2022-11-18 03:54:56

by Sungwoo Kim

Subject: [BUG 0 / 6] L2cap: Spec violations

Hello,
Our fuzzer found six spec violations, illegal state transition.

1. BT_CONNECT2 -> BT_CONFIG by L2CAP_CONN_RSP
2. BT_CONNECT2 -> BT_CONNECTED by L2CAP_CONF_RSP
3. BT_CONNECT2 -> BT_DISCONN by L2CAP_CONF_RSP
4. BT_CONNECTED -> BT_CONFIG by L2CAP_CONN_RSP
5. BT_DISCONN -> BT_CONFIG by L2CAP_CONN_RSP
6. BT_DISCONN -> BT_CONNECTED by L2CAP_CONN_RSP

All expected behaviors are ignoring incoming packets as described in
the spec v5.3 | Vol 3, Part A 6. STATE MACHINE.
Also, I assumed BT_CONNECT2 is corresponding to WAIT_CONNECT in the spec.

2022-11-18 04:06:36

by Sungwoo Kim

Subject: [BUG 1 / 6] L2cap: Spec violations

1. BT_CONNECT2 -> BT_CONFIG by L2CAP_CONN_RSP
btmon log:

Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 15.924193
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 15.935617
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 15.935617
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 15.942943
invalid packet size (16 != 2061)
0c 00 01 00 03 01 08 00 00 00 00 00 00 00 00 00 ................

2022-11-18 04:07:09

by Sungwoo Kim

Subject: [BUG 2 / 6] L2cap: Spec violations

2. BT_CONNECT2 -> BT_CONNECTED by L2CAP_CONF_RSP

btmon log:

Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 23.498353
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 23.498635
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 23.498635
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
= bluetoothd: Failed to obtain handles for "Service Changed" char.. 23.555719
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 23.527295
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 90 00 07 00 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 1547 #34 [hci0] 23.538671
invalid packet size (14 != 1547)
0a 00 01 00 05 01 06 00 40 00 00 00 00 00 ........@.....

2022-11-18 04:07:38

by Sungwoo Kim

Subject: [BUG 3 / 6] L2cap: Spec violations

3. BT_CONNECT2 -> BT_DISCONN by L2CAP_CONF_RSP

btmon log:

Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.266186
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 14.282303
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 14.282303
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
= bluetoothd: Failed to obtain handles for "Service Changed" char.. 14.362392
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 14.283096
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 01 02 00 00 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.299480
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 02 00 ff ff ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.300143
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 01 00 00 01 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 1547 #36 [hci0] 14.300750
invalid packet size (14 != 1547)
0a 00 01 00 05 01 06 00 40 00 ff ff 01 00 ........@.....

2022-11-18 04:08:07

by Sungwoo Kim

Subject: [BUG 5 / 6] L2cap: Spec violations

5. BT_DISCONN -> BT_CONFIG by L2CAP_CONN_RSP

btmon log:

Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 11.525124
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 11.546310
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 11.546310
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 11.540575
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 07 02 00 00 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 11.543844
invalid packet size (16 != 2061)
0c 00 01 00 03 01 08 00 00 00 00 00 00 00 00 00 ................

2022-11-18 04:08:16

by Sungwoo Kim

Subject: [BUG 4 / 6] L2cap: Spec violations

4. BT_CONNECTED -> BT_CONFIG by L2CAP_CONN_RSP

btmon log:

Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 12.003575
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 12.024700
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 12.024700
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
= bluetoothd: Failed to obtain handles for "Service Changed" char.. 12.049885
> ACL Data RX: Handle 200 flags 0x00 dlen 1804 #33 [hci0] 12.003613
invalid packet size (15 != 1804)
0b 00 01 00 04 01 07 00 40 00 00 00 05 01 00 ........@......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 12.004416
invalid packet size (16 != 2061)
0c 00 01 00 05 01 08 00 40 00 00 00 01 00 ff 80 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 12.004968
invalid packet size (16 != 2061)
0c 00 01 00 03 01 08 00 00 00 00 00 00 00 00 00 ................

2022-11-18 04:09:21

by Sungwoo Kim

Subject: [BUG 6 / 6] L2cap: Spec violations

6. BT_DISCONN -> BT_CONNECTED by L2CAP_CONN_RSP

btmon log:

Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 12.777814
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 12.797646
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 12.797646
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 12.778616
invalid packet size (16 != 2061)
0c 00 01 00 03 01 08 00 00 00 00 00 00 00 00 00 ................
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 12.778858
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 07 00 00 01 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 12.778882
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 07 02 00 00 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 1547 #36 [hci0] 12.778905
invalid packet size (14 != 1547)
0a 00 01 00 05 01 06 00 40 00 00 00 00 00 ........@.....