2024-05-20 20:10:35

by Luiz Augusto von Dentz

[permalink] [raw]
Subject: [PATCH v1] Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ

From: Luiz Augusto von Dentz <[email protected]>

This removes the bogus check for max > hcon->le_conn_max_interval since
the later is just the initial maximum conn interval not the maximum the
stack could support which is really 3200=4000ms.

In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values
of the following fields in IXIT that would cause hci_check_conn_params
to fail:

TSPX_conn_update_int_min
TSPX_conn_update_int_max
TSPX_conn_update_peripheral_latency
TSPX_conn_update_supervision_timeout

Link: https://github.com/bluez/bluez/issues/847
Fixes: e4b019515f95 ("Bluetooth: Enforce validation on max value of connection interval")
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
---
net/bluetooth/l2cap_core.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 5b509b767557..c49e0d4b3c0d 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4647,13 +4647,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,

memset(&rsp, 0, sizeof(rsp));

- if (max > hcon->le_conn_max_interval) {
- BT_DBG("requested connection interval exceeds current bounds.");
- err = -EINVAL;
- } else {
- err = hci_check_conn_params(min, max, latency, to_multiplier);
- }
-
+ err = hci_check_conn_params(min, max, latency, to_multiplier);
if (err)
rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
else
--
2.45.1



2024-05-20 20:43:30

by bluez.test.bot

[permalink] [raw]
Subject: RE: [v1] Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=854501

---Test result---

Test Summary:
CheckPatch PASS 0.68 seconds
GitLint PASS 0.33 seconds
SubjectPrefix PASS 0.13 seconds
BuildKernel PASS 29.82 seconds
CheckAllWarning PASS 32.69 seconds
CheckSparse PASS 38.48 seconds
CheckSmatch FAIL 35.08 seconds
BuildKernel32 PASS 28.84 seconds
TestRunnerSetup PASS 527.11 seconds
TestRunner_l2cap-tester PASS 24.49 seconds
TestRunner_iso-tester FAIL 32.53 seconds
TestRunner_bnep-tester PASS 4.68 seconds
TestRunner_mgmt-tester PASS 110.10 seconds
TestRunner_rfcomm-tester PASS 7.30 seconds
TestRunner_sco-tester PASS 14.93 seconds
TestRunner_ioctl-tester PASS 7.78 seconds
TestRunner_mesh-tester PASS 6.02 seconds
TestRunner_smp-tester PASS 6.81 seconds
TestRunner_userchan-tester PASS 4.95 seconds
IncrementalBuild PASS 27.92 seconds

Details
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:

Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
Total: 122, Passed: 117 (95.9%), Failed: 1, Not Run: 4

Failed Test Cases
ISO Connect Suspend - Success Failed 4.176 seconds


---
Regards,
Linux Bluetooth

2024-05-20 20:48:48

by Luiz Augusto von Dentz

[permalink] [raw]
Subject: Re: [PATCH v1] Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ

Hi Kai,

On Mon, May 20, 2024 at 4:10 PM Luiz Augusto von Dentz
<[email protected]> wrote:
>
> From: Luiz Augusto von Dentz <[email protected]>
>
> This removes the bogus check for max > hcon->le_conn_max_interval since
> the later is just the initial maximum conn interval not the maximum the
> stack could support which is really 3200=4000ms.
>
> In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values
> of the following fields in IXIT that would cause hci_check_conn_params
> to fail:
>
> TSPX_conn_update_int_min
> TSPX_conn_update_int_max
> TSPX_conn_update_peripheral_latency
> TSPX_conn_update_supervision_timeout
>
> Link: https://github.com/bluez/bluez/issues/847
> Fixes: e4b019515f95 ("Bluetooth: Enforce validation on max value of connection interval")
> Signed-off-by: Luiz Augusto von Dentz <[email protected]>
> ---
> net/bluetooth/l2cap_core.c | 8 +-------
> 1 file changed, 1 insertion(+), 7 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 5b509b767557..c49e0d4b3c0d 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4647,13 +4647,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
>
> memset(&rsp, 0, sizeof(rsp));
>
> - if (max > hcon->le_conn_max_interval) {
> - BT_DBG("requested connection interval exceeds current bounds.");
> - err = -EINVAL;
> - } else {
> - err = hci_check_conn_params(min, max, latency, to_multiplier);
> - }
> -
> + err = hci_check_conn_params(min, max, latency, to_multiplier);
> if (err)
> rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
> else
> --
> 2.45.1

I hope that doesn't break the testing you have done, you should really
be setting the invalid values with use of the fields about and not use
hcon->le_conn_max_interval as upper limit of the stack, for more
details check the discussion at
https://github.com/bluez/bluez/issues/847.

--
Luiz Augusto von Dentz