[PATCH] bluetooth:Fix error checking in the function sc_dhkey_check

[PATCH] bluetooth:Fix error checking in the function sc_dhkey_check

[Nicholas Krause]

This fixes error checking  in the function sc_dhkey_check by
properly checking if the internal call to the function smp_f6
has failed by returning a error code as we must return to the
caller immediately if this internal call fails as we cannot

Signed-off-by: Nicholas Krause <xerofoify@gmail.com>
---
 net/bluetooth/smp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index ad82324..05d9814 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1460,8 +1460,9 @@ static void sc_dhkey_check(struct smp_chan *smp)
 	if (smp->method == REQ_OOB)
 		memcpy(r, smp->rr, 16);
 
-	smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
-	       local_addr, remote_addr, check.e);
+	if (smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
+		   local_addr, remote_addr, check.e))
+		return;
 
 	smp_send_cmd(smp->conn, SMP_CMD_DHKEY_CHECK, sizeof(check), &check);
 }
-- 
2.1.4

Re: [PATCH] bluetooth:Fix error checking in the function sc_dhkey_check

[Johan Hedberg]

Hi Nicholas,

(unneeded recipients removed again)

On Tue, Aug 18, 2015, Nicholas Krause wrote:
> This fixes error checking  in the function sc_dhkey_check by
> properly checking if the internal call to the function smp_f6
> has failed by returning a error code as we must return to the
> caller immediately if this internal call fails as we cannot

Looks like the last sentence above is incomplete.

> --- a/net/bluetooth/smp.c
> +++ b/net/bluetooth/smp.c
> @@ -1460,8 +1460,9 @@ static void sc_dhkey_check(struct smp_chan *smp)
>  	if (smp->method == REQ_OOB)
>  		memcpy(r, smp->rr, 16);
>  
> -	smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
> -	       local_addr, remote_addr, check.e);
> +	if (smp_f6(smp->tfm_cmac, smp->mackey, smp->prnd, smp->rrnd, r, io_cap,
> +		   local_addr, remote_addr, check.e))
> +		return;

This could cause the pairing procedure to get stuck because the remote
is expecting the DHKey Check PDU from us and instead we never send
anything. Probably the better solution is to make sc_dhkey_check()
return an SMP error and then pass that up the call stack if necessary,
similar to what sc_passkey_round() does.

Johan