2023-11-28 08:19:27

by bugzilla-daemon

[permalink] [raw]
Subject: [Bug 218199] New: Bluetooth: HCI_EV_REMOTE_EXT_FEATURES loss prevents connection abort

https://bugzilla.kernel.org/show_bug.cgi?id=218199

Bug ID: 218199
Summary: Bluetooth: HCI_EV_REMOTE_EXT_FEATURES loss prevents
connection abort
Product: Drivers
Version: 2.5
Hardware: Intel
OS: Linux
Status: NEW
Severity: normal
Priority: P3
Component: Bluetooth
Assignee: [email protected]
Reporter: [email protected]
Regression: No

Our fuzzing tool finds a possible semantic bug in the Bluetooth system in Linux
6.7-rc2:

When establishing a connection, the loss of HCI_EV_CONN_COMPLETE results in a
connection failure, and the controller sends HCI_EV_DISCONN_COMPLETE to abort
the connection.

Even if HCI_EV_DISCONN_COMPLETE is lost, functions such as hci_conn_timeout
(/net/bluetooth/hci_conn.c: 612), hci_abort_conn (/net/bluetooth/hci_conn.c:
2960), and hci_abort_conn_sync (/net/bluetooth/hci_sync.c: 5379) ensure that
the connection is aborted.

However, in our testing, when both HCI_EV_REMOTE_EXT_FEATURES and
HCI_EV_DISCONN_COMPLETE are lost, it seems that hci_conn_timeout,
hci_abort_conn, and hci_abort_conn_sync are not invoked, leading to the
connection remaining un-aborted.

We are not sure whether this is a semantic bug or an implementation feature in
the Linux kernel. Any feedback would be appreciated, thanks!

--
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.


2023-11-28 08:21:37

by bugzilla-daemon

[permalink] [raw]
Subject: [Bug 218199] Bluetooth: HCI_EV_REMOTE_EXT_FEATURES loss prevents connection abort

https://bugzilla.kernel.org/show_bug.cgi?id=218199

Si-Jie Bai ([email protected]) changed:

What |Removed |Added
----------------------------------------------------------------------------
Kernel Version| |6.7-rc2

--
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.