diff mbox series

[v1] Bluetooth: send proper config param to unknown config request

Message ID 20200924234422.v1.1.Id1d24a896cd1d20f9ce7a4eb74523fe7896af89d@changeid
State New
Headers show
Series [v1] Bluetooth: send proper config param to unknown config request | expand

Commit Message

Archie Pusaka Sept. 24, 2020, 3:45 p.m. UTC 
From: Archie Pusaka <apusaka@chromium.org>

When receiving an L2CAP_CONFIGURATION_REQ with an unknown config
type, currently we will reply with L2CAP_CONFIGURATION_RSP with
a list of unknown types as the config param. However, this is not
a correct format of config param.

As described in the bluetooth spec v5.2, Vol 3, Part A, Sec 5,
the config param should consists of type, length, and optionally
data.

This patch copies the length and data from the received
L2CAP_CONFIGURATION_REQ and also appends them to the config param
of the corresponding L2CAP_CONFIGURATION_RSP to match the format
of the config param according to the spec.

Signed-off-by: Archie Pusaka <apusaka@chromium.org>
Reviewed-by: Alain Michaud <alainm@chromium.org>

---

 net/bluetooth/l2cap_core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Marcel Holtmann Sept. 25, 2020, 4:11 p.m. UTC | #1 
Hi Archie,

> When receiving an L2CAP_CONFIGURATION_REQ with an unknown config

> type, currently we will reply with L2CAP_CONFIGURATION_RSP with

> a list of unknown types as the config param. However, this is not

> a correct format of config param.

> 

> As described in the bluetooth spec v5.2, Vol 3, Part A, Sec 5,

> the config param should consists of type, length, and optionally

> data.

> 

> This patch copies the length and data from the received

> L2CAP_CONFIGURATION_REQ and also appends them to the config param

> of the corresponding L2CAP_CONFIGURATION_RSP to match the format

> of the config param according to the spec.


any chance you could add btmon traces to the commit message to show the wrong behavior?

Regards

Marcel
diff mbox series

Patch

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index ade83e224567..2f3ddd4f0f4c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3627,7 +3627,8 @@  static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
 			if (hint)
 				break;
 			result = L2CAP_CONF_UNKNOWN;
-			*((u8 *) ptr++) = type;
+			l2cap_add_conf_opt(&ptr, type, olen, val,
+					   endptr - ptr);
 			break;
 		}
 	}
@@ -3658,7 +3659,7 @@  static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
 	}
 
 done:
-	if (chan->mode != rfc.mode) {
+	if (chan->mode != rfc.mode && result != L2CAP_CONF_UNKNOWN) {
 		result = L2CAP_CONF_UNACCEPT;
 		rfc.mode = chan->mode;