| Message ID | 20240521143521.1568672-1-luiz.dentz@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v3] Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ | expand |
Hello: This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>: On Tue, 21 May 2024 10:35:21 -0400 you wrote: > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > > This removes the bogus check for max > hcon->le_conn_max_interval since > the later is just the initial maximum conn interval not the maximum the > stack could support which is really 3200=4000ms. > > In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values > of the following fields in IXIT that would cause hci_check_conn_params > to fail: > > [...] Here is the summary with links: - [v3] Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ https://git.kernel.org/bluetooth/bluetooth-next/c/a3975db95fcd You are awesome, thank you!
I tested it using the bluetooth-next, with HEAD at
a3975db95fcd8e304f1ee4b0be1895038942a8ef. It rejects the connection
parameter update request at least for the case where the min > max,
which is one of the failed conditions for the hci_check_conn_params()
Note that TSPX_iut_invalid_connection_interval_{min, max} in the IXIT
can be used to create faulty connection parameters.
The specific test steps are:
1. Set TSPX_iut_invalid_connection_interval_min to a value larger
than TSPX_iut_invalid_connection_interval_max, e.g. 0xAB and 0xAA
respectively.
2. Start the GAP/CONN/CPUP/BV-05-C case on PTS.
3. Enter bluetoothctl. Use "scan on" to find the address of PTS dongle.
4. Meanwhile, PTS will ask for connect request. Connect to it by
running "connect $PTS_ADDR" in bluetoothctl.
5. At this point the PTS would send the parameter update request with
faulty parameters set in the IXIT. Kernel will reject this request.
6. PST will then ask to send a disconnect request. Run "disconnect"
in bluetoothctl. The test case should pass after disconnection.
Tested-by: Yo-Jung (Leo) Lin <leo.lin@canonical.com>
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 9231396fe96f..c43716edf205 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -2113,18 +2113,46 @@ static inline int hci_check_conn_params(u16 min, u16 max, u16 latency, { u16 max_latency; - if (min > max || min < 6 || max > 3200) + if (min > max) { + BT_WARN("min %d > max %d", min, max); return -EINVAL; + } - if (to_multiplier < 10 || to_multiplier > 3200) + if (min < 6) { + BT_WARN("min %d < 6", min); return -EINVAL; + } - if (max >= to_multiplier * 8) + if (max > 3200) { + BT_WARN("max %d > 3200", max); return -EINVAL; + } + + if (to_multiplier < 10) { + BT_WARN("to_multiplier %d < 10", to_multiplier); + return -EINVAL; + } + + if (to_multiplier > 3200) { + BT_WARN("to_multiplier %d > 3200", to_multiplier); + return -EINVAL; + } + + if (max >= to_multiplier * 8) { + BT_WARN("max %d >= to_multiplier %d * 8", max, to_multiplier); + return -EINVAL; + } max_latency = (to_multiplier * 4 / max) - 1; - if (latency > 499 || latency > max_latency) + if (latency > 499) { + BT_WARN("latency %d > 499", latency); return -EINVAL; + } + + if (latency > max_latency) { + BT_WARN("latency %d > max_latency %d", latency, max_latency); + return -EINVAL; + } return 0; } diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 5b509b767557..c49e0d4b3c0d 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -4647,13 +4647,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, memset(&rsp, 0, sizeof(rsp)); - if (max > hcon->le_conn_max_interval) { - BT_DBG("requested connection interval exceeds current bounds."); - err = -EINVAL; - } else { - err = hci_check_conn_params(min, max, latency, to_multiplier); - } - + err = hci_check_conn_params(min, max, latency, to_multiplier); if (err) rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); else