2014-05-29 16:36:53

by Johan Hedberg

[permalink] [raw]
Subject: [PATCH] Bluetooth: Fix properly ignoring LTKs of unknown types

From: Johan Hedberg <[email protected]>

In case there are new LTK types in the future we shouldn't just blindly
assume that != MGMT_LTK_UNAUTHENTICATED means that the key is
authenticated. This patch adds explicit checks for each allowed key type
in the form of a switch statement and skips any key which has an unknown
value.

Signed-off-by: Johan Hedberg <[email protected]>
---
net/bluetooth/mgmt.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 5e9c21a5525f..0fce54412ffd 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -4546,10 +4546,16 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
else
type = HCI_SMP_LTK_SLAVE;

- if (key->type == MGMT_LTK_UNAUTHENTICATED)
+ switch (key->type) {
+ case MGMT_LTK_UNAUTHENTICATED:
authenticated = 0x00;
- else
+ break;
+ case MGMT_LTK_AUTHENTICATED:
authenticated = 0x01;
+ break;
+ default:
+ continue;
+ }

hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
authenticated, key->val, key->enc_size, key->ediv,
--
1.9.3



2014-05-31 04:26:01

by Marcel Holtmann

[permalink] [raw]
Subject: Re: [PATCH] Bluetooth: Fix properly ignoring LTKs of unknown types

Hi Johan,

> In case there are new LTK types in the future we shouldn't just blindly
> assume that != MGMT_LTK_UNAUTHENTICATED means that the key is
> authenticated. This patch adds explicit checks for each allowed key type
> in the form of a switch statement and skips any key which has an unknown
> value.
>
> Signed-off-by: Johan Hedberg <[email protected]>
> ---
> net/bluetooth/mgmt.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel


2014-06-14 09:20:58

by Marcel Holtmann

[permalink] [raw]
Subject: Re: [PATCH] Bluetooth: Fix properly ignoring LTKs of unknown types

Hi Scott,

> That's a good observation (though to be fair it was Marcel and not me
> adding the Cc tags ;)
>
> Anyway, the primary target of these fixes was 3.16 and 3.15 where I
> believe the dependency is already covered. For earlier stable trees we
> can fix this up by doing a manual patch submission to stable@vger.

exactly, the primary goal is to get 3.16-rcX fixed and all stable tags have the intention to fix 3.15.x. Once that is done, we have to figure out 3.14.x and maybe 3.13.x where we most likely have to manually submit some depending patches.

If I made a mistake with a stable tag for 3.15.x, then please point me to the one where I screwed up. There is a chance that I overlooked something since I was drowning in way to many trees and way too many patches.

Please also keep in mind that only patches that have a commit hash in Linus' tree are suppose to be pushed to the other stable queues. So right now we have to wait for the bluetooth.git pull request to actually make it into Linus' tree first.

Regards

Marcel


2014-06-14 08:27:54

by Johan Hedberg

[permalink] [raw]
Subject: Re: [PATCH] Bluetooth: Fix properly ignoring LTKs of unknown types

Hi Scott,

That's a good observation (though to be fair it was Marcel and not me
adding the Cc tags ;)

Anyway, the primary target of these fixes was 3.16 and 3.15 where I
believe the dependency is already covered. For earlier stable trees we
can fix this up by doing a manual patch submission to stable@vger.

Johan

On Fri, Jun 13, 2014, Scott James Remnant wrote:
> You cc'd this to stable, but didn't Cc the patch that it modifies.
>
> Just sayin' ;-)
>
> On Thu, May 29, 2014 at 9:36 AM, <[email protected]> wrote:
> > From: Johan Hedberg <[email protected]>
> >
> > In case there are new LTK types in the future we shouldn't just blindly
> > assume that != MGMT_LTK_UNAUTHENTICATED means that the key is
> > authenticated. This patch adds explicit checks for each allowed key type
> > in the form of a switch statement and skips any key which has an unknown
> > value.
> >
> > Signed-off-by: Johan Hedberg <[email protected]>
> > ---
> > net/bluetooth/mgmt.c | 10 ++++++++--
> > 1 file changed, 8 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> > index 5e9c21a5525f..0fce54412ffd 100644
> > --- a/net/bluetooth/mgmt.c
> > +++ b/net/bluetooth/mgmt.c
> > @@ -4546,10 +4546,16 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
> > else
> > type = HCI_SMP_LTK_SLAVE;
> >
> > - if (key->type == MGMT_LTK_UNAUTHENTICATED)
> > + switch (key->type) {
> > + case MGMT_LTK_UNAUTHENTICATED:
> > authenticated = 0x00;
> > - else
> > + break;
> > + case MGMT_LTK_AUTHENTICATED:
> > authenticated = 0x01;
> > + break;
> > + default:
> > + continue;
> > + }
> >
> > hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
> > authenticated, key->val, key->enc_size, key->ediv,
> > --
> > 1.9.3
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
> > the body of a message to [email protected]
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>
>
> --
> Scott James Remnant | Chrome OS Systems | [email protected] | Google

2014-06-13 19:25:37

by Scott James Remnant

[permalink] [raw]
Subject: Re: [PATCH] Bluetooth: Fix properly ignoring LTKs of unknown types

You cc'd this to stable, but didn't Cc the patch that it modifies.

Just sayin' ;-)

On Thu, May 29, 2014 at 9:36 AM, <[email protected]> wrote:
> From: Johan Hedberg <[email protected]>
>
> In case there are new LTK types in the future we shouldn't just blindly
> assume that != MGMT_LTK_UNAUTHENTICATED means that the key is
> authenticated. This patch adds explicit checks for each allowed key type
> in the form of a switch statement and skips any key which has an unknown
> value.
>
> Signed-off-by: Johan Hedberg <[email protected]>
> ---
> net/bluetooth/mgmt.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> index 5e9c21a5525f..0fce54412ffd 100644
> --- a/net/bluetooth/mgmt.c
> +++ b/net/bluetooth/mgmt.c
> @@ -4546,10 +4546,16 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
> else
> type = HCI_SMP_LTK_SLAVE;
>
> - if (key->type == MGMT_LTK_UNAUTHENTICATED)
> + switch (key->type) {
> + case MGMT_LTK_UNAUTHENTICATED:
> authenticated = 0x00;
> - else
> + break;
> + case MGMT_LTK_AUTHENTICATED:
> authenticated = 0x01;
> + break;
> + default:
> + continue;
> + }
>
> hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
> authenticated, key->val, key->enc_size, key->ediv,
> --
> 1.9.3
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html



--
Scott James Remnant | Chrome OS Systems | [email protected] | Google