From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: linux-bluetooth@vger.kernel.org
Subject: [PATCH BlueZ v1 05/10] unit/test-gatt: Add malformed PDU tests
Date: Mon, 9 Nov 2026 10:44:56 -0500 [thread overview]
Message-ID: <20261109154501.1362649-6-luiz.dentz@gmail.com> (raw)
In-Reply-To: <20261109154501.1362649-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Add server tests for short and oversized requests, which must be
answered with Invalid PDU, and client tests for truncated or
inconsistent MTU, Read By Group Type, Read By Type and Notification
Multiple responses.
Client tests that are expected to fail initialization use a new
init_fail step flag.
Assisted-by: OpenCode:claude-sonnet-5.5
---
unit/test-gatt.c | 175 +++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 175 insertions(+)
diff --git a/unit/test-gatt.c b/unit/test-gatt.c
index 267bcc61802e..ad8e95453be2 100644
--- a/unit/test-gatt.c
+++ b/unit/test-gatt.c
@@ -352,6 +352,7 @@ struct test_step {
const uint8_t *value;
uint16_t length;
uint8_t features;
+ bool init_fail;
};
static void destroy_context(struct context *context)
@@ -645,6 +646,15 @@ static void match_services(struct gatt_db_attribute *client_serv_attr,
static void client_ready_cb(bool success, uint8_t att_ecode, void *user_data)
{
struct context *context = user_data;
+ const struct test_step *init_step = context->data->step;
+
+ if (init_step && init_step->init_fail) {
+ g_assert(!success);
+
+ /* The client is still in use by the caller, quit when idle */
+ g_idle_add(context_quit, context);
+ return;
+ }
g_assert(success);
@@ -2495,6 +2505,10 @@ static void test_notification_short(struct context *context)
NULL));
}
+static const struct test_step test_client_init_fail = {
+ .init_fail = true,
+};
+
static const struct test_step test_notification_short_1 = {
.handle = 0x0003,
.func = test_notification_short,
@@ -4953,6 +4967,167 @@ int main(int argc, char *argv[])
raw_pdu(0xff, 0x00),
raw_pdu());
+ define_test_client("/robustness/client-mtu-rsp-short", test_client,
+ NULL, &test_client_init_fail,
+ raw_pdu(0x02, 0x00, 0x02),
+ raw_pdu(0x03, 0x00));
+
+ define_test_client("/robustness/client-mtu-rsp-long", test_client,
+ NULL, &test_client_init_fail,
+ raw_pdu(0x02, 0x00, 0x02),
+ raw_pdu(0x03, 0x00, 0x02, 0x00));
+
+ define_test_client("/robustness/client-read-by-grp-type-short",
+ test_client, NULL, &test_client_init_fail,
+ CLIENT_INIT_PDUS,
+ raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),
+ raw_pdu(0x11, 0x06, 0x01, 0x00, 0x05));
+
+ define_test_client("/robustness/client-read-by-grp-type-data-len",
+ test_client, NULL, &test_client_init_fail,
+ CLIENT_INIT_PDUS,
+ raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),
+ raw_pdu(0x11, 0x07, 0x01, 0x00, 0x05, 0x00, 0x01, 0x18,
+ 0x00));
+
+ define_test_client("/robustness/client-read-by-grp-type-trailing",
+ test_client, NULL, &test_client_init_fail,
+ CLIENT_INIT_PDUS,
+ raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),
+ raw_pdu(0x11, 0x06, 0x01, 0x00, 0x05, 0x00, 0x01, 0x18,
+ 0x02));
+
+ define_test_client("/robustness/client-included-short", test_client,
+ NULL, &test_client_init_fail,
+ CLIENT_INIT_PDUS,
+ raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),
+ raw_pdu(0x11, 0x06, 0x01, 0x00, 0x04, 0x00, 0x01, 0x18),
+ raw_pdu(0x10, 0x05, 0x00, 0xff, 0xff, 0x00, 0x28),
+ raw_pdu(0x01, 0x10, 0x05, 0x00, 0x0a),
+ raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x01, 0x28),
+ raw_pdu(0x01, 0x10, 0x01, 0x00, 0x0a),
+ raw_pdu(0x08, 0x01, 0x00, 0x04, 0x00, 0x02, 0x28),
+ raw_pdu(0x09, 0x08, 0x02, 0x00, 0x01, 0x00, 0x04));
+
+ define_test_client("/robustness/client-characteristic-short",
