android/android_kernel_samsung_sm8650
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bluetooth: L2CAP: Fix responding with wrong PDU type

Browse Source 
[ Upstream commit 9aa9d9473f1550d1936c31259720b3f1f4690576 ]

L2CAP_ECRED_CONN_REQ shall be responded with L2CAP_ECRED_CONN_RSP not
L2CAP_LE_CONN_RSP:

L2CAP LE EATT Server - Reject - run
  Listening for connections
  New client connection with handle 0x002a
  Sending L2CAP Request from client
  Client received response code 0x15
  Unexpected L2CAP response code (expected 0x18)
L2CAP LE EATT Server - Reject - test failed

> ACL Data RX: Handle 42 flags 0x02 dlen 26
      LE L2CAP: Enhanced Credit Connection Request (0x17) ident 1 len 18
        PSM: 39 (0x0027)
        MTU: 64
        MPS: 64
        Credits: 5
        Source CID: 65
        Source CID: 66
        Source CID: 67
        Source CID: 68
        Source CID: 69
< ACL Data TX: Handle 42 flags 0x00 dlen 16
      LE L2CAP: LE Connection Response (0x15) ident 1 len 8
        invalid size
        00 00 00 00 00 00 06 00

L2CAP LE EATT Server - Reject - run
  Listening for connections
  New client connection with handle 0x002a
  Sending L2CAP Request from client
  Client received response code 0x18
L2CAP LE EATT Server - Reject - test passed

Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Luiz Augusto von Dentz
2023-03-08 14:20:34 -08:00
committed by Greg Kroah-Hartman
parent 9508596006
commit c357e28b01
1 changed files with 87 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

133
net/bluetooth/l2cap_core.c
View File

@ -708,6 +708,17 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
}
EXPORT_SYMBOL_GPL(l2cap_chan_del);
static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id,
l2cap_chan_func_t func, void *data)
{
struct l2cap_chan *chan, *l;
list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
if (chan->ident == id)
func(chan, data);
}
}
static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
void *data)
{
@ -775,23 +786,9 @@ static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
{
struct l2cap_conn *conn = chan->conn;
struct l2cap_ecred_conn_rsp rsp;
u16 result;
if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
result = L2CAP_CR_LE_AUTHORIZATION;
else
result = L2CAP_CR_LE_BAD_PSM;
l2cap_state_change(chan, BT_DISCONN);
memset(&rsp, 0, sizeof(rsp));
rsp.result = cpu_to_le16(result);
l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
&rsp);
__l2cap_ecred_conn_rsp_defer(chan);
}
static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
@ -846,7 +843,7 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)
break;
case L2CAP_MODE_EXT_FLOWCTL:
l2cap_chan_ecred_connect_reject(chan);
break;
return;
}
}
}
@ -3938,43 +3935,86 @@ void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
&rsp);
}
void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
{
struct {
struct l2cap_ecred_conn_rsp rsp;
__le16 dcid[5];
} __packed pdu;
struct l2cap_conn *conn = chan->conn;
u16 ident = chan->ident;
int i = 0;
int *result = data;
if (!ident)
if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
return;
BT_DBG("chan %p ident %d", chan, ident);
pdu.rsp.mtu = cpu_to_le16(chan->imtu);
pdu.rsp.mps = cpu_to_le16(chan->mps);
pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
mutex_lock(&conn->chan_lock);
list_for_each_entry(chan, &conn->chan_l, list) {
if (chan->ident != ident)
continue;
/* Reset ident so only one response is sent */
chan->ident = 0;
/* Include all channels pending with the same ident */
pdu.dcid[i++] = cpu_to_le16(chan->scid);
switch (chan->state) {
case BT_CONNECT2:
/* If channel still pending accept add to result */
(*result)++;
return;
case BT_CONNECTED:
return;
default:
/* If not connected or pending accept it has been refused */
*result = -ECONNREFUSED;
return;
}
}
mutex_unlock(&conn->chan_lock);
struct l2cap_ecred_rsp_data {
struct {
struct l2cap_ecred_conn_rsp rsp;
__le16 scid[L2CAP_ECRED_MAX_CID];
} __packed pdu;
int count;
};
l2cap_send_cmd(conn, ident, L2CAP_ECRED_CONN_RSP,
sizeof(pdu.rsp) + i * sizeof(__le16), &pdu);
static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
{
struct l2cap_ecred_rsp_data *rsp = data;
if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
return;
/* Reset ident so only one response is sent */
chan->ident = 0;
/* Include all channels pending with the same ident */
if (!rsp->pdu.rsp.result)
rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid);
else
l2cap_chan_del(chan, ECONNRESET);
}
void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
{
struct l2cap_conn *conn = chan->conn;
struct l2cap_ecred_rsp_data data;
u16 id = chan->ident;
int result = 0;
if (!id)
return;
BT_DBG("chan %p id %d", chan, id);
memset(&data, 0, sizeof(data));
data.pdu.rsp.mtu = cpu_to_le16(chan->imtu);
data.pdu.rsp.mps = cpu_to_le16(chan->mps);
data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
/* Verify that all channels are ready */
__l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result);
if (result > 0)
return;
if (result < 0)
data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION);
/* Build response */
__l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data);
l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP,
sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)),
&data.pdu);
}
void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
@ -6078,6 +6118,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
chan->ident = cmd->ident;
chan->mode = L2CAP_MODE_EXT_FLOWCTL;
if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
l2cap_state_change(chan, BT_CONNECT2);