diff --git a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263103.patch b/Patches/LineageOS-16.0/android_device_lge_hammerhead/263103.patch deleted file mode 100644 index 11b94af0..00000000 --- a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263103.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 303349ca33b80052b0f16defdddc7f4c126f5349 Mon Sep 17 00:00:00 2001 -From: Adrian DC -Date: Sun, 3 Nov 2019 00:54:38 +0200 -Subject: [PATCH] sepolicy: Resolve surfaceflinger access to qdisplay service - - * denied { add find } for service=display.qservice uid=1000 - scontext=u:r:surfaceflinger:s0 - tcontext=u:object_r:qdisplay_service:s0 tclass=service_manager - -Change-Id: I9e8af53ecbc475056497926d401d2312b43283c9 ---- - sepolicy/service.te | 1 + - sepolicy/service_contexts | 1 + - sepolicy/surfaceflinger.te | 1 + - 3 files changed, 3 insertions(+) - create mode 100644 sepolicy/service.te - create mode 100644 sepolicy/service_contexts - -diff --git a/sepolicy/service.te b/sepolicy/service.te -new file mode 100644 -index 00000000..60490a58 ---- /dev/null -+++ b/sepolicy/service.te -@@ -0,0 +1 @@ -+type qdisplay_service, service_manager_type; -diff --git a/sepolicy/service_contexts b/sepolicy/service_contexts -new file mode 100644 -index 00000000..3d6b681b ---- /dev/null -+++ b/sepolicy/service_contexts -@@ -0,0 +1 @@ -+display.qservice u:object_r:qdisplay_service:s0 -diff --git a/sepolicy/surfaceflinger.te b/sepolicy/surfaceflinger.te -index 02adf8ac..a92feab8 100644 ---- a/sepolicy/surfaceflinger.te -+++ b/sepolicy/surfaceflinger.te -@@ -1,2 +1,3 @@ - allow surfaceflinger sysfs_surfaceflinger:file rw_file_perms; - allow surfaceflinger sysfs_thermal:file r_file_perms; -+allow surfaceflinger qdisplay_service:service_manager { add find }; diff --git a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263104.patch b/Patches/LineageOS-16.0/android_device_lge_hammerhead/263104.patch deleted file mode 100644 index cc9c9741..00000000 --- a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263104.patch +++ /dev/null @@ -1,47 +0,0 @@ -From df76b984675254e8b8c9c493fd6a0865d1e065de Mon Sep 17 00:00:00 2001 -From: Sashko -Date: Sun, 3 Nov 2019 01:11:48 +0200 -Subject: [PATCH] sepolicy: Resolve healthd denials - -* Label all healthd devices as sysfs_batteryinfo - -* denied { getattr } for path=/sys/devices/f9923000.i2c/i2c-84/84-0036/power_supply/battery/present dev=sysfs ino=19172 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { getattr } for path=/sys/devices/f9923000.i2c/i2c-84/84-006b/power_supply/ac/type dev=sysfs ino=16691 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { getattr } for path=/sys/devices/msm_dwc3/power_supply/usb/type dev=sysfs ino=15162 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { getattr } for path=/sys/devices/f9923000.i2c/i2c-84/84-0036/power_supply/battery/voltage_now dev=sysfs ino=19162 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { getattr } for path=/sys/devices/f9923000.i2c/i2c-84/84-0036/power_supply/battery/current_now dev=sysfs ino=19163 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { getattr } for path=/sys/devices/f9923000.i2c/i2c-84/84-0036/power_supply/battery/temp dev=sysfs ino=19180 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { getattr } for pid=217 comm=healthd path=/sys/devices/bq51013b_wlc.77/power_supply/wireless/type dev=sysfs ino=16663 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { getattr } for path=/sys/devices/virtual/power_supply/touch/type dev=sysfs ino=15931 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -Change-Id: I4b8a4dbbcb687de966e9f2dee02f668f6ce5a602 ---- - sepolicy/file_contexts | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts -index b65aa2a3..66969cbd 100644 ---- a/sepolicy/file_contexts -+++ b/sepolicy/file_contexts -@@ -149,7 +149,13 @@ - /sys/devices/fdb00000\.qcom,kgsl-3d0/kgsl/kgsl-3d0/gpuclk u:object_r:sysfs_thermal:s0 - /sys/devices/fdb00000\.qcom,kgsl-3d0/kgsl/kgsl-3d0/max_gpuclk u:object_r:sysfs_thermal:s0 - /sys/devices/fdb00000\.qcom,kgsl-3d0/kgsl/kgsl-3d0/reset_count u:object_r:sysfs_thermal:s0 --/sys/devices/f9923000\.i2c/i2c-84/84-0036/power_supply/battery/capacity u:object_r:sysfs_batteryinfo:s0 -+ -+/sys/devices/f9923000\.i2c/i2c-84/84-0036/power_supply/battery(/.*)? u:object_r:sysfs_batteryinfo:s0 -+/sys/devices/f9923000.i2c/i2c-84/84-006b/power_supply/ac(/.*)? u:object_r:sysfs_batteryinfo:s0 -+/sys/devices/msm_dwc3/power_supply/usb(/.*)? u:object_r:sysfs_batteryinfo:s0 -+/sys/devices/virtual/power_supply/touch(/.*)? u:object_r:sysfs_batteryinfo:s0 -+/sys/devices/bq51013b_wlc.77/power_supply/wireless(/.*)? u:object_r:sysfs_batteryinfo:s0 -+/sys/devices/battery_tm_ctrl.78/power_supply/batt_therm(/.