[Bug 218199] New: Bluetooth: HCI_EV_REMOTE_EXT_FEATURES loss prevents connection abort

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=218199

            Bug ID: 218199
           Summary: Bluetooth: HCI_EV_REMOTE_EXT_FEATURES loss prevents
                    connection abort
           Product: Drivers
           Version: 2.5
          Hardware: Intel
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: Bluetooth
          Assignee: linux-bluetooth@vger.kernel.org
          Reporter: sy2239101@buaa.edu.cn
        Regression: No

Our fuzzing tool finds a possible semantic bug in the Bluetooth system in Linux
6.7-rc2:

When establishing a connection, the loss of HCI_EV_CONN_COMPLETE results in a
connection failure, and the controller sends HCI_EV_DISCONN_COMPLETE to abort
the connection.

Even if HCI_EV_DISCONN_COMPLETE is lost, functions such as hci_conn_timeout
(/net/bluetooth/hci_conn.c: 612), hci_abort_conn (/net/bluetooth/hci_conn.c:
2960), and hci_abort_conn_sync (/net/bluetooth/hci_sync.c: 5379) ensure that
the connection is aborted.

However, in our testing, when both HCI_EV_REMOTE_EXT_FEATURES and
HCI_EV_DISCONN_COMPLETE are lost, it seems that hci_conn_timeout,
hci_abort_conn, and hci_abort_conn_sync are not invoked, leading to the
connection remaining un-aborted.

We are not sure whether this is a semantic bug or an implementation feature in
the Linux kernel. Any feedback would be appreciated, thanks!

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.