Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-4922-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Content-Type: multipart/mixed; boundary="------------RPiOa1eO3rfjjsP3iJaQbfKy"
Message-ID: <fefc349d-9dc1-462a-be2f-29d82dc30157@buaa.edu.cn>
Date: Fri, 24 May 2024 16:55:45 +0800
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: johan.hedberg@gmail.com, Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
 marcel@holtmann.org
From: Yuxuan-Hu <yuxuanhu@buaa.edu.cn>
Subject: HCI_EVT Packet 'Flush Occurred' Misalignment
Cc: linux-bluetooth@vger.kernel.org, baijiaju1990 <baijiaju1990@gmail.com>

This is a multi-part message in MIME format.
--------------RPiOa1eO3rfjjsP3iJaQbfKy
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi All,

Our fuzzing tool found a possible bug when testing Bluetooth RFCOMM connection:

(1) A'Flush Occurred'  HCI_EVT packet with incorrect'parameter_total_length' field and parameters was maliciously sent to the host (hexadecimal content:'11 3D C4 02 62 D1').

(2) Because'hci_ev_table'(/net/bluetooth/hci_event.c: 7514) does not include'Flush Occurred'  event, the function'hci_event_func'(/net/bluetooth/hci_event.c: 7644) doesn't check the'parameter_total_length'  field of this packet.

(3) When the controller transmits additional HCI packets to the host, these packets are concatenated to the previously mentioned Flush Occurred packet. This results in the packets being disregarded by the host.

Attachment 1 is Kernel Log, which includes the printed HCI packet interactions between the host and controller. All HCI packets following the line mentioned below are ignored by the host:

'''
[ 1555.520646] <- [EVT] 11 3D C4 02 62 D1
'''
Attachment 2 contains packet captures from tshark.

It remains unclear whether this behavior constitutes a bug or a feature. We apologize if this inquiry causes any offense.
Thank you very much for taking the time to read.

Best Regard,
Yuxuan Hu.

--------------RPiOa1eO3rfjjsP3iJaQbfKy
Content-Type: text/plain; charset=UTF-8; name="kernel_log.txt"
Content-Disposition: attachment; filename="kernel_log.txt"
Content-Transfer-Encoding: base64

W1FTZXJ2ZXJdIGJlZ2luIGNvbm5lY3RfYnQoKQpbIDE1NTUuMzM5NjIyXSAtPiBbQ01EXSAw
NSAwNCAwRCBBOCAyNSBEMSBFQiAyNyBCOCAxOCBDQyAwMiAwMCAwMCAwMCAwMSAKWyAxNTU1
LjM0MDE3NF0gPC0gW0VWVF0gMEYgMDQgMDAgMDEgMDUgMDQgClsgMTU1NS4zNDI5NzBdIDwt
IFtFVlRdIDEyIDA4IDAwIEE4IDI1IEQxIEVCIDI3IEI4IDAxIApbIDE1NTUuMzQ2NDU1XSA8
LSBbRVZUXSAwMyAwQiAwMCAwQiAwMCBBOCAyNSBEMSBFQiAyNyBCOCAwMSAwMCAKWyAxNTU1
LjM0NzAwNl0gLT4gW0NNRF0gMUIgMDQgMDIgMEIgMDAgClsgMTU1NS4zNDgyNDRdIDwtIFtF
VlRdIDFCIDAzIDBCIDAwIDA1IApbIDE1NTUuMzY2MDE4XSA8LSBbQUNMXSAwQiAyMCAwQSAw
MCAwNiAwMCAwMSAwMCAwQSAwMSAwMiAwMCAwMiAwMCAKWyAxNTU1LjM2NjczMl0gPC0gW0VW
VF0gMEYgMDQgMDAgMDEgMUIgMDQgClsgMTU1NS4zNjcyMTddIC0+IFtDTURdIDFBIDBDIDAx
IDAwIApbIDE1NTUuMzY4OTM2XSA8LSBbRVZUXSAwQiAwQiAwMCAwQiAwMCBCRiBGRSBDRiBG
RSBEQiBGRiA3QiA4NyAKWyAxNTU1LjM2OTc5N10gPC0gW0VWVF0gMEUgMDQgMDEgMUEgMEMg
MDAgClsgMTU1NS4zNzAxNjddIC0+IFtDTURdIDFDIDA0IDAzIDBCIDAwIDAxIApbIDE1NTUu
MzcwNjM2XSA8LSBbRVZUXSAwRSAwNCAwMSAxQSAwQyAwMCAKWyAxNTU1LjQyMDEwNl0gPC0g
W0VWVF0gMEYgMDQgMDAgMDEgMUMgMDQgClsgMTU1NS40MjIxMjBdIDwtIFtFVlRdIDIzIDBE
IDAwIDBCIDAwIDAxIDAyIDBCIDAwIDAwIDAwIDAwIDAwIDAwIDAwIApbIDE1NTUuNDIyNjIx
XSAtPiBbQ01EXSAxOSAwNCAwQSBBOCAyNSBEMSBFQiAyNyBCOCAwMiAwMCAwMCAwMCAKWyAx
NTU1LjQyMzM2NF0gPC0gW0VWVF0gMEYgMDQgMDAgMDEgMTkgMDQgClsgMTU1NS40NjE0MDVd
IDwtIFtFVlRdIDA3IEZGIDAwIEE4IDI1IEQxIEVCIDI3IEI4IDcyIDYxIDczIDcwIDYyIDY1
IDcyIDcyIDc5IDcwIDY5IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwCiAwMCAwMCAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwCjAgMDAgMDAgMDAgMDAg
MDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg
MDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgCjAwIDAwIDAwIDAwIDAw
IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAw
IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwCiAwMCAwMCAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwCjAgMDAgMDAgMDAgMDAg
MDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg
MDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgCjAwIDAwIDAwIDAwIDAw
IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAw
IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwCiAwMCAwMCAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAKWyAxNTU1LjQ2NzUxNF0gLT4gW0NN
RF0gMTEgMDQgMDIgMEIgMDAgClsgMTU1NS40NjgzMTVdIDwtIFtFVlRdIDBGIDA0IDAwIDAx
IDExIDA0IApbIDE1NTUuNDg1MTgyXSA8LSBbRVZUXSAxNyAwNiBBOCAyNSBEMSBFQiAyNyBC
OCAKWyAxNTU1LjQ4NTcwOV0gLT4gW0NNRF0gMEIgMDQgMTYgQTggMjUgRDEgRUIgMjcgQjgg
RTkgQjcgQTAgNTMgNDQgRkQgMEMgQjggOTcgOEMgQkQgQkEgMzIgOEYgODYgQjMgClsgMTU1
NS40ODY5NTddIDwtIFtFVlRdIDBFIDBBIDAxIDBCIDA0IDAwIEE4IDI1IEQxIEVCIDI3IEI4
IApbIDE1NTUuNTIwMTMzXSA8LSBbRVZUXSAwNiAwMyAwMCAwQiAwMCAKWyAxNTU1LjUyMDM4
MF0gLT4gW0NNRF0gMTMgMDQgMDMgMEIgMDAgMDEgClsgMTU1NS41MjA2NDZdIDwtIFtFVlRd
IDExIDNEIEM0IDAyIDYyIEQxIApbIDE1NTUuNTUxODk0XSA8LSBbRVZUXSAwOCAwNCAwMCAw
QiAwMCAwMiAKWyAxNTU1LjYwMDk0MV0gPC0gW0VWVF0gRUQgQkEgNDcgOTEgRDAgMjYgMEEg
OUYgQjcgClsgMTU1NS42MzE5MTZdIDwtIFtBQ0xdIDBCIDIwIDEwIDAwIDBDIDAwIDAxIDAw
IDBCIDAxIDA4IDAwIDAyIDAwIDAwIDAwIEI4IDAyIDAwIDAwIApbIDE1NTUuNjMzOTAxXSA8
LSBbRVZUXSAxMyAwNSAwMSAwQiAwMCAwMiAwMCAKWyAxNTU1LjY4MzAzN10gPC0gW0FDTF0g
MEIgMjAgMEEgMDAgMDYgMDAgMDEgMDAgMEEgMDIgMDIgMDAgMDMgMDAgClsgMTU1NS43MzE5
MTddIDwtIFtBQ0xdIEY0IDA3IDgyIEYxIDNBIDlGIDE0IDRCIDJDIDI2IDVDIDcyIEFFIEFD
IEFFIEYzIDVBIEU5IDgwIDM5IDEyIEQ0IDRDIDZBIApbIDE1NTUuNzMzODg0XSA8LSBbRVZU
XSAxMyAwNSAwMSAwQiAwMCAwMiAwMCAKWyAxNTU1Ljc4MjkzMl0gPC0gW0FDTF0gMEIgMjAg
MTAgMDAgMEMgMDAgMDEgMDAgMDMgMDMgMDggMDAgNDAgMDAgNDAgMDAgMDAgMDAgMDAgMDAg
ClsgMTU1NS44MzE5MDFdIDwtIFtBQ0xdIDBCIDIwIDFCIDAwIDE3IDAwIDAxIDAwIDA0IDAz
IDEzIDAwIDQwIDAwIDAwIDAwIDAxIDAyIEZEIDAzIDA0IDA5IDAwIDAwIDAwIDAwIDAwIDAw
CiAwMCAwMCAwMCAKWyAxNTU1Ljg2MzkxN10gPC0gW0VWVF0gMTMgMDUgMDEgMEIgMDAgMDIg
MDAgClsgMTU1NS45MTI5NTldIDwtIFtBQ0xdIDBCIDIwIDEyIDAwIDBFIDAwIDAxIDAwIDA1
IDA0IDBBIDAwIDQwIDAwIDAwIDAwIDAwIDAwIDAxIDAyIEZEIDAzIApbIDE1NTUuOTQ2ODk5
XSA8LSBbRVZUXSAxMyAwNSAwMSAwQiAwMCAwMiAwMCAKWyAxNTU1Ljk5NTkyM10gPC0gW0FD
TF0gMEIgMjAgMDggMDAgMDQgMDAgNDAgMDAgMDMgNzMgMDEgRDcgClsgMTU1Ni4wNDQ5MjZd
IDwtIFtBQ0xdIDBCIDIwIDEyIDAwIDBFIDAwIDQwIDAwIDAxIEVGIDE1IDgxIDExIDAyIEUw
IDA3IDAwIEY4IDAzIDAwIDA3IEFBIApbIDE1NTYuMDYxODk5XSA8LSBbRVZUXSAxMyAwNSAw
