Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-4917-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: bugzilla-daemon@kernel.org
To: linux-bluetooth@vger.kernel.org
Subject: [Bug 218880] New: HCI_EVT Packet 'Flush Occurred' Misalignment
Date: Fri, 24 May 2024 08:43:44 +0000
Message-ID: <bug-218880-62941@https.bugzilla.kernel.org/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Auto-Submitted: auto-generated
Precedence: bulk
MIME-Version: 1.0

https://bugzilla.kernel.org/show_bug.cgi?id=3D218880

            Bug ID: 218880
           Summary: HCI_EVT Packet 'Flush Occurred' Misalignment
           Product: Drivers
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: Bluetooth
          Assignee: linux-bluetooth@vger.kernel.org
          Reporter: yuxuanhu@buaa.edu.cn
        Regression: No

Hi All,

Our fuzzing tool found a possible bug when testing Bluetooth RFCOMM connect=
ion:

(1) A 'Flush Occurred' HCI_EVT packet with incorrect 'parameter_total_lengt=
h'
field and parameters was maliciously sent to the host (hexadecimal content:=
 '11
3D C4 02 62 D1').

(2) Because 'hci_ev_table'(/net/bluetooth/hci_event.c: 7514) does not inclu=
de
'Flush Occurred' event, the function hci_event_func(/net/bluetooth/hci_even=
t.c:
7644) doesn't check the 'parameter_total_length' field of this packet.

(3) When the controller transmits additional HCI packets to the host, these
packets are concatenated to the previously mentioned Flush Occurred packet.
This results in the packets being disregarded by the host.

Attachment 1 is Kernel Log, which includes the printed HCI packet interacti=
ons
between the host and controller. All HCI packets following the line mention=
ed
below are ignored by the host:

'''
[ 1555.520646] <- [EVT] 11 3D C4 02 62 D1
'''

Attachment 2 contains packet captures from tshark.

It remains unclear whether this behavior constitutes a bug or a feature. We
apologize if this inquiry causes any offense.
Thank you very much for taking the time to read.

Best Regard,
Yuxuan Hu.

--=20
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.=