*)? u:object_r:sysfs_batteryinfo:s0 - - # Sysfs files used by qmuxd - /sys/devices/virtual/smdpkt/smdcntl([0-9])+/open_timeout u:object_r:sysfs_smdcntl_open_timeout:s0 diff --git a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263105.patch b/Patches/LineageOS-16.0/android_device_lge_hammerhead/263105.patch deleted file mode 100644 index c1ca045f..00000000 --- a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263105.patch +++ /dev/null @@ -1,29 +0,0 @@ -From dbd5721bb8845fe408d53f48601df500d685065c Mon Sep 17 00:00:00 2001 -From: Roman Yarullin -Date: Sun, 3 Nov 2019 01:20:04 +0200 -Subject: [PATCH] sepolicy: Resolve storaged denials - -*Label /sys/devices/msm_sdcc.1/mmc_host/mmc1/mmc1:0001/block/mmcblk0/stat as sysfs_disk_stat - -* denied { read open } for name=stat dev=sysfs ino=19332 scontext=u:r:storaged:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { getattr } for path=/sys/devices/msm_sdcc.1/mmc_host/mmc1/mmc1:0001/block/mmcblk0/stat dev=sysfs ino=19332 scontext=u:r:storaged:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -Change-Id: Ic4047346cdc282568069b9abdb3d250c051d6579 ---- - sepolicy/file_contexts | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts -index 66969cbd..4540ce06 100644 ---- a/sepolicy/file_contexts -+++ b/sepolicy/file_contexts -@@ -157,6 +157,8 @@ - /sys/devices/bq51013b_wlc.77/power_supply/wireless(/.*)? u:object_r:sysfs_batteryinfo:s0 - /sys/devices/battery_tm_ctrl.78/power_supply/batt_therm(/.*)? u:object_r:sysfs_batteryinfo:s0 - -+/sys/devices/msm_sdcc.1/mmc_host/mmc1/mmc1:0001/block/mmcblk0/stat u:object_r:sysfs_disk_stat:s0 -+ - # Sysfs files used by qmuxd - /sys/devices/virtual/smdpkt/smdcntl([0-9])+/open_timeout u:object_r:sysfs_smdcntl_open_timeout:s0 - diff --git a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263106.patch b/Patches/LineageOS-16.0/android_device_lge_hammerhead/263106.patch deleted file mode 100644 index 0e070df5..00000000 --- a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263106.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 48c9750798e2e06baf61f598ba4715ad402b3493 Mon Sep 17 00:00:00 2001 -From: Kevin Haggerty -Date: Sun, 3 Nov 2019 01:36:15 +0200 -Subject: [PATCH] sepolicy: Label sysfs_net - - * avc: denied { write } for name=mtu dev=sysfs ino=24282 - scontext=u:r:netd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - - avc: denied { open } for name=mtu dev=sysfs ino=24282 - scontext=u:r:netd:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -Change-Id: I6f40b8bdac2537b7000c02af6fac8277acb2a718 ---- - sepolicy/file_contexts | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts -index 4540ce06..7cb352a2 100644 ---- a/sepolicy/file_contexts -+++ b/sepolicy/file_contexts -@@ -159,6 +159,9 @@ - - /sys/devices/msm_sdcc.1/mmc_host/mmc1/mmc1:0001/block/mmcblk0/stat u:object_r:sysfs_disk_stat:s0 - -+#sysfs - net -+/sys/devices/virtual/net(/.*)? u:object_r:sysfs_net:s0 -+ - # Sysfs files used by qmuxd - /sys/devices/virtual/smdpkt/smdcntl([0-9])+/open_timeout u:object_r:sysfs_smdcntl_open_timeout:s0 - diff --git a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263107.patch b/Patches/LineageOS-16.0/android_device_lge_hammerhead/263107.patch deleted file mode 100644 index 8ab3e88f..00000000 --- a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263107.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 513a0c7562b5f15852090cf4ba3b9e4321e03102 Mon Sep 17 00:00:00 2001 -From: Sashko -Date: Sun, 3 Nov 2019 01:47:42 +0200 -Subject: [PATCH] sepolicy: Resolve init denials - -* denied { setattr } for name=state dev=sysfs ino=9120 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_bluetooth_writable:s0 tclass=file permissive=1 - -* denied { setattr } for name=hpd dev=sysfs ino=11773 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_surfaceflinger:s0 tclass=file permissive=1 - -* denied { setattr } for pid=1 comm=init name=firmware_path dev=sysfs ino=5881 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_wlan_fwpath:s0 tclass=file permissive=1 - -* denied { setattr } for name=file dev=sysfs ino=15720 scontext=u:r:init:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { write } for name=boot dev=sysfs ino=8899 scontext=u:r:init:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -* denied { open } for name=boot dev=sysfs ino=8899 scontext=u:r:init:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -Change-Id: I2f35267ea74a5646bb423192162752e44aa51064 ---- - sepolicy/file.te | 5 +++++ - sepolicy/file_contexts | 23 ++++++++++++++++++++++- - sepolicy/init.te | 17 +++++++++++++++++ - 3 files changed, 44 insertions(+), 1 deletion(-) - -diff --git a/sepolicy/file.te b/sepolicy/file.te -index 34eb6229..0c1a3820 100644 ---- a/sepolicy/file.te -+++ b/sepolicy/file.te -@@ -26,3 +26,8 @@ type sysfs_mpdecision, fs_type, sysfs_type; - type sysfs_surfaceflinger, fs_type, sysfs_type; - type sysfs_smdcntl_open_timeout, fs_type, sysfs_type; - type sysfs_soc, fs_type, sysfs_type; -+type sysfs_adsp, fs_type, sysfs_type; -+type sysfs_thermal_control, fs_type, sysfs_type; -+type sysfs_ssr_toggle, fs_type, sysfs_type; -+type sysfs_ramdump, fs_type, sysfs_type; -+type sysfs_irq, fs_type, sysfs_type; -diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts -index 7cb352a2..602f1753 100644 ---- a/sepolicy/file_contexts -+++ b/sepolicy/file_contexts -@@ -162,11 +162,32 @@ - #sysfs - net - /sys/devices/virtual/net(/.*)? u:object_r:sysfs_net:s0 - -+/sys/devices/mdp\.0/qcom,mdss_fb_primary.160/leds/lcd-backlight/brightness u:object_r:sysfs_leds:s0 -+/sys/devices/leds-qpnp-23/leds(/.*)? u:object_r:sysfs_leds:s0 -+ -+/sys/kernel/boot_adsp/boot u:object_r:sysfs_adsp:s0 -+ -+/sys/module/msm_thermal/core_control/enabled u:object_r:sysfs_thermal_control:s0 -+ -+/sys/devices/fe200000\.qcom,lpass/subsys[0-2]/restart_level u:object_r:sysfs_ssr_toggle:s0 -+/sys/devices/fc880000\.qcom,mss/subsys[0-2]/restart_level u:object_r:sysfs_ssr_toggle:s0 -+/sys/devices/fdce0000\.qcom,venus/subsys[0-2]/restart_level u:object_r:sysfs_ssr_toggle:s0 -+ -+/sys/module/subsystem_restart/parameters/enable_ramdumps u:object_r:sysfs_ramdump:s0 -+ -+/sys/devices/msm_dwc3/f9200000\.dwc3/gadget/lun[0-9]+(/.*)? u:object_r:sysfs_android_usb:s0 -+ - # Sysfs files used by qmuxd - /sys/devices/virtual/smdpkt/smdcntl([0-9])+/open_timeout u:object_r:sysfs_smdcntl_open_timeout:s0 - - # Bluetooth --/sys/devices/platform/bluetooth_rfkill/rfkill/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0 -+/sys/devices/platform/bluetooth_rfkill/rfkill/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0 -+/sys/devices/platform/bluetooth_rfkill/rfkill/rfkill0/type u:object_r:sysfs_bluetooth_writable:s0 -+ -+/sys/module/lpm_resources/enable_low_power(/.*)? u:object_r:sysfs_mpdecision:s0 -+ -+/sys/module/slimport/parameters/enable_irq u:object_r:sysfs_irq:s0 -+/sys/module/msm_show_resume_irq/parameters/debug_mask u:object_r:sysfs_irq:s0 - - # Thermal engine - /dev/msm_thermal_query u:object_r:thermal_engine_device:s0 -diff --git a/sepolicy/init.te b/sepolicy/init.te -index 3aa81d1b..05a26d5b 100644 ---- a/sepolicy/init.te -+++ b/sepolicy/init.te -@@ -1 +1,18 @@ - allow init tmpfs:lnk_file create_file_perms; -+ -+allow init { -+ sysfs_bluetooth_writable -+ sysfs_leds -+ sysfs_surfaceflinger -+ sysfs_wlan_fwpath -+ }:file setattr; -+ -+allow init { -+ sysfs_adsp -+ sysfs_devices_system_cpu -+ sysfs_mpdecision -+ sysfs_irq -+ sysfs_ramdump -+ sysfs_ssr_toggle -+ sysfs_thermal_control -+ }:file w_file_perms; -\ No newline at end of file diff --git a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263108.patch b/Patches/LineageOS-16.0/android_device_lge_hammerhead/263108.patch deleted file mode 100644 index 9d748a39..00000000 --- a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263108.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 5ff294c0a20302e01695ebc82180d0ad6ea11501 Mon Sep 17 00:00:00 2001 -From: Sashko -Date: Sun, 3 Nov 2019 02:07:03 +0200 -Subject: [PATCH] sepolicy: Resolve surfaceflinger denials - -denied { read open } for name=msm_fb_split dev=sysfs ino=11739 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -denied { getattr } for path=/sys/devices/virtual/graphics/fb0/msm_fb_split dev=sysfs ino=11739 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 - -denied { read open } for name=fb2 dev=sysfs ino=11788 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs:s0 tclass=dir permissive=1 - -denied { search read open } for name=fb0 dev=sysfs ino=11697 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs_surfaceflinger:s0 tclass=dir permissive=1 - -denied { write } for name=rgb dev=sysfs ino=11740 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_surfaceflinger:s0 tclass=file permissive=1 - -Change-Id: I404b61992eb082d87c5b3b1b7875a7bc83f8cf7d ---- - sepolicy/file_contexts | 4 +--- - sepolicy/surfaceflinger.te | 1 + - sepolicy/system_server.te | 2 ++ - 3 files changed, 4 insertions(+), 3 deletions(-) - -diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts -index 9ec66741..cb9b79e7 100644 ---- a/sepolicy/file_contexts -+++ b/sepolicy/file_contexts -@@ -142,9 +142,7 @@ - /sys/module/pm_8x60/modes(/.*)? u:object_r:sysfs_mpdecision:s0 - - # Sysfs files used by surfaceflinger --/sys/devices/virtual/graphics/fb1/hpd -- u:object_r:sysfs_surfaceflinger:s0 --/sys/devices/virtual/graphics/fb1/vendor_name -- u:object_r:sysfs_surfaceflinger:s0 --/sys/devices/virtual/graphics/fb1/product_description -- u:object_r:sysfs_surfaceflinger:s0 -+/sys/devices/virtual/graphics/fb([0-2])+(/.*)? u:object_r:sysfs_surfaceflinger:s0 - - /sys/devices/fdb00000\.qcom,kgsl-3d0/kgsl/kgsl-3d0/gpuclk u:object_r:sysfs_thermal:s0 - /sys/devices/fdb00000\.qcom,kgsl-3d0/kgsl/kgsl-3d0/max_gpuclk u:object_r:sysfs_thermal:s0 -diff --git a/sepolicy/surfaceflinger.te b/sepolicy/surfaceflinger.te -index a92feab8..e2760a36 100644 ---- a/sepolicy/surfaceflinger.te -+++ b/sepolicy/surfaceflinger.te -@@ -1,3 +1,4 @@ -+allow surfaceflinger sysfs_surfaceflinger:dir r_dir_perms; - allow surfaceflinger sysfs_surfaceflinger:file rw_file_perms; - allow surfaceflinger sysfs_thermal:file r_file_perms; - allow surfaceflinger qdisplay_service:service_manager { add find }; -diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te -index ab211feb..cf161518 100644 ---- a/sepolicy/system_server.te -+++ b/sepolicy/system_server.te -@@ -22,6 +22,8 @@ allow system_server self:netlink_socket create_socket_perms_no_ioctl; - - allow system_server sysfs_thermal:file r_file_perms; - -+allow system_server sysfs_surfaceflinger:file write; -+ - allow system_server sensors_device:chr_file getattr; - - allowxperm system_server self:udp_socket ioctl { SIOCSIFFLAGS SIOCDEVPRIVATE_D }; diff --git a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263109.patch b/Patches/LineageOS-16.0/android_device_lge_hammerhead/263109.patch deleted file mode 100644 index 1c545527..00000000 --- a/Patches/LineageOS-16.0/android_device_lge_hammerhead/263109.patch +++ /dev/null @@ -1,20 +0,0 @@ -From cc823367ab4624a34502121c5671c8a37fb6fbb6 Mon Sep 17 00:00:00 2001 -From: Sashko -Date: Sun, 3 Nov 2019 02:36:57 +0200 -Subject: [PATCH] sepolicy: Resolve nfc denial - - denied { search } for pid=236 comm=android.hardwar name=nfc dev=mmcblk0p29 ino=610801 scontext=u:r:hal_nfc_default:s0 tcontext=u:object_r:nfc_data_file:s0 tclass=dir permissive=0 - -Change-Id: I455e2ca9e35f287b757e958cbc1f67d19d903ac6 ---- - sepolicy/hal_nfc_default.te | 1 + - 1 file changed, 1 insertion(+) - create mode 100644 sepolicy/hal_nfc_default.te - -diff --git a/sepolicy/hal_nfc_default.te b/sepolicy/hal_nfc_default.te -new file mode 100644 -index 00000000..e183dd8e ---- /dev/null -+++ b/sepolicy/hal_nfc_default.te -@@ -0,0 +1 @@ -+allow hal_nfc_default nfc_data_file:dir search; diff --git a/Patches/LineageOS-18.1/android_vendor_qcom_opensource_packages_apps_Bluetooth/405585.patch b/Patches/LineageOS-18.1/android_vendor_qcom_opensource_packages_apps_Bluetooth/405585.patch index 8536e443..eb521455 100644 --- a/Patches/LineageOS-18.1/android_vendor_qcom_opensource_packages_apps_Bluetooth/405585.patch +++ b/Patches/LineageOS-18.1/android_vendor_qcom_opensource_packages_apps_Bluetooth/405585.patch @@ -1,4 +1,4 @@ -From 0b906b1eef2156110bb753272fe133c096eb371b Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Himanshu Rawat Date: Mon, 8 Apr 2024 19:44:45 +0000 Subject: [PATCH] RESTRICT AUTOMERGE Disallow unexpected incoming HID @@ -62,7 +62,7 @@ diff --git a/src/com/android/bluetooth/hid/HidHostService.java b/src/com/android index 4687bd6a1..0258f1fdd 100644 --- a/src/com/android/bluetooth/hid/HidHostService.java +++ b/src/com/android/bluetooth/hid/HidHostService.java -@@ -167,7 +167,10 @@ public void handleMessage(Message msg) { +@@ -167,7 +167,10 @@ public class HidHostService extends ProfileService { break; case MESSAGE_DISCONNECT: { BluetoothDevice device = (BluetoothDevice) msg.obj; @@ -74,7 +74,7 @@ index 4687bd6a1..0258f1fdd 100644 broadcastConnectionState(device, BluetoothProfile.STATE_DISCONNECTING); broadcastConnectionState(device, BluetoothProfile.STATE_DISCONNECTED); break; -@@ -192,7 +195,10 @@ public void handleMessage(Message msg) { +@@ -192,7 +195,10 @@ public class HidHostService extends ProfileService { Log.d(TAG, "Incoming HID connection rejected"); } if (disconnectRemote(device)) { @@ -86,7 +86,7 @@ index 4687bd6a1..0258f1fdd 100644 } else { virtualUnPlugNative(Utils.getByteAddress(device)); } -@@ -978,7 +984,7 @@ public void dump(StringBuilder sb) { +@@ -978,7 +984,7 @@ public class HidHostService extends ProfileService { private native boolean connectHidNative(byte[] btAddress); diff --git a/Patches/LineageOS-18.1/android_vendor_qcom_opensource_system_bt/405583.patch b/Patches/LineageOS-18.1/android_vendor_qcom_opensource_system_bt/405583.patch index e810128f..2439164f 100644 --- a/Patches/LineageOS-18.1/android_vendor_qcom_opensource_system_bt/405583.patch +++ b/Patches/LineageOS-18.1/android_vendor_qcom_opensource_system_bt/405583.patch @@ -1,4 +1,4 @@ -From eb91d38c9e876c23d9a51ecc8bf9b55ad90c2c4d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Chris Manton Date: Sun, 14 Mar 2021 09:52:19 -0700 Subject: [PATCH] Add btif/include/btif_hh::btif_hh_status_text diff --git a/Patches/LineageOS-18.1/android_vendor_qcom_opensource_system_bt/405584.patch b/Patches/LineageOS-18.1/android_vendor_qcom_opensource_system_bt/405584.patch index f860a166..811d9916 100644 --- a/Patches/LineageOS-18.1/android_vendor_qcom_opensource_system_bt/405584.patch +++ b/Patches/LineageOS-18.1/android_vendor_qcom_opensource_system_bt/405584.patch @@ -1,4 +1,4 @@ -From 0196deeccce43dc7fc5d8c4bfe94d2f24ad2d4b2 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Himanshu Rawat Date: Mon, 8 Apr 2024 19:42:21 +0000 Subject: [PATCH] RESTRICT AUTOMERGE Disallow unexpected incoming HID diff --git a/Patches/LineageOS-20.0/ASB-2023-10/av-01.patch b/Patches/LineageOS-20.0/ASB-2023-10/av-01.patch deleted file mode 100644 index 52acdac9..00000000 --- a/Patches/LineageOS-20.0/ASB-2023-10/av-01.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 41235bcc67a2122bc1d6a4d19e8356b3d1ada91e Mon Sep 17 00:00:00 2001 -From: Kyle Zhang -Date: Fri, 10 Mar 2023 00:06:16 +0000 -Subject: [PATCH] Fix mSession NULL dereference - -Bug: 230793853 -Test: clearkeyV1.4_fuzzer -Change-Id: I3f11b133a4854a9ef896c9f5042bd719527c3fa6 ---- - drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp | 3 +++ - drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp | 4 ++++ - 2 files changed, 7 insertions(+) - -diff --git a/drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp -index afc9b6a9a4..a63471fd53 100644 ---- a/drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp -+++ b/drm/mediadrm/plugins/clearkey/aidl/CryptoPlugin.cpp -@@ -137,6 +137,8 @@ ::ndk::ScopedAStatus CryptoPlugin::decrypt(const DecryptArgs& in_args, int32_t* - *_aidl_return = static_cast(offset); - return toNdkScopedAStatus(Status::OK); - } else if (in_args.mode == Mode::AES_CTR) { -+ if (!mSession) return toNdkScopedAStatus(Status::ERROR_DRM_CANNOT_HANDLE, -+ "session not found"); - size_t bytesDecrypted{}; - std::vector clearDataLengths; - std::vector encryptedDataLengths; -@@ -149,6 +151,7 @@ ::ndk::ScopedAStatus CryptoPlugin::decrypt(const DecryptArgs& in_args, int32_t* - detailedError = "invalid decrypt parameter size"; - return toNdkScopedAStatus(Status::ERROR_DRM_CANNOT_HANDLE, detailedError); - } -+ - auto res = - mSession->decrypt(in_args.keyId.data(), in_args.iv.data(), - srcPtr, static_cast(destPtr), -diff --git a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp -index 7bc320db6b..64a43b0af7 100644 ---- a/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp -+++ b/drm/mediadrm/plugins/clearkey/hidl/CryptoPlugin.cpp -@@ -211,6 +211,10 @@ Return CryptoPlugin::decrypt_1_2( - _hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0, "invalid decrypt parameter size"); - return Void(); - } -+ if (!mSession) { -+ _hidl_cb(Status_V1_2::ERROR_DRM_CANNOT_HANDLE, 0, "session not found"); -+ return Void(); -+ } - Status_V1_2 res = mSession->decrypt(keyId.data(), iv.data(), srcPtr, - static_cast(destPtr), toVector(subSamples), &bytesDecrypted); - if (res == Status_V1_2::OK) { diff --git a/Patches/LineageOS-20.0/ASB-2023-10/av-02.patch b/Patches/LineageOS-20.0/ASB-2023-10/av-02.patch deleted file mode 100644 index ff0f27d7..00000000 --- a/Patches/LineageOS-20.0/ASB-2023-10/av-02.patch +++ /dev/null @@ -1,26 +0,0 @@ -From a89f704701e6af4a4809f4bb4911af88a023226f Mon Sep 17 00:00:00 2001 -From: Kyle Zhang -Date: Wed, 22 Feb 2023 20:14:34 +0000 -Subject: [PATCH] Fix null pointer derefernce AMediaDrm_setPropertyByteArray - -Bug: 234798181 -Test: ndkDrmFuzzer -Change-Id: I0d2d92ce7be108a904e811048f90a93571862ebc ---- - media/ndk/NdkMediaDrm.cpp | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/media/ndk/NdkMediaDrm.cpp b/media/ndk/NdkMediaDrm.cpp -index f4674dea63..170506168f 100644 ---- a/media/ndk/NdkMediaDrm.cpp -+++ b/media/ndk/NdkMediaDrm.cpp -@@ -758,6 +758,9 @@ media_status_t AMediaDrm_setPropertyString(AMediaDrm *mObj, - EXPORT - media_status_t AMediaDrm_setPropertyByteArray(AMediaDrm *mObj, - const char *propertyName, const uint8_t *value, size_t valueSize) { -+ if (!mObj || mObj->mDrm == NULL) { -+ return AMEDIA_ERROR_INVALID_OBJECT; -+ } - - Vector byteArray; - byteArray.appendArray(value, valueSize); diff --git a/Patches/LineageOS-20.0/ASB-2023-10/av-03.patch b/Patches/LineageOS-20.0/ASB-2023-10/av-03.patch deleted file mode 100644 index b8e9f595..00000000 --- a/Patches/LineageOS-20.0/ASB-2023-10/av-03.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 6d7cd80d77ed35efbe168f627dda021a5d8dd766 Mon Sep 17 00:00:00 2001 -From: Kwangkyu Park -Date: Thu, 9 Feb 2023 16:29:10 +0900 -Subject: [PATCH] Fix an issue that a free memory is accessed - -In error state, request thread join is not executed. And, -Camera3Device's mId can be accessed from String& after being freed with -CLOGE(). - -This fix will address by changing reference type to normal variable. - -Bug: 268437033 -Change-Id: Iad3fcd0fbbaf1e18a2b95093aba08015a933374c ---- - services/camera/libcameraservice/device3/Camera3Device.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/services/camera/libcameraservice/device3/Camera3Device.h b/services/camera/libcameraservice/device3/Camera3Device.h -index e6073a94d4..5187a96f59 100644 ---- a/services/camera/libcameraservice/device3/Camera3Device.h -+++ b/services/camera/libcameraservice/device3/Camera3Device.h -@@ -1010,7 +1010,7 @@ class Camera3Device : - - wp mListener; - -- const String8& mId; // The camera ID -+ const String8 mId; // The camera ID - int mStatusId; // The RequestThread's component ID for - // status tracking - diff --git a/Patches/LineageOS-20.0/ASB-2023-10/av-04.patch b/Patches/LineageOS-20.0/ASB-2023-10/av-04.patch deleted file mode 100644 index d67fb6c6..00000000 --- a/Patches/LineageOS-20.0/ASB-2023-10/av-04.patch +++ /dev/null @@ -1,300 +0,0 @@ -From 75fc175a08c1a8e86d4649c19fd3136121518b96 Mon Sep 17 00:00:00 2001 -From: Ray Essick -Date: Mon, 22 Aug 2022 15:58:51 -0500 -Subject: [PATCH] NdkMediaFormat_*() parameter checking - -verify non-null format and name fields in the NdkMediaFormat_set/get -functions. Update unit tests to verify fixes are in place. - -Bug: 243204176 -Test: atest libmediandk_test -Change-Id: I551b61c96dce71310bcd1d057abad0fde021cc55 ---- - media/ndk/NdkMediaFormat.cpp | 97 ++++++++++++++++++++++++- - media/ndk/tests/NdkMediaFormat_test.cpp | 45 ++++++++++++ - 2 files changed, 141 insertions(+), 1 deletion(-) - -diff --git a/media/ndk/NdkMediaFormat.cpp b/media/ndk/NdkMediaFormat.cpp -index 923453ac1b..a95e87419a 100644 ---- a/media/ndk/NdkMediaFormat.cpp -+++ b/media/ndk/NdkMediaFormat.cpp -@@ -147,38 +147,80 @@ const char* AMediaFormat_toString(AMediaFormat *mData) { - - EXPORT - bool AMediaFormat_getInt32(AMediaFormat* format, const char *name, int32_t *out) { -+ if (format == nullptr) { -+ return false; -+ } -+ if (name == nullptr) { -+ return false; -+ } - return format->mFormat->findInt32(name, out); - } - - EXPORT - bool AMediaFormat_getInt64(AMediaFormat* format, const char *name, int64_t *out) { -+ if (format == nullptr) { -+ return false; -+ } -+ if (name == nullptr) { -+ return false; -+ } - return format->mFormat->findInt64(name, out); - } - - EXPORT - bool AMediaFormat_getFloat(AMediaFormat* format, const char *name, float *out) { -+ if (format == nullptr) { -+ return false; -+ } -+ if (name == nullptr) { -+ return false; -+ } - return format->mFormat->findFloat(name, out); - } - - EXPORT - bool AMediaFormat_getDouble(AMediaFormat* format, const char *name, double *out) { -+ if (format == nullptr) { -+ return false; -+ } -+ if (name == nullptr) { -+ return false; -+ } - return