MSAwQiAwMCAwMiAwMCAKWyAxNTU2LjExMDkwN10gPC0gW0FDTF0gMEIgMjAgMDggMDAgMDQg
MDAgNDAgMDAgMEIgNzMgMDEgOTIgClsgMTU1Ni4xNTk5MDddIDwtIFtBQ0xdIDBCIDIwIDBD
IDAwIDA4IDAwIDQwIDAwIDAxIEVGIDA5IEUzIDA1IDBCIDhEIEFBIApbIDE1NTYuMjA4OTEy
XSA8LSBbQUNMXSAwQiAyMCAwQyAwMCAwOCAwMCA0MCAwMCAwMSBFRiAwOSBFMSAwNSAwQiA4
RCBBQSAKWyAxNTU2LjIxMDg4OF0gPC0gW0VWVF0gMTMgMDUgMDEgMEIgMDAgMDIgMDAgClsg
MTU1Ni4yMTI4OTJdIDwtIFtBQ0xdIDBCIDIwIDA5IDAwIDA1IDAwIDQwIDAwIDA5IEZGIDAx
IDIxIDVDIApbIDE1NTYuMjQ1OTAzXSA8LSBbQUNMXSAwQiAyMCAxQSAwMCAxNiAwMCA0MCAw
MCAwOSBFRiAyNSA0OCA2NSA2QyA2QyA2RiAyMCA2NiA3MiA2RiA2RCAyMCA1MSA1MyA2NSA3
MiA3NiA2NQogNzIgNDAgClsgMTU1Ni4yNDc4ODFdIDwtIFtFVlRdIDEzIDA1IDAxIDBCIDAw
IDAyIDAwIApbIDE1NTYuMjk2OTAxXSA8LSBbQUNMXSAwQiAyMCAwOCAwMCAwNCAwMCA0MCAw
MCAwOSA1MyAwMSBEOSAKWyAxNTU2LjMyNzg5N10gPC0gW0VWVF0gMTMgMDUgMDEgMEIgMDAg
MDIgMDAgClsgMTU1Ni4zNzY5MDVdIDwtIFtBQ0xdIDBCIDIwIDA4IDAwIDA0IDAwIDQwIDAw
IDBCIDczIDAxIDkyIApbIDE1NTYuNDI1OTE1XSA8LSBbQUNMXSAwQiAyMCAwOCAwMCAwNCAw
MCA0MCAwMCAwQiAxRiAwMSA3MyAKWyAxNTU2LjYzNTkzNl0gPC0gW0VWVF0gMTMgMDUgMDEg
MEIgMDAgMDEgMDAgClsgMTU1Ni42ODQ4OTFdIDwtIFtBQ0xdIDBCIDIwIDA4IDAwIDA0IDAw
IDQwIDAwIDAxIDUzIDAxIDlDIApbIDE1NTYuNzMzOTA0XSA8LSBbQUNMXSAwQiAyMCAwOCAw
MCAwNCAwMCA0MCAwMCAwMyA3MyAwMSBENyAKWyAxNTU2Ljc4MjkwN10gPC0gW0FDTF0gMEIg
MjAgMEMgMDAgMDggMDAgMDEgMDAgMDYgMDQgMDQgMDAgNDAgMDAgNDAgMDAgClsgMTU1Ni44
MTU4OTddIDwtIFtFVlRdIDEzIDA1IDAxIDBCIDAwIDAyIDAwIApbIDE1NTYuODY0OTA2XSA8
LSBbQUNMXSAwQiAyMCAwQyAwMCAwOCAwMCAwMSAwMCAwNyAwNSAwNCAwMCA0MCAwMCA0MCAw
MCAKWyAxNTU2Ljg2Njg4N10gPC0gW0VWVF0gMTMgMDUgMDEgMEIgMDAgMDIgMDAgClsgMTU1
Ni45MTU5MTJdIDwtIFtFVlRdIDBGIDA0IDAwIDAxIDA2IDA0IApbIDE1NTYuOTE3ODg3XSA8
LSBbRVZUXSAwNSAwNCAwMCAwQiAwMCAxNiAKWyAxNTU2Ljk2NjkyOF0gPC0gW0VWVF0gMEUg
MDQgMDEgMUEgMEMgMDAgClsgMTU1Ny41Nzk5ODNdIEJsdWV0b290aDogaGNpMDogY29tbWFu
ZCAweDA0MTMgdHggdGltZW91dApbUVNlcnZlcl0gQ2hpbGQgdGVybWluYXRlZCBieSBzaWdu
YWwgS2lsbGVkCg==
--------------RPiOa1eO3rfjjsP3iJaQbfKy
Content-Type: application/octet-stream;
 name="Flush_Occurred_Misalignment.pcap"
Content-Disposition: attachment; filename="Flush_Occurred_Misalignment.pcap"
Content-Transfer-Encoding: base64

