This fixes error checking in the function sc_dhkey_check by
properly checking if the internal call to the function smp_f6
has failed by returning a error code as we must return to the
caller immediately if this internal call fails as we cannot
Signed-off-by: Nicholas Krause <[email protected]>
---
net/bluetooth/smp.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index ad82324..05d9814 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1460,8 +1460,9 @@ static void sc_dhkey_check(struct smp_chan *smp)
if (smp->method == REQ_OOB)
memcpy(r, smp->rr, 16);
- smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
- local_addr, remote_addr, check.e);
+ if (smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
+ local_addr, remote_addr, check.e))
+ return;
smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check);
}
--
2.1.4
Hi Nicholas,
(unneeded recipients removed again)
On Tue, Aug 18, 2015, Nicholas Krause wrote:
> This fixes error checking in the function sc_dhkey_check by
> properly checking if the internal call to the function smp_f6
> has failed by returning a error code as we must return to the
> caller immediately if this internal call fails as we cannot
Looks like the last sentence above is incomplete.
> --- a/net/bluetooth/smp.c
> +++ b/net/bluetooth/smp.c
> @@ -1460,8 +1460,9 @@ static void sc_dhkey_check(struct smp_chan *smp)
> if (smp->method == REQ_OOB)
> memcpy(r, smp->rr, 16);
>
> - smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
> - local_addr, remote_addr, check.e);
> + if (smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
> + local_addr, remote_addr, check.e))
> + return;
This could cause the pairing procedure to get stuck because the remote
is expecting the DHKey Check PDU from us and instead we never send
anything. Probably the better solution is to make sc_dhkey_check()
return an SMP error and then pass that up the call stack if necessary,
similar to what sc_passkey_round() does.
Johan