2d 6c 69 73 74 69 6e 67 00 4c 00 18 -msg-listing.L.. 01 02 00 0b 02 02 00 00 13 01 ff 06 01 00 07 00 ................ 08 00 09 01 00 c4 ...... < ACL Data TX: Handle 256 flags 0x00 dlen 1017 Channel: 65 len 1013 [PSM 3 mode 0] {chan 0} RFCOMM: Unnumbered Info with Header Check (UIH) (0xef) Address: 0x81 cr 0 dlci 0x20 Control: 0xef poll/final 0 Length: 28675 FCS: 0x02 90 08 63 4c 00 21 12 02 00 0b 19 15 32 30 31 37 ..cL.!......2017 30 36 31 32 54 31 32 32 35 31 33 2d 20 35 33 30 0612T122513- 530 00 0d 01 00 48 08 3f 3c 4d 41 50 2d 6d 73 67 2d ....H.?<MAP-msg- 6c 69 73 74 69 6e 67 20 76 65 72 73 69 6f 6e 3d listing version= 22 31 2e 30 22 3e 3c 6d 73 67 20 68 61 6e 64 6c "1.0"><msg handl 65 3d 22 30 34 30 30 30 30 30 30 30 30 30 30 30 e="0400000000000 30 31 32 22 20 73 75 62 6a 65 63 74 3d 22 4e 6f 012" subject="No 22 20 64 61 74 65 74 69 6d 65 3d 22 32 30 31 37 " datetime="2017 30 35 32 34 54 31 37 30 31 35 37 22 20 73 65 6e 0524T170157" sen 64 65 72 5f 61 64 64 72 65 73 73 69 6e 67 3d 22 der_addressing=" 22 20 72 65 63 69 70 69 65 6e 74 5f 61 64 64 72 " recipient_addr 65 73 73 69 6e 67 3d 22 35 34 33 32 31 22 20 74 essing="54321" t 79 70 65 3d 22 53 4d 53 5f 47 53 4d 22 20 72 65 ype="SMS_GSM" re 63 65 70 74 69 6f 6e 5f 73 74 61 74 75 73 3d 22 ception_status=" 63 6f 6d 70 6c 65 74 65 22 20 61 74 74 61 63 68 complete" attach 6d 65 6e 74 5f 73 69 7a 65 3d 22 30 22 2f 3e 0a ment_size="0"/>. ... and more Sathish Narasimman 8 years ago 1 file, +185, -1
a987ea04 obexd/map: Do not send parent folder in dummy In messages-dummy it is not necessary to add parent folder in the response to folder-lisintg. when tested with some carkit the present method is not working when navigating to different folders. so removing it. Sathish Narasimman 8 years ago 1 file, +0, -10
825400c5 shared/gatt-client: Correct att err variable According to Core specification version 5.0 (Vol 3, Part F, 3.4.1.1) error code size is one byte. Grzegorz Kolodziejczyk 8 years ago 1 file, +1, -1
bd36dfff tester: fix inproper printout from cmd handler Konrad ZapaƂowicz 8 years ago 1 file, +1, -1
2179f571 core/gatt: Add GATT.Cache config option This adds GATT.Cache config option to main.conf which can be used to adjust the cache expected behavior of attributes found over GATT. Luiz Augusto von Dentz 8 years ago 4 files, +73, -1
8fdae266 core/gatt: Fix not registering .accept callback for external profiles The .accept callback is mandatory since probe_service has been changed to check for it in 89ca735e57417ec296a41d8c31d0d0d5c66ce2a9. Luiz Augusto von Dentz 8 years ago 1 file, +10, -0
ffc08888 monitor/avdtp: Correct bit mask for TSEP According to AVDP specification 1.3 (8.6.2 Stream End Point Discovery Response), TSEP bit is on 3rd position of 3rd frame byte. Grzegorz Kolodziejczyk 8 years ago 1 file, +1, -1
0f791b0c monitor: Add Broadcom controller features decoding Marcel Holtmann 8 years ago 1 file, +52, -0
fedb7f6e tools: Add testing utility for advertising Marcel Holtmann 8 years ago 3 files, +443, -2
d6c07ecf shared/gatt-client: Fix removing services with no attributes If a service has no attributes, like IPSS, just mark it as active and skip doing any attribute discover. Luiz Augusto von Dentz 8 years ago 1 file, +5, -1
feade203 core/device: Fix discarding valid events if the addres is updated If a device gets paired while connected and that causes device_update_addr dev->bdaddr gets overwritten with identity address but some parts of the code may still use the initial address used to connect so this makes device_addr_type_cmp check both addresses. Luiz Augusto von Dentz 8 years ago 1 file, +9, -1
Previous Next