[PATCH BlueZ v1 1/2] monitor: Check valid range of CE Length

[PATCH BlueZ v1 1/2] monitor: Check valid range of CE Length

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The connection event length recommended in requests by a Peripheral has
a valid range of 0x0001 to 0x7CFF (Time = N * 125 us, Time Range:
0.125 ms to 3.999875 s), so print values outside of it as reserved
instead of decoding them as a time.
---
 monitor/packet.c | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/monitor/packet.c b/monitor/packet.c
index 0d3b23cc3fb7..692119ec6425 100644
--- a/monitor/packet.c
+++ b/monitor/packet.c
@@ -2423,6 +2423,24 @@ static void print_slot_125u(const char *label, uint16_t value)
 				le16_to_cpu(value) * 0.125, le16_to_cpu(value));
 }
 
+/* Connection event length recommended in requests by a Peripheral:
+ * Range: 0x0001 to 0x7CFF, Time = N * 125 us
+ */
+#define BT_HCI_CE_LEN_MIN 0x0001
+#define BT_HCI_CE_LEN_MAX 0x7cff
+
+static void print_ce_len(const char *label, uint16_t value)
+{
+	uint16_t val = le16_to_cpu(value);
+
+	if (val < BT_HCI_CE_LEN_MIN || val > BT_HCI_CE_LEN_MAX) {
+		print_field("%s: Reserved (0x%4.4x)", label, val);
+		return;
+	}
+
+	print_field("%s: %.3f msec (0x%4.4x)", label, val * 0.125, val);
+}
+
 static void print_slot_625(const char *label, uint16_t value)
 {
 	 print_field("%s: %.3f msec (0x%4.4x)", label,
@@ -9915,8 +9933,8 @@ static void le_conn_rate_cmd(uint16_t index, const void *data, uint8_t size)
 	print_field("Supervision Timeout: %d ms (0x%4.4x)",
 				le16_to_cpu(cmd->supv_timeout) * 10,
 				le16_to_cpu(cmd->supv_timeout));
-	print_slot_125u("Minimum CE Length", cmd->min_ce_len);
-	print_slot_125u("Maximum CE Length", cmd->max_ce_len);
+	print_ce_len("Minimum CE Length", cmd->min_ce_len);
+	print_ce_len("Maximum CE Length", cmd->max_ce_len);
 }
 
 static void le_set_def_rate_cmd(uint16_t index, const void *data, uint8_t size)
@@ -9940,8 +9958,8 @@ static void le_set_def_rate_cmd(uint16_t index, const void *data, uint8_t size)
 	print_field("Supervision Timeout: %d ms (0x%4.4x)",
 				le16_to_cpu(cmd->supv_timeout) * 10,
 				le16_to_cpu(cmd->supv_timeout));
-	print_slot_125u("Minimum CE Length", cmd->min_ce_len);
-	print_slot_125u("Maximum CE Length", cmd->max_ce_len);
+	print_ce_len("Minimum CE Length", cmd->min_ce_len);
+	print_ce_len("Maximum CE Length", cmd->max_ce_len);
 }
 
 static void le_read_conn_interval_rsp(uint16_t index, const void *data,
-- 
2.54.0

[PATCH BlueZ v1 2/2] emulator/btdev: Check valid range of CE Length

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The connection event length recommended in requests by a Peripheral has
a valid range of 0x0001 to 0x7CFF (Time = N * 125 us, Time Range:
0.125 ms to 3.999875 s), so reject LE Connection Rate Request and LE Set
Default Rate Parameters with values outside of it.
---
 emulator/btdev.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/emulator/btdev.c b/emulator/btdev.c
index a53bd82526d9..bc573c3a2370 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -7963,6 +7963,27 @@ static void set_le_60_commands(struct btdev *btdev)
 	btdev->cmds = cmd_le_6_0;
 }
 
+/* Connection event length recommended in requests by a Peripheral:
+ * Range: 0x0001 to 0x7CFF, Time = N * 125 us
+ * Time Range: 0.125 ms to 3.999875 s
+ */
+#define BT_HCI_CE_LEN_MIN 0x0001
+#define BT_HCI_CE_LEN_MAX 0x7cff
+
+static bool valid_ce_len(uint16_t min_ce_len, uint16_t max_ce_len)
+{
+	uint16_t min = le16_to_cpu(min_ce_len);
+	uint16_t max = le16_to_cpu(max_ce_len);
+
+	if (min < BT_HCI_CE_LEN_MIN || min > BT_HCI_CE_LEN_MAX)
+		return false;
+
+	if (max < BT_HCI_CE_LEN_MIN || max > BT_HCI_CE_LEN_MAX)
+		return false;
+
+	return min <= max;
+}
+
 static int cmd_le_conn_rate(struct btdev *dev, const void *data, uint8_t len)
 {
 	const struct bt_hci_cmd_le_conn_rate *cmd = data;
@@ -7974,6 +7995,8 @@ static int cmd_le_conn_rate(struct btdev *dev, const void *data, uint8_t len)
 				UINT_TO_PTR(le16_to_cpu(cmd->handle)));
 	if (!conn)
 		status = BT_HCI_ERR_UNKNOWN_CONN_ID;
+	else if (!valid_ce_len(cmd->min_ce_len, cmd->max_ce_len))
+		status = BT_HCI_ERR_INVALID_PARAMETERS;
 
 	cmd_status(dev, status, BT_HCI_CMD_LE_CONN_RATE);
 
@@ -7999,8 +8022,12 @@ static int cmd_le_conn_rate(struct btdev *dev, const void *data, uint8_t len)
 
 static int cmd_le_set_def_rate(struct btdev *dev, const void *data, uint8_t len)
 {
+	const struct bt_hci_cmd_le_set_def_rate *cmd = data;
 	uint8_t status = BT_HCI_ERR_SUCCESS;
 
+	if (!valid_ce_len(cmd->min_ce_len, cmd->max_ce_len))
+		status = BT_HCI_ERR_INVALID_PARAMETERS;
+
 	cmd_complete(dev, BT_HCI_CMD_LE_SET_DEF_RATE, &status, sizeof(status));
 
 	return 0;
-- 
2.54.0

RE: [BlueZ,v1,1/2] monitor: Check valid range of CE Length

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1387 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1156272

---Test result---

Test Summary:
CheckPatch                    PASS      0.64 seconds
GitLint                       PASS      0.45 seconds
BuildEll                      PASS      23.58 seconds
BluezMake                     PASS      641.40 seconds
MakeCheck                     PASS      0.94 seconds
MakeDistcheck                 PASS      162.41 seconds
CheckValgrind                 PASS      160.63 seconds
CheckSmatch                   WARNING   322.58 seconds
bluezmakeextell               PASS      103.55 seconds
IncrementalBuild              PASS      638.06 seconds
ScanBuild                     PASS      1021.13 seconds

Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
monitor/packet.c:2002:26: warning: Variable length array is used.monitor/packet.c: note: in included file:monitor/bt.h:3924:52: warning: array of flexible structuresmonitor/bt.h:3912:40: warning: array of flexible structuresemulator/btdev.c:478:29: warning: Variable length array is used.


https://github.com/bluez/bluez/pull/2472

---
Regards,
Linux Bluetooth