format->mFormat->findDouble(name, out); - } - - EXPORT - bool AMediaFormat_getSize(AMediaFormat* format, const char *name, size_t *out) { -+ if (format == nullptr) { -+ return false; -+ } -+ if (name == nullptr) { -+ return false; -+ } - return format->mFormat->findSize(name, out); - } - - EXPORT - bool AMediaFormat_getRect(AMediaFormat* format, const char *name, - int32_t *left, int32_t *top, int32_t *right, int32_t *bottom) { -+ if (format == nullptr) { -+ return false; -+ } -+ if (name == nullptr) { -+ return false; -+ } - return format->mFormat->findRect(name, left, top, right, bottom); - } - - EXPORT - bool AMediaFormat_getBuffer(AMediaFormat* format, const char *name, void** data, size_t *outsize) { - sp buf; -+ if (format == nullptr) { -+ return false; -+ } -+ if (name == nullptr) { -+ return false; -+ } - if (format->mFormat->findBuffer(name, &buf)) { - *data = buf->data() + buf->offset(); - *outsize = buf->size(); -@@ -189,7 +231,12 @@ bool AMediaFormat_getBuffer(AMediaFormat* format, const char *name, void** data, - - EXPORT - bool AMediaFormat_getString(AMediaFormat* mData, const char *name, const char **out) { -- -+ if (mData == nullptr) { -+ return false; -+ } -+ if (name == nullptr) { -+ return false; -+ } - for (size_t i = 0; i < mData->mStringCache.size(); i++) { - if (strcmp(mData->mStringCache.keyAt(i).string(), name) == 0) { - mData->mStringCache.removeItemsAt(i, 1); -@@ -212,43 +259,91 @@ bool AMediaFormat_getString(AMediaFormat* mData, const char *name, const char ** - - EXPORT - void AMediaFormat_setInt32(AMediaFormat* format, const char *name, int32_t value) { -+ if (format == nullptr) { -+ return; -+ } -+ if (name == nullptr) { -+ return; -+ } - format->mFormat->setInt32(name, value); - } - - EXPORT - void AMediaFormat_setInt64(AMediaFormat* format, const char *name, int64_t value) { -+ if (format == nullptr) { -+ return; -+ } -+ if (name == nullptr) { -+ return; -+ } - format->mFormat->setInt64(name, value); - } - - EXPORT - void AMediaFormat_setFloat(AMediaFormat* format, const char* name, float value) { -+ if (format == nullptr) { -+ return; -+ } -+ if (name == nullptr) { -+ return; -+ } - format->mFormat->setFloat(name, value); - } - - EXPORT - void AMediaFormat_setDouble(AMediaFormat* format, const char* name, double value) { -+ if (format == nullptr) { -+ return; -+ } -+ if (name == nullptr) { -+ return; -+ } - format->mFormat->setDouble(name, value); - } - - EXPORT - void AMediaFormat_setSize(AMediaFormat* format, const char* name, size_t value) { -+ if (format == nullptr) { -+ return; -+ } -+ if (name == nullptr) { -+ return; -+ } - format->mFormat->setSize(name, value); - } - - EXPORT - void AMediaFormat_setRect(AMediaFormat* format, const char *name, - int32_t left, int32_t top, int32_t right, int32_t bottom) { -+ if (format == nullptr) { -+ return; -+ } -+ if (name == nullptr) { -+ return; -+ } - format->mFormat->setRect(name, left, top, right, bottom); - } - - EXPORT - void AMediaFormat_setString(AMediaFormat* format, const char* name, const char* value) { -+ if (format == nullptr) { -+ return; -+ } -+ if (name == nullptr) { -+ return; -+ } - // AMessage::setString() makes a copy of the string - format->mFormat->setString(name, value, strlen(value)); - } - - EXPORT - void AMediaFormat_setBuffer(AMediaFormat* format, const char* name, const void* data, size_t size) { -+ if (format == nullptr) { -+ return; -+ } -+ if (name == nullptr) { -+ return; -+ } - // the ABuffer(void*, size_t) constructor doesn't take ownership of the data, so create - // a new buffer and copy the data into it - sp buf = new ABuffer(size); -diff --git a/media/ndk/tests/NdkMediaFormat_test.cpp b/media/ndk/tests/NdkMediaFormat_test.cpp -index 668d0a4463..18690b8782 100644 ---- a/media/ndk/tests/NdkMediaFormat_test.cpp -+++ b/media/ndk/tests/NdkMediaFormat_test.cpp -@@ -51,6 +51,13 @@ TEST(NdkMediaFormat_tests, test_int32) { - EXPECT_FALSE(AMediaFormat_getInt64(fmt1, "five", &i64)); - EXPECT_EQ(i32, 5); - -+ // verify detecting some bad parameters. -+ AMediaFormat_setInt32(nullptr, "whatever", 6); -+ AMediaFormat_setInt32(fmt1, nullptr, 6); -+ -+ EXPECT_FALSE(AMediaFormat_getInt32(nullptr, "whatever", &i32)); -+ EXPECT_FALSE(AMediaFormat_getInt32(fmt1, nullptr, &i32)); -+ - AMediaFormat_delete(fmt1); - } - -@@ -67,6 +74,13 @@ TEST(NdkMediaFormat_tests, test_int64) { - EXPECT_FALSE(AMediaFormat_getInt64(fmt1, "five", &i64)); - EXPECT_EQ(i64, -1); - -+ // verify detecting some bad parameters. -+ AMediaFormat_setInt64(nullptr, "whatever", 6); -+ AMediaFormat_setInt64(fmt1, nullptr, 6); -+ -+ EXPECT_FALSE(AMediaFormat_getInt64(nullptr, "whatever", &i64)); -+ EXPECT_FALSE(AMediaFormat_getInt64(fmt1, nullptr, &i64)); -+ - AMediaFormat_delete(fmt1); - } - -@@ -80,6 +94,13 @@ TEST(NdkMediaFormat_tests, test_size) { - EXPECT_TRUE(AMediaFormat_getSize(fmt1, "medium", &size)); - EXPECT_EQ(size, 10); - -+ // verify detecting some bad parameters. -+ AMediaFormat_setSize(nullptr, "whatever", 6); -+ AMediaFormat_setSize(fmt1, nullptr, 6); -+ -+ EXPECT_FALSE(AMediaFormat_getSize(nullptr, "whatever", &size)); -+ EXPECT_FALSE(AMediaFormat_getSize(fmt1, nullptr, &size)); -+ - AMediaFormat_delete(fmt1); - } - -@@ -90,6 +111,14 @@ TEST(NdkMediaFormat_tests, test_float) { - AMediaFormat_setFloat(fmt1, "ship", 0.5); - EXPECT_TRUE(AMediaFormat_getFloat(fmt1, "boat", &f)); - EXPECT_EQ(f, 1.5); -+ -+ // verify detecting some bad parameters. -+ AMediaFormat_setFloat(nullptr, "whatever", 1.5); -+ AMediaFormat_setFloat(fmt1, nullptr, 1.5); -+ -+ EXPECT_FALSE(AMediaFormat_getFloat(nullptr, "whatever", &f)); -+ EXPECT_FALSE(AMediaFormat_getFloat(fmt1, nullptr, &f)); -+ - AMediaFormat_delete(fmt1); - } - -@@ -100,6 +129,14 @@ TEST(NdkMediaFormat_tests, test_double) { - AMediaFormat_setDouble(fmt1, "dip", 0.5); - EXPECT_TRUE(AMediaFormat_getDouble(fmt1, "trouble", &d)); - EXPECT_EQ(d, 100.5); -+ -+ // verify detecting some bad parameters. -+ AMediaFormat_setDouble(nullptr, "whatever", 1.5); -+ AMediaFormat_setDouble(fmt1, nullptr, 1.5); -+ -+ EXPECT_FALSE(AMediaFormat_getDouble(nullptr, "whatever", &d)); -+ EXPECT_FALSE(AMediaFormat_getDouble(fmt1, nullptr, &d)); -+ - AMediaFormat_delete(fmt1); - } - -@@ -111,8 +148,16 @@ TEST(NdkMediaFormat_tests, test_string) { - AMediaFormat_setString(fmt1, "stringtheory", content); - EXPECT_TRUE(AMediaFormat_getString(fmt1, "stringtheory", &out)); - EXPECT_NE(out, nullptr); -+ EXPECT_NE(out, content); // should not be the original - EXPECT_EQ(strcmp(out,content), 0); - -+ // verify detecting some bad parameters. -+ AMediaFormat_setString(nullptr, "whatever", content); -+ AMediaFormat_setString(fmt1, nullptr, content); -+ -+ EXPECT_FALSE(AMediaFormat_getString(nullptr, "whatever", &out)); -+ EXPECT_FALSE(AMediaFormat_getString(fmt1, nullptr, &out)); -+ - AMediaFormat_delete(fmt1); - } - diff --git a/Patches/LineageOS-20.0/ASB-2023-10/av-05.patch b/Patches/LineageOS-20.0/ASB-2023-10/av-05.patch deleted file mode 100644 index 25bcdab2..00000000 --- a/Patches/LineageOS-20.0/ASB-2023-10/av-05.patch +++ /dev/null @@ -1,33 +0,0 @@ -From b023ec300f437494d6d6b23b03607e308dae43d2 Mon Sep 17 00:00:00 2001 -From: Jiajia Cong -Date: Wed, 2 Dec 2020 12:00:49 +0800 -Subject: [PATCH] codec2: fix issue in allocating too many 8k buffers - -default output delay is too large, in 8k use case, framework doesn't -allow to use so much memory to allocate those 8k buffers. - -if exceeds max capacity and underlying buffer alloc fail. do not -create MediaCodecBuffer holds a null underlying ABuffer. Otherwise, -some MediaCodecBuffer APIs may access ABuffer (nullptr). - -Bug: b/208481412 -Change-Id: Ic8e33f6c27ee1c435bf0dc4bc09df87cb0ad3c3a ---- - media/codec2/sfplugin/Codec2Buffer.cpp | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/media/codec2/sfplugin/Codec2Buffer.cpp b/media/codec2/sfplugin/Codec2Buffer.cpp -index 55e0c45fad..876c96d484 100644 ---- a/media/codec2/sfplugin/Codec2Buffer.cpp -+++ b/media/codec2/sfplugin/Codec2Buffer.cpp -@@ -843,6 +843,10 @@ sp ConstGraphicBlockBuffer::AllocateEmpty( - } - } - sp aBuffer(alloc(align(width, 16) * align(height, 16) * bpp / 8)); -+ if (aBuffer == nullptr) { -+ ALOGD("%s: failed to allocate buffer", __func__); -+ return nullptr; -+ } - return new ConstGraphicBlockBuffer( - format, - aBuffer, diff --git a/Patches/LineageOS-20.0/ASB-2023-10/av-06.patch b/Patches/LineageOS-20.0/ASB-2023-10/av-06.patch deleted file mode 100644 index bb1e8c85..00000000 --- a/Patches/LineageOS-20.0/ASB-2023-10/av-06.patch +++ /dev/null @@ -1,29 +0,0 @@ -From c8117d1539078bb3339b5d5fffe063a9135c2c21 Mon Sep 17 00:00:00 2001 -From: Arun Johnson -Date: Mon, 18 Jul 2022 19:16:04 +0000 -Subject: [PATCH] Adding null check for IResourceManagerClient in dump() - -bug: 191613308 -Change-Id: I1694f2d1c13163a9b8162630377de71303bc517f ---- - services/mediaresourcemanager/ResourceManagerService.cpp | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - -diff --git a/services/mediaresourcemanager/ResourceManagerService.cpp b/services/mediaresourcemanager/ResourceManagerService.cpp -index b4610bc71e..4d18876bfc 100644 ---- a/services/mediaresourcemanager/ResourceManagerService.cpp -+++ b/services/mediaresourcemanager/ResourceManagerService.cpp -@@ -271,10 +271,9 @@ binder_status_t ResourceManagerService::dump(int fd, const char** /*args*/, uint - snprintf(buffer, SIZE, " Id: %lld\n", (long long)infos[j].clientId); - result.append(buffer); - -- std::string clientName; -- Status status = infos[j].client->getName(&clientName); -- if (!status.isOk()) { -- clientName = ""; -+ std::string clientName = ""; -+ if (infos[j].client != nullptr) { -+ Status status = infos[j].client->getName(&clientName); - } - snprintf(buffer, SIZE, " Name: %s\n", clientName.c_str()); - result.append(buffer); diff --git a/Patches/LineageOS-20.0/ASB-2023-10/av-07.patch b/Patches/LineageOS-20.0/ASB-2023-10/av-07.patch deleted file mode 100644 index e6983a6e..00000000 --- a/Patches/LineageOS-20.0/ASB-2023-10/av-07.patch +++ /dev/null @@ -1,49 +0,0 @@ -From f06d23d824f60e98299d03f21c0715477666936d Mon Sep 17 00:00:00 2001 -From: Jeffrey Kardatzke -Date: Tue, 21 Mar 2023 11:38:33 -0700 -Subject: [PATCH] Fix incorrect buffer size in NuPlayer - -This was discovered from running GTS tests that were failing because the -DRM implementation was receiving media packets of incorrect sizes for -decryption. The problem is that it was copying content using the size of -the underlying MediaBuffer object rather than the range that was set in -it. That was leading to lots of trailing garbage in media packets. -Generally this was fine and decoders would ignore them, but recent -changes in decryption handling for AMD platforms exposed this problem. - -The fix is very straightforward in that we should be using the -range_length rather than the size when copying them. This doesn't impact -non-DRM content as those buffer sizes appear to be correct already based -on testing. - -Bug: b:268158584 -Test: gts.MediaPlayerTest#testLLAMA_H264_BASELINE_240P_800_DOWNLOADED_V1_ASYNC - no longer shows corruption on guybrush and packet sizes now match - up as expected -Change-Id: I14eda495fa76621436b212f2bd3ae9f7093137fe ---- - media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp b/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp -index 52b2041ea8..8da09c434a 100644 ---- a/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp -+++ b/media/libmediaplayerservice/nuplayer/NuPlayerDecoder.cpp -@@ -1104,14 +1104,14 @@ bool NuPlayer::Decoder::onInputBufferFetched(const sp &msg) { - static_cast(holder.get())->mediaBuffer() : nullptr; - } - if (mediaBuf != NULL) { -- if (mediaBuf->size() > codecBuffer->capacity()) { -+ if (mediaBuf->range_length() > codecBuffer->capacity()) { - handleError(ERROR_BUFFER_TOO_SMALL); - mDequeuedInputBuffers.push_back(bufferIx); - return false; - } - -- codecBuffer->setRange(0, mediaBuf->size()); -- memcpy(codecBuffer->data(), mediaBuf->data(), mediaBuf->size()); -+ codecBuffer->setRange(0, mediaBuf->range_length()); -+ memcpy(codecBuffer->data(), mediaBuf->data(), mediaBuf->range_length()); - - MetaDataBase &meta_data = mediaBuf->meta_data(); - cryptInfo = NuPlayerDrm::getSampleCryptoInfo(meta_data); diff --git a/Patches/LineageOS-20.0/ASB-2023-10/av-08.patch b/Patches/LineageOS-20.0/ASB-2023-10/av-08.patch deleted file mode 100644 index e6a75611..00000000 --- a/Patches/LineageOS-20.0/ASB-2023-10/av-08.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 9c7408ab0710a9e36fd2a258098afde863cb6544 Mon Sep 17 00:00:00 2001 -From: Harish Mahendrakar -Date: Wed, 19 Oct 2022 18:17:07 -0700 -Subject: [PATCH] Codec2 decoders: Invalidate allocated graphic buffer in - stop() - -Bug: 243583691 -Test: atest CtsMediaV2TestCases -- --module-arg \ -CtsMediaV2TestCases:instrumentation-arg:codec-prefix:=c2.android. - -Change-Id: I312c106350b2eb072f0e6f2f9a83f16eb8424cb2 ---- - media/codec2/components/avc/C2SoftAvcDec.cpp | 3 +++ - media/codec2/components/hevc/C2SoftHevcDec.cpp | 3 +++ - media/codec2/components/mpeg2/C2SoftMpeg2Dec.cpp | 3 +++ - media/codec2/components/mpeg4_h263/C2SoftMpeg4Dec.cpp | 4 +++- - 4 files changed, 12 insertions(+), 1 deletion(-) - -diff --git a/media/codec2/components/avc/C2SoftAvcDec.cpp b/media/codec2/components/avc/C2SoftAvcDec.cpp -index 953afc57cd..96a4c4a756 100644 ---- a/media/codec2/components/avc/C2SoftAvcDec.cpp -+++ b/media/codec2/components/avc/C2SoftAvcDec.cpp -@@ -671,6 +671,9 @@ status_t C2SoftAvcDec::resetDecoder() { - void C2SoftAvcDec::resetPlugin() { - mSignalledOutputEos = false; - mTimeStart = mTimeEnd = systemTime(); -+ if (mOutBlock) { -+ mOutBlock.reset(); -+ } - } - - status_t C2SoftAvcDec::deleteDecoder() { -diff --git a/media/codec2/components/hevc/C2SoftHevcDec.cpp b/media/codec2/components/hevc/C2SoftHevcDec.cpp -index 5a660c5ca1..7d3b9d9399 100644 ---- a/media/codec2/components/hevc/C2SoftHevcDec.cpp -+++ b/media/codec2/components/hevc/C2SoftHevcDec.cpp -@@ -664,6 +664,9 @@ status_t C2SoftHevcDec::resetDecoder() { - void C2SoftHevcDec::resetPlugin() { - mSignalledOutputEos = false; - mTimeStart = mTimeEnd = systemTime(); -+ if (mOutBlock) { -+ mOutBlock.reset(); -+ } - } - - status_t C2SoftHevcDec::deleteDecoder() { -diff --git a/media/codec2/components/mpeg2/C2SoftMpeg2Dec.cpp b/media/codec2/components/mpeg2/C2SoftMpeg2Dec.cpp -index 9a4191025f..439323c76e 100644 ---- a/media/codec2/components/mpeg2/C2SoftMpeg2Dec.cpp -+++ b/media/codec2/components/mpeg2/C2SoftMpeg2Dec.cpp -@@ -732,6 +732,9 @@ status_t C2SoftMpeg2Dec::resetDecoder() { - void C2SoftMpeg2Dec::resetPlugin() { - mSignalledOutputEos = false; - mTimeStart = mTimeEnd = systemTime(); -+ if (mOutBlock) { -+ mOutBlock.reset(); -+ } - } - - status_t C2SoftMpeg2Dec::deleteDecoder() { -diff --git a/media/codec2/components/mpeg4_h263/C2SoftMpeg4Dec.cpp b/media/codec2/components/mpeg4_h263/C2SoftMpeg4Dec.cpp -index 54a1d0e354..3bf9c48dc3 100644 ---- a/media/codec2/components/mpeg4_h263/C2SoftMpeg4Dec.cpp -+++ b/media/codec2/components/mpeg4_h263/C2SoftMpeg4Dec.cpp -@@ -256,7 +256,9 @@ c2_status_t C2SoftMpeg4Dec::onStop() { - mFramesConfigured = false; - mSignalledOutputEos = false; - mSignalledError = false; -- -+ if (mOutBlock) { -+ mOutBlock.reset(); -+ } - return C2_OK; - } - diff --git a/Scripts/LineageOS-18.1/Patch.sh b/Scripts/LineageOS-18.1/Patch.sh index 374f7dcc..d390b851 100644 --- a/Scripts/LineageOS-18.1/Patch.sh +++ b/Scripts/LineageOS-18.1/Patch.sh @@ -518,7 +518,7 @@ if enterAndClear "system/vold"; then git revert --no-edit 3461ff5c9ad334c96780f3da14f1d23fcbee63ad; #breaks mako first boot fi; -if enterAndClear "vendor/qcom/opensource/commonsys/system/bt"; then +if enterAndClear "vendor/qcom/opensource/commonsys/packages/apps/Bluetooth"; then applyPatch "$DOS_PATCHES/android_vendor_qcom_opensource_packages_apps_Bluetooth/405585.patch"; #R_asb_2024-10 Disallow unexpected incoming HID connections 2/2 fi;