* [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links
@ 2013-10-16 8:37 johan.hedberg
2013-10-16 8:37 ` [PATCH 2/2] Bluetooth: Ignore SMP data on non-LE links johan.hedberg
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: johan.hedberg @ 2013-10-16 8:37 UTC (permalink / raw)
To: linux-bluetooth
From: Johan Hedberg <johan.hedberg@intel.com>
The A2MP CID is only valid for BR/EDR transports. We should ignore A2MP
data on non-BR/EDR links and refuse to create an amp_mgr object.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
---
net/bluetooth/a2mp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index fe32a33..efcd108 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -836,6 +836,9 @@ struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
{
struct amp_mgr *mgr;
+ if (conn->hcon->type != ACL_LINK)
+ return NULL;
+
mgr = amp_mgr_create(conn, false);
if (!mgr) {
BT_ERR("Could not create AMP manager");
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] Bluetooth: Ignore SMP data on non-LE links
2013-10-16 8:37 [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links johan.hedberg
@ 2013-10-16 8:37 ` johan.hedberg
2013-10-16 8:42 ` Marcel Holtmann
2013-10-16 8:42 ` [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links Marcel Holtmann
2013-10-16 8:54 ` Andrei Emeltchenko
2 siblings, 1 reply; 6+ messages in thread
From: johan.hedberg @ 2013-10-16 8:37 UTC (permalink / raw)
To: linux-bluetooth
From: Johan Hedberg <johan.hedberg@intel.com>
The SMP CID is only defined for LE transports. Instead of returning an
error from smp_sig_channel() in this case (which would cause a
disconnection) just return 0 to ignore the data, which is consistent
with the behavior for other unknown CIDs.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
---
net/bluetooth/smp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 463e50c..fc200e0 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -856,7 +856,7 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
if (hcon->type != LE_LINK) {
kfree_skb(skb);
- return -ENOTSUPP;
+ return 0;
}
if (skb->len < 1) {
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links
2013-10-16 8:37 [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links johan.hedberg
2013-10-16 8:37 ` [PATCH 2/2] Bluetooth: Ignore SMP data on non-LE links johan.hedberg
@ 2013-10-16 8:42 ` Marcel Holtmann
2013-10-16 8:54 ` Andrei Emeltchenko
2 siblings, 0 replies; 6+ messages in thread
From: Marcel Holtmann @ 2013-10-16 8:42 UTC (permalink / raw)
To: johan.hedberg; +Cc: linux-bluetooth
Hi Johan,
> The A2MP CID is only valid for BR/EDR transports. We should ignore A2MP
> data on non-BR/EDR links and refuse to create an amp_mgr object.
>
> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
> ---
> net/bluetooth/a2mp.c | 3 +++
> 1 file changed, 3 insertions(+)
patch has been applied to bluetooth-next tree.
Regards
Marcel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links
2013-10-16 8:37 [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links johan.hedberg
2013-10-16 8:37 ` [PATCH 2/2] Bluetooth: Ignore SMP data on non-LE links johan.hedberg
2013-10-16 8:42 ` [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links Marcel Holtmann
@ 2013-10-16 8:54 ` Andrei Emeltchenko
2013-10-16 9:10 ` Marcel Holtmann
2 siblings, 1 reply; 6+ messages in thread
From: Andrei Emeltchenko @ 2013-10-16 8:54 UTC (permalink / raw)
To: johan.hedberg; +Cc: linux-bluetooth
Hi Johan,
On Wed, Oct 16, 2013 at 11:37:00AM +0300, johan.hedberg@gmail.com wrote:
> From: Johan Hedberg <johan.hedberg@intel.com>
>
> The A2MP CID is only valid for BR/EDR transports. We should ignore A2MP
> data on non-BR/EDR links and refuse to create an amp_mgr object.
>
> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
> ---
> net/bluetooth/a2mp.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
> index fe32a33..efcd108 100644
> --- a/net/bluetooth/a2mp.c
> +++ b/net/bluetooth/a2mp.c
> @@ -836,6 +836,9 @@ struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
> {
> struct amp_mgr *mgr;
>
> + if (conn->hcon->type != ACL_LINK)
> + return NULL;
> +
Have you experienced this ever happened?
Best regards
Andrei Emeltchenko
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links
2013-10-16 8:54 ` Andrei Emeltchenko
@ 2013-10-16 9:10 ` Marcel Holtmann
0 siblings, 0 replies; 6+ messages in thread
From: Marcel Holtmann @ 2013-10-16 9:10 UTC (permalink / raw)
To: Andrei Emeltchenko; +Cc: johan.hedberg, linux-bluetooth
Hi Andrei,
>> The A2MP CID is only valid for BR/EDR transports. We should ignore A2MP
>> data on non-BR/EDR links and refuse to create an amp_mgr object.
>>
>> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
>> ---
>> net/bluetooth/a2mp.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
>> index fe32a33..efcd108 100644
>> --- a/net/bluetooth/a2mp.c
>> +++ b/net/bluetooth/a2mp.c
>> @@ -836,6 +836,9 @@ struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
>> {
>> struct amp_mgr *mgr;
>>
>> + if (conn->hcon->type != ACL_LINK)
>> + return NULL;
>> +
>
> Have you experienced this ever happened?
this is how good software is written. You check that your input is valid first. Otherwise you open yourself up to vulnerabilities.
Regards
Marcel
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-10-16 9:10 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-16 8:37 [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links johan.hedberg
2013-10-16 8:37 ` [PATCH 2/2] Bluetooth: Ignore SMP data on non-LE links johan.hedberg
2013-10-16 8:42 ` Marcel Holtmann
2013-10-16 8:42 ` [PATCH 1/2] Bluetooth: Ignore A2MP data on non-BR/EDR links Marcel Holtmann
2013-10-16 8:54 ` Andrei Emeltchenko
2013-10-16 9:10 ` Marcel Holtmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox