Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
From:   Kai Krakow <kai@kaishome.de>
Date:   Sun, 30 Jan 2022 16:02:43 +0100
Message-ID: <CAC2ZOYu4zy0CPTW40qy3vJJDFuWEUvqqPJdMgtKL9=7Xh-YVEA@mail.gmail.com>
Subject: kernel 5.15.17: Spamming dmesg with "Malicious advertising data"
To:     linux-bluetooth@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hello!

Since kernel 5.15.17, dmesg is spammed with the following log,
sometimes multiple times per second:

> Bluetooth: hci0: Malicious advertising data. Stopping processing

This was probably introduced by commit 2de0e6a71ceb056e17e4684dce8b7640367996f9.

I'm not sure which device causes it, and it seems quite useless to
repeat this message without any rate limiting, especially when no
source of the incident is indicated.

I'm suspecting that something is messed up here, and there's not
really any malicious advertising going on. At least, there's a lot of
LE advertising going on but that looks sane:

```
> HCI Event: LE Meta Event (0x3e) plen 40                                                                                                                                                                                                  #63 [hci0] 3.466120
     LE Advertising Report (0x02)
       Num reports: 1
       Event type: Non connectable undirected - ADV_NONCONN_IND (0x03)
       Address type: Public (0x00)
       Address: F8:04:2E:8A:20:C1 (SAMSUNG ELECTRO-MECHANICS(THAILAND))
       Data length: 28
       Company: Samsung Electronics Co. Ltd. (117)
         Data: 42040180aef8042e8a20c1fa042e8a20c001000000000000
       RSSI: -68 dBm (0xbc)
> HCI Event: LE Meta Event (0x3e) plen 40                                                                                                                                                                                                  #64 [hci0] 3.469127
     LE Advertising Report (0x02)
       Num reports: 1
       Event type: Connectable undirected - ADV_IND (0x00)
       Address type: Public (0x00)
       Address: 74:AC:B9:41:D2:23 (Ubiquiti Networks Inc.)
       Data length: 28
       128-bit Service UUIDs (partial): 1 entry
         Vendor specific
       Service Data (UUID 0x252a): 74acb941d21c
       RSSI: -37 dBm (0xdb)
> HCI Event: LE Meta Event (0x3e) plen 40                                                                                                                                                                                                  #65 [hci0] 3.540118
     LE Advertising Report (0x02)
       Num reports: 1
       Event type: Scannable undirected - ADV_SCAN_IND (0x02)
       Address type: Random (0x01)
       Address: 53:F3:43:9B:9D:13 (Resolvable)
       Data length: 28
       16-bit Service UUIDs (complete): 1 entry
         Google (0xfe9f)
       Service Data (UUID 0xfe9f): 0000000000000000000000000000000000000000
       RSSI: -70 dBm (0xba)
> HCI Event: LE Meta Event (0x3e) plen 40                                                                                                                                                                                                  #66 [hci0] 3.596124
     LE Advertising Report (0x02)
       Num reports: 1
       Event type: Non connectable undirected - ADV_NONCONN_IND (0x03)
       Address type: Public (0x00)
       Address: 68:72:C3:A0:AA:75 (Samsung Electronics Co.,Ltd)
       Data length: 28
       Company: Samsung Electronics Co. Ltd. (117)
         Data: 420401806e6872c3a0aa756a72c3a0aa7401000000000000
       RSSI: -55 dBm (0xc9)
```

System info:

> Linux jupiter 5.15.17-gentoo #1 SMP PREEMPT Sat Jan 29 07:32:24 CET 2022 x86_64 12th Gen Intel(R) Core(TM) i7-12700K GenuineIntel GNU/Linux
> Bluetooth monitor ver 5.63
> = Note: Linux version 5.15.17-gentoo (x86_64)                          0.256208
> = Note: Bluetooth subsystem version 2.22                               0.256210
> = New Index: 00:1A:7D:DA:71:15 (Primary,USB,hci0)               [hci0] 0.256211
> = Open Index: 00:1A:7D:DA:71:15                                 [hci0] 0.256212
> = Index Info: 00:1A:7D:DA:71:15 (Cambridge Silicon Radio)       [hci0] 0.256212
> @ MGMT Open: bluetoothd (privileged) version 1.21             {0x0001} 0.256213


Regards,
Kai