Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <259e755c.4eaad.188f817a0f3.Coremail.lxybhu@buaa.edu.cn>
In-Reply-To: <259e755c.4eaad.188f817a0f3.Coremail.lxybhu@buaa.edu.cn>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Mon, 26 Jun 2023 12:25:12 -0700
Message-ID: <CABBYNZJtGo2SSRREH9jpAKM8UoEUNgK9uzyPuzqDdks_KBoDdw@mail.gmail.com>
Subject: Re: [BUG]Bluetooth: HCI_Command_Status: possible semantic bug when
 Num_HCI_Command_Packets set to zero
To:     =?UTF-8?B?5YiY5paw5a6H?= <lxybhu@buaa.edu.cn>
Cc:     marcel@holtmann.org, johan.hedberg@gmail.com, davem@davemloft.net,
        edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
        baijiaju1990@gmail.com, sy2239101@buaa.edu.cn,
        linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi,

On Mon, Jun 26, 2023 at 7:25=E2=80=AFAM =E5=88=98=E6=96=B0=E5=AE=87 <lxybhu=
@buaa.edu.cn> wrote:
>
> Hello,
>
> Our fuzzing tool finds a possible semantic bug in the Bluetooth system in=
 Linux 5.18:
>
> During the connection process, the host server needs to receive the HCI_C=
ommand_Status packet from the hardware controller. In normal cases, the Num=
_HCI_Command_Packets field of this packet is not zero, and the host server =
can normally handle this packet. However, in our testing, when the Num_HCI_=
Command_Packets field is set to zero, the Bluetooth functionality is totall=
y stopped until it is manually reopened.
>
> In the Bluetooth Core Specification 5.4, the section 7.7.15 "Command Stat=
us event" says that:
>
> "The Num_HCI_Command_Packets event parameter allows the Controller to ind=
icate the number of HCI command packets the Host can send to the Controller=
. If the Controller requires the Host to stop sending commands, the Num_HCI=
_Command_Packets event parameter will be set to zero."
>
> This section does not mean that the Bluetooth functionality needs to be t=
otally stopped when Num_HCI_Command_Packets is zero. Maybe in this case, th=
e Bluetooth functionality could be still available, but the host server cou=
ld reject any packet until Num_HCI_Command_Packets is not zero.

Well it says, If the Controller requires the Host to stop sending
commands, so if your tool is sending 0 then it is requesting he host
to stop sending more commands, if you want it to continue just send
another Num_HCI_Command_Packets, or are you saying some other
functionality that doesn't require sending commands shall still work?

> We are not sure whether this is a semantic bug or implementation feature =
in the Linux kernel. Any feedback would be appreciated, thanks!
>
>
> Best wishes,
> Xin-Yu Liu


--=20
Luiz Augusto von Dentz