2024-03-07 14:58:40

by Frédéric Danis

[permalink] [raw]
Subject: [PATCH] Bluetooth: Fix eir name length

According to Section 1.2 of Core Specification Supplement Part A the
complete or short name strings are defined as utf8s, which should not
include the trailing NULL for variable length array as defined in Core
Specification Vol1 Part E Section 2.9.3.

The trailing NULL was introduce by commit f61851f64b17
("Bluetooth: Fix append max 11 bytes of name to scan rsp data")

Removing the trailing NULL allows PTS to retrieve the random address based
on device name, e.g. for SM/PER/KDU/BV-02-C, SM/PER/KDU/BV-08-C or
GAP/BROB/BCST/BV-03-C.

Signed-off-by: Frédéric Danis <[email protected]>
---
net/bluetooth/eir.c | 29 +++++++----------------------
net/bluetooth/mgmt.c | 2 +-
2 files changed, 8 insertions(+), 23 deletions(-)

diff --git a/net/bluetooth/eir.c b/net/bluetooth/eir.c
index 9214189279e8..1bc51e2b05a3 100644
--- a/net/bluetooth/eir.c
+++ b/net/bluetooth/eir.c
@@ -13,48 +13,33 @@

#define PNP_INFO_SVCLASS_ID 0x1200

-static u8 eir_append_name(u8 *eir, u16 eir_len, u8 type, u8 *data, u8 data_len)
-{
- u8 name[HCI_MAX_SHORT_NAME_LENGTH + 1];
-
- /* If data is already NULL terminated just pass it directly */
- if (data[data_len - 1] == '\0')
- return eir_append_data(eir, eir_len, type, data, data_len);
-
- memcpy(name, data, HCI_MAX_SHORT_NAME_LENGTH);
- name[HCI_MAX_SHORT_NAME_LENGTH] = '\0';
-
- return eir_append_data(eir, eir_len, type, name, sizeof(name));
-}
-
u8 eir_append_local_name(struct hci_dev *hdev, u8 *ptr, u8 ad_len)
{
size_t short_len;
size_t complete_len;

- /* no space left for name (+ NULL + type + len) */
- if ((max_adv_len(hdev) - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 3)
+ /* no space left for name (+ type + len) */
+ if ((max_adv_len(hdev) - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 2)
return ad_len;

/* use complete name if present and fits */
complete_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
if (complete_len && complete_len <= HCI_MAX_SHORT_NAME_LENGTH)
- return eir_append_name(ptr, ad_len, EIR_NAME_COMPLETE,
- hdev->dev_name, complete_len + 1);
+ return eir_append_data(ptr, ad_len, EIR_NAME_COMPLETE,
+ hdev->dev_name, complete_len);

/* use short name if present */
short_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
if (short_len)
- return eir_append_name(ptr, ad_len, EIR_NAME_SHORT,
+ return eir_append_data(ptr, ad_len, EIR_NAME_SHORT,
hdev->short_name,
- short_len == HCI_MAX_SHORT_NAME_LENGTH ?
- short_len : short_len + 1);
+ short_len);

/* use shortened full name if present, we already know that name
* is longer then HCI_MAX_SHORT_NAME_LENGTH
*/
if (complete_len)
- return eir_append_name(ptr, ad_len, EIR_NAME_SHORT,
+ return eir_append_data(ptr, ad_len, EIR_NAME_SHORT,
hdev->dev_name,
HCI_MAX_SHORT_NAME_LENGTH);

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 9613cc8a60f8..32ed6e9245a3 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -8408,7 +8408,7 @@ static int read_adv_features(struct sock *sk, struct hci_dev *hdev,

static u8 calculate_name_len(struct hci_dev *hdev)
{
- u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
+ u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */

return eir_append_local_name(hdev, buf, 0);
}
--
2.34.1



2024-03-07 15:33:33

by bluez.test.bot

[permalink] [raw]
Subject: RE: Bluetooth: Fix eir name length

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=833441

---Test result---

Test Summary:
CheckPatch PASS 1.49 seconds
GitLint PASS 0.58 seconds
SubjectPrefix PASS 0.20 seconds
BuildKernel PASS 27.83 seconds
CheckAllWarning PASS 30.87 seconds
CheckSparse PASS 36.08 seconds
CheckSmatch PASS 99.59 seconds
BuildKernel32 PASS 27.28 seconds
TestRunnerSetup PASS 513.19 seconds
TestRunner_l2cap-tester PASS 20.14 seconds
TestRunner_iso-tester FAIL 32.72 seconds
TestRunner_bnep-tester PASS 4.75 seconds
TestRunner_mgmt-tester FAIL 112.10 seconds
TestRunner_rfcomm-tester PASS 7.33 seconds
TestRunner_sco-tester PASS 14.92 seconds
TestRunner_ioctl-tester PASS 7.80 seconds
TestRunner_mesh-tester PASS 6.68 seconds
TestRunner_smp-tester PASS 6.86 seconds
TestRunner_userchan-tester PASS 4.94 seconds
IncrementalBuild PASS 26.47 seconds

Details
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
Total: 117, Passed: 116 (99.1%), Failed: 1, Not Run: 0

Failed Test Cases
ISO Connect2 Suspend - Success Failed 6.233 seconds
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 492, Passed: 478 (97.2%), Failed: 12, Not Run: 2

Failed Test Cases
Set Advertising on - Local name 1 Failed 0.103 seconds
Set Advertising on - Name + Appear 1 Failed 2.149 seconds
Add Advertising - Success (Complete name) Failed 0.105 seconds
Add Advertising - Success (Shortened name) Failed 0.101 seconds
Add Advertising - Success (Short name) Failed 0.100 seconds
Add Advertising - Success (Name + data) Failed 0.105 seconds
Add Advertising - Success (Name+data+appear) Failed 0.109 seconds
Add Ext Advertising - Success (Complete name) Failed 0.108 seconds
Add Ext Advertising - Success (Shortened name) Failed 0.108 seconds
Add Ext Advertising - Success (Short name) Failed 0.102 seconds
Add Ext Advertising - Success (Name + data) Failed 0.105 seconds
Add Ext Advertising - Success (Name+data+appear) Failed 0.113 seconds


---
Regards,
Linux Bluetooth