Cg0NCqAAAABNPCsaAQAAAP//////////AgAdAFFFTVUgVmlydHVhbCBDUFUgdmVyc2lvbiAy
LjUrAAAAAwALAExpbnV4IDYuNy45AAQARQBEdW1wY2FwIChXaXJlc2hhcmspIDMuNC4xMCAo
R2l0IHYzLjQuMTAgcGFja2FnZWQgYXMgMy40LjEwLTArZGViMTF1MSkAAAAAAAAAoAAAAAEA
AABAAAAAyQAAAAAABAACAAoAYmx1ZXRvb3RoMAAACQABAAYAAAAMAAsATGludXggNi43LjkA
AAAAAEAAAAAGAAAAOAAAAAAAAADzGAYA8TD7hhUAAAAVAAAAAAAAAAEFBA2oJdHrJ7gYzAIA
AAABAAAAOAAAAAYAAAAsAAAAAAAAAPMYBgAiM/uGCwAAAAsAAAAAAAABBA8EAAEFBAAsAAAA
BgAAADAAAAAAAAAA8xgGABM++4YPAAAADwAAAAAAAAEEEggAqCXR6ye4AQAwAAAABgAAADQA
AAAAAAAA8xgGAM5J+4YSAAAAEgAAAAAAAAEEAwsACwCoJdHrJ7gBAAAANAAAAAYAAAAsAAAA
AAAAAPMYBgAGTvuGCgAAAAoAAAAAAAAAARsEAgsAAAAsAAAABgAAACwAAAAAAAAA8xgGAPpR
+4YKAAAACgAAAAAAAAEEGwMLAAUAACwAAAAGAAAANAAAAAAAAADzGAYABJj7hhMAAAATAAAA
AAAAAQILIAoABgABAAoBAgACAAA0AAAABgAAACwAAAAAAAAA8xgGAGSa+4YLAAAACwAAAAAA
AAEEDwQAARsEACwAAAAGAAAALAAAAAAAAADzGAYA45r7hgkAAAAJAAAAAAAAAAEaDAEAAAAA
LAAAAAYAAAA0AAAAAAAAAPMYBgDIo/uGEgAAABIAAAAAAAABBAsLAAsAv/7P/tv/e4cAADQA
AAAGAAAALAAAAAAAAADzGAYAW6b7hgsAAAALAAAAAAAAAQQOBAEaDAAALAAAAAYAAAAsAAAA
AAAAAPMYBgDOpvuGCwAAAAsAAAAAAAAAARwEAwsAAQAsAAAABgAAACwAAAAAAAAA8xgGAPyp
+4YLAAAACwAAAAAAAAEEDgQBGgwAACwAAAAGAAAALAAAAAAAAADzGAYAFGv8hgsAAAALAAAA
AAAAAQQPBAABHAQALAAAAAYAAAA0AAAAAAAAAPMYBgC6cvyGFAAAABQAAAAAAAABBCMNAAsA
AQILAAAAAAAAADQAAAAGAAAANAAAAAAAAADzGAYAOXP8hhIAAAASAAAAAAAAAAEZBAqoJdHr
J7gCAAAAAAA0AAAABgAAACwAAAAAAAAA8xgGAPN3/IYLAAAACwAAAAAAAAEEDwQAARkEACwA
AAAGAAAAKAEAAAAAAADzGAYAIQv9hgYBAAAGAQAAAAAAAQQH/wCoJdHrJ7hyYXNwYmVycnlw
aQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAEAAAYAAAAsAAAAAAAAAPMYBgBkDP2GCgAAAAoA
AAAAAAAAAREEAgsAAAAsAAAABgAAACwAAAAAAAAA8xgGAG0n/YYLAAAACwAAAAAAAAEEDwQA
AREEACwAAAAGAAAAMAAAAAAAAADzGAYA22j9hg0AAAANAAAAAAAAAQQXBqgl0esnuAAAADAA
AAAGAAAAQAAAAAAAAADzGAYAbmn9hh4AAAAeAAAAAAAAAAELBBaoJdHrJ7jpt6BTRP0MuJeM
vboyj4azAABAAAAABgAAADQAAAAAAAAA8xgGADJw/YYRAAAAEQAAAAAAAAEEDgoBCwQAqCXR
6ye4AAAANAAAAAYAAAAsAAAAAAAAAPMYBgC58f2GCgAAAAoAAAAAAAABBAYDAAsAAAAsAAAA
BgAAACwAAAAAAAAA8xgGAEjy/YYLAAAACwAAAAAAAAABEwQDCwABACwAAAAGAAAAZAAAAAAA
AADzGAYAOG4Ah0QAAABEAAAAAAAAAQQRPcQCYtEECAQACwACBO26R5HQJgqftwILIBAADAAB
AAsBCAACAAAAuAIAAAQTBQELAAIAAgsgCgAGAAEACgJkAAAA

--------------RPiOa1eO3rfjjsP3iJaQbfKy--