Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Isak Westin <isak.westin@loytec.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     Isak Westin <isak.westin@loytec.com>
Subject: [PATCH BlueZ 2/4] mesh: Ignore SNB with invalid IV Index values
Date:   Thu, 29 Sep 2022 13:03:42 +0200
Message-Id: <20220929110344.26130-3-isak.westin@loytec.com>
In-Reply-To: <20220929110344.26130-1-isak.westin@loytec.com>
References: <20220929110344.26130-1-isak.westin@loytec.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

If we are in IV update in progress state, and receive a Secure Network
beacon with an IV index equal to last known IV index + 1, and IV update
flag set to 1, it should be ignored. See MshPRFv1.0.1 section 3.10.5.
---
 mesh/net.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mesh/net.c b/mesh/net.c
index dc3d1fd80..c225fdb9a 100644
--- a/mesh/net.c
+++ b/mesh/net.c
@@ -2671,6 +2671,10 @@ static bool update_iv_ivu_state(struct mesh_net *net, uint32_t iv_index,
 		if (iv_index == net->iv_index)
 			return false;
 
+		/* Ignore beacon with invalid IV index value */
+		if (net->iv_update && iv_index == net->iv_index + 1)
+			return false;
+
 		if (!net->iv_update) {
 			l_debug("iv_upd_state = IV_UPD_UPDATING");
 			net->iv_upd_state = IV_UPD_UPDATING;
-- 
2.20.1