[PATCH BlueZ 0/1] Fix SDP buffer overflow for DS4 (Revision 2)

[PATCH BlueZ 0/1] Fix SDP buffer overflow for DS4 (Revision 2)

[Kieran Geary]

Hello,

I have a Dualshock 4 that has been unable to connect via BlueZ, since it reports a L2CAP buffer overflow when it recieves an SDP response on PSM19. This is known for Dualshock 4 (Revision 1) controllers , and there is already a fix in place for it in BlueZ. This patch extends that fix to also apply for the Revision 2 product code.


If there are any adjustments that need to be made, feel free to reach out.

Many thanks,
Kieran Geary

Kieran Geary (1):
  Set `SDP_LARGE_MTU` flag for DS4 Rev. 2 product code

 src/device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.47.1

[PATCH BlueZ 1/1] Set `SDP_LARGE_MTU` flag for DS4 Rev. 2 product code

[Kieran Geary]

---
 src/device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/device.c b/src/device.c
index 2b3d19f55..4e5a5b945 100644
--- a/src/device.c
+++ b/src/device.c
@@ -6047,7 +6047,7 @@ static uint16_t get_sdp_flags(struct btd_device *device)
 	 * results in SDP response being dropped by kernel. Workaround this by
 	 * forcing SDP code to use bigger MTU while connecting.
 	 */
-	if (vid == 0x054c && pid == 0x05c4)
+	if (vid == 0x054c && (pid == 0x05c4 || pid == 0x09cc))
 		return SDP_LARGE_MTU;
 
 	if (btd_adapter_ssp_enabled(device->adapter))
-- 
2.47.1

Re: [PATCH BlueZ 1/1] Set `SDP_LARGE_MTU` flag for DS4 Rev. 2 product code

[Luiz Augusto von Dentz]

Hi Kieran,

On Thu, Dec 19, 2024 at 1:13 PM Kieran Geary <kieran.r.geary@gmail.com> wrote:
>
> ---
>  src/device.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/device.c b/src/device.c
> index 2b3d19f55..4e5a5b945 100644
> --- a/src/device.c
> +++ b/src/device.c
> @@ -6047,7 +6047,7 @@ static uint16_t get_sdp_flags(struct btd_device *device)
>          * results in SDP response being dropped by kernel. Workaround this by
>          * forcing SDP code to use bigger MTU while connecting.
>          */
> -       if (vid == 0x054c && pid == 0x05c4)
> +       if (vid == 0x054c && (pid == 0x05c4 || pid == 0x09cc))
>                 return SDP_LARGE_MTU;
>
>         if (btd_adapter_ssp_enabled(device->adapter))
> --
> 2.47.1

Perhaps it would be a good idea to create a vid:pid table if there are
multiple devices being affected.

-- 
Luiz Augusto von Dentz

RE: Fix SDP buffer overflow for DS4 (Revision 2)

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=919589

---Test result---

Test Summary:
CheckPatch                    PENDING   0.21 seconds
GitLint                       PENDING   0.20 seconds
BuildEll                      PASS      20.66 seconds
BluezMake                     PASS      1619.79 seconds
MakeCheck                     PASS      13.05 seconds
MakeDistcheck                 PASS      159.85 seconds
CheckValgrind                 PASS      215.65 seconds
CheckSmatch                   PASS      274.02 seconds
bluezmakeextell               PASS      99.84 seconds
IncrementalBuild              PENDING   0.27 seconds
ScanBuild                     PASS      855.39 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

[PATCH BlueZ v2] Set `SDP_LARGE_MTU` flag for DS4 Rev. 2 product code

[Kieran Geary]

iterate over a table instead of checking individual product codes
---
 src/device.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/device.c b/src/device.c
index 2b3d19f55..09121e1b9 100644
--- a/src/device.c
+++ b/src/device.c
@@ -6038,7 +6038,12 @@ static int device_browse_gatt(struct btd_device *device, DBusMessage *msg)
 
 static uint16_t get_sdp_flags(struct btd_device *device)
 {
+	size_t i;
 	uint16_t vid, pid;
+	static const uint16_t device_sdp_flags[][3] = {
+		{0x054c, 0x05c4, SDP_LARGE_MTU},
+		{0x054c, 0x09cc, SDP_LARGE_MTU}
+	};
 
 	vid = btd_device_get_vendor(device);
 	pid = btd_device_get_product(device);
@@ -6047,8 +6052,11 @@ static uint16_t get_sdp_flags(struct btd_device *device)
 	 * results in SDP response being dropped by kernel. Workaround this by
 	 * forcing SDP code to use bigger MTU while connecting.
 	 */
-	if (vid == 0x054c && pid == 0x05c4)
-		return SDP_LARGE_MTU;
+	for (i=0; i<G_N_ELEMENTS(device_sdp_flags); i++) {
+		if (vid == device_sdp_flags[i][0] &&
+				pid == device_sdp_flags[i][1])
+			return device_sdp_flags[i][2];
+	}
 
 	if (btd_adapter_ssp_enabled(device->adapter))
 		return 0;
-- 
2.47.1

RE: [BlueZ,v2] Set `SDP_LARGE_MTU` flag for DS4 Rev. 2 product code

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=919714

---Test result---

Test Summary:
CheckPatch                    PENDING   0.19 seconds
GitLint                       PENDING   0.19 seconds
BuildEll                      PASS      20.67 seconds
BluezMake                     PASS      1587.12 seconds
MakeCheck                     PASS      13.29 seconds
MakeDistcheck                 PASS      159.70 seconds
CheckValgrind                 PASS      215.45 seconds
CheckSmatch                   PASS      274.95 seconds
bluezmakeextell               PASS      99.81 seconds
IncrementalBuild              PENDING   0.26 seconds
ScanBuild                     PASS      848.94 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth