From: Luiz Augusto von Dentz <[email protected]>
This removes the bogus check for max > hcon->le_conn_max_interval since
the later is just the initial maximum conn interval not the maximum the
stack could support which is really 3200=4000ms.
In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values
of the following fields in IXIT that would cause hci_check_conn_params
to fail:
TSPX_conn_update_int_min
TSPX_conn_update_int_max
TSPX_conn_update_peripheral_latency
TSPX_conn_update_supervision_timeout
Link: https://github.com/bluez/bluez/issues/847
Fixes: e4b019515f95 ("Bluetooth: Enforce validation on max value of connection interval")
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
---
include/net/bluetooth/hci_core.h | 36 ++++++++++++++++++++++++++++----
net/bluetooth/l2cap_core.c | 8 +------
2 files changed, 33 insertions(+), 11 deletions(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9231396fe96f..c43716edf205 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2113,18 +2113,46 @@ static inline int hci_check_conn_params(u16 min, u16 max, u16 latency,
{
u16 max_latency;
- if (min > max || min < 6 || max > 3200)
+ if (min > max) {
+ BT_WARN("min %d > max %d", min, max);
return -EINVAL;
+ }
- if (to_multiplier < 10 || to_multiplier > 3200)
+ if (min < 6) {
+ BT_WARN("min %d < 6", min);
return -EINVAL;
+ }
- if (max >= to_multiplier * 8)
+ if (max > 3200) {
+ BT_WARN("max %d > 3200", max);
return -EINVAL;
+ }
+
+ if (to_multiplier < 10) {
+ BT_WARN("to_multiplier %d < 10", to_multiplier);
+ return -EINVAL;
+ }
+
+ if (to_multiplier > 3200) {
+ BT_WARN("to_multiplier %d > 3200", to_multiplier);
+ return -EINVAL;
+ }
+
+ if (max >= to_multiplier * 8) {
+ BT_WARN("max %d >= to_multiplier %d * 8", max, to_multiplier);
+ return -EINVAL;
+ }
max_latency = (to_multiplier * 4 / max) - 1;
- if (latency > 499 || latency > max_latency)
+ if (latency > 499) {
+ BT_WARN("latency %d > 499", latency);
return -EINVAL;
+ }
+
+ if (latency > max_latency) {
+ BT_WARN("latency %d > max_latency %d", latency, max_latency);
+ return -EINVAL;
+ }
return 0;
}
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 5b509b767557..c49e0d4b3c0d 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4647,13 +4647,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
memset(&rsp, 0, sizeof(rsp));
- if (max > hcon->le_conn_max_interval) {
- BT_DBG("requested connection interval exceeds current bounds.");
- err = -EINVAL;
- } else {
- err = hci_check_conn_params(min, max, latency, to_multiplier);
- }
-
+ err = hci_check_conn_params(min, max, latency, to_multiplier);
if (err)
rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
else
--
2.45.1
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=854750
---Test result---
Test Summary:
CheckPatch PASS 0.70 seconds
GitLint PASS 0.22 seconds
SubjectPrefix PASS 0.07 seconds
BuildKernel PASS 29.69 seconds
CheckAllWarning PASS 32.80 seconds
CheckSparse PASS 37.95 seconds
CheckSmatch FAIL 36.20 seconds
BuildKernel32 PASS 28.97 seconds
TestRunnerSetup PASS 522.85 seconds
TestRunner_l2cap-tester PASS 18.20 seconds
TestRunner_iso-tester PASS 32.42 seconds
TestRunner_bnep-tester PASS 4.81 seconds
TestRunner_mgmt-tester PASS 109.52 seconds
TestRunner_rfcomm-tester PASS 7.41 seconds
TestRunner_sco-tester PASS 16.32 seconds
TestRunner_ioctl-tester PASS 7.81 seconds
TestRunner_mesh-tester PASS 5.88 seconds
TestRunner_smp-tester PASS 6.84 seconds
TestRunner_userchan-tester PASS 4.98 seconds
IncrementalBuild PASS 27.71 seconds
Details
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bpa10x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bpa10x.o'
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
---
Regards,
Linux Bluetooth
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:
On Tue, 21 May 2024 10:35:21 -0400 you wrote:
> From: Luiz Augusto von Dentz <[email protected]>
>
> This removes the bogus check for max > hcon->le_conn_max_interval since
> the later is just the initial maximum conn interval not the maximum the
> stack could support which is really 3200=4000ms.
>
> In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values
> of the following fields in IXIT that would cause hci_check_conn_params
> to fail:
>
> [...]
Here is the summary with links:
- [v3] Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
https://git.kernel.org/bluetooth/bluetooth-next/c/a3975db95fcd
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
I tested it using the bluetooth-next, with HEAD at
a3975db95fcd8e304f1ee4b0be1895038942a8ef. It rejects the connection
parameter update request at least for the case where the min > max,
which is one of the failed conditions for the hci_check_conn_params()
Note that TSPX_iut_invalid_connection_interval_{min, max} in the IXIT
can be used to create faulty connection parameters.
The specific test steps are:
1. Set TSPX_iut_invalid_connection_interval_min to a value larger
than TSPX_iut_invalid_connection_interval_max, e.g. 0xAB and 0xAA
respectively.
2. Start the GAP/CONN/CPUP/BV-05-C case on PTS.
3. Enter bluetoothctl. Use "scan on" to find the address of PTS dongle.
4. Meanwhile, PTS will ask for connect request. Connect to it by
running "connect $PTS_ADDR" in bluetoothctl.
5. At this point the PTS would send the parameter update request with
faulty parameters set in the IXIT. Kernel will reject this request.
6. PST will then ask to send a disconnect request. Run "disconnect"
in bluetoothctl. The test case should pass after disconnection.
Tested-by: Yo-Jung (Leo) Lin <[email protected]>