+ test_client, NULL, &test_client_init_fail,
+ CLIENT_INIT_PDUS,
+ raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),
+ raw_pdu(0x11, 0x06, 0x01, 0x00, 0x04, 0x00, 0x01, 0x18),
+ raw_pdu(0x10, 0x05, 0x00, 0xff, 0xff, 0x00, 0x28),
+ raw_pdu(0x01, 0x10, 0x05, 0x00, 0x0a),
+ raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x01, 0x28),
+ raw_pdu(0x01, 0x10, 0x01, 0x00, 0x0a),
+ raw_pdu(0x08, 0x01, 0x00, 0x04, 0x00, 0x02, 0x28),
+ raw_pdu(0x01, 0x08, 0x01, 0x00, 0x0a),
+ raw_pdu(0x08, 0x01, 0x00, 0x04, 0x00, 0x03, 0x28),
+ raw_pdu(0x09, 0x07, 0x02, 0x00, 0x02, 0x03, 0x00,
+ 0x00));
+
+ define_test_client("/robustness/notify-multiple-short", test_client,
+ ts_small_db, &test_notification_short_1,
+ CLIENT_INIT_PDUS,
+ SMALL_DB_DISCOVERY_PDUS,
+ raw_pdu(0x12, 0x04, 0x00, 0x01, 0x00),
+ raw_pdu(0x13),
+ raw_pdu(),
+ raw_pdu(0x23, 0x03, 0x00, 0x03, 0x00, 0x01, 0x02, 0x03),
+ raw_pdu(),
+ raw_pdu(0x23, 0x03, 0x00, 0x03),
+ raw_pdu(),
+ raw_pdu(0x23, 0x03, 0x00, 0x09, 0x00, 0x01, 0x02,
+ 0x03));
+
+ define_test_server("/robustness/read-by-grp-type-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff),
+ raw_pdu(0x01, 0x10, 0x00, 0x00, 0x04),
+ raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28,
+ 0x29),
+ raw_pdu(0x01, 0x10, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/read-by-type-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff),
+ raw_pdu(0x01, 0x08, 0x00, 0x00, 0x04),
+ raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28,
+ 0x29),
+ raw_pdu(0x01, 0x08, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/find-info-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x04, 0x01, 0x00, 0xff),
+ raw_pdu(0x01, 0x04, 0x00, 0x00, 0x04),
+ raw_pdu(0x04, 0x01, 0x00, 0xff, 0xff, 0x00),
+ raw_pdu(0x01, 0x04, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/find-by-type-value-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x06, 0x01, 0x00, 0xff, 0xff, 0x00),
+ raw_pdu(0x01, 0x06, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/read-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x0a, 0x03),
+ raw_pdu(0x01, 0x0a, 0x00, 0x00, 0x04),
+ raw_pdu(0x0a, 0x03, 0x00, 0x00),
+ raw_pdu(0x01, 0x0a, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/read-blob-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x0c, 0x03, 0x00, 0x00),
+ raw_pdu(0x01, 0x0c, 0x00, 0x00, 0x04),
+ raw_pdu(0x0c, 0x03, 0x00, 0x00, 0x00, 0x00),
+ raw_pdu(0x01, 0x0c, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/read-multiple-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x0e, 0x03, 0x00),
+ raw_pdu(0x01, 0x0e, 0x00, 0x00, 0x04),
+ raw_pdu(0x20, 0x03, 0x00),
+ raw_pdu(0x01, 0x20, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/write-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x12, 0x04),
+ raw_pdu(0x01, 0x12, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/write-cmd-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x52, 0x04),
+ raw_pdu());
+
+ define_test_server("/robustness/prep-write-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x16, 0x03, 0x00, 0x00),
+ raw_pdu(0x01, 0x16, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/exec-write-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x18),
+ raw_pdu(0x01, 0x18, 0x00, 0x00, 0x04),
+ raw_pdu(0x18, 0x01, 0x00),
+ raw_pdu(0x01, 0x18, 0x00, 0x00, 0x04));
+
+ define_test_server("/robustness/mtu-malformed",
+ test_server, ts_small_db, NULL,
+ raw_pdu(0x03, 0x00, 0x02),
+ raw_pdu(0x02, 0x17),
+ raw_pdu(0x01, 0x02, 0x00, 0x00, 0x04),
+ raw_pdu(0x02, 0x17, 0x00, 0x00),
+ raw_pdu(0x01, 0x02, 0x00, 0x00, 0x04));
+
define_test_server("/robustness/hash-db",
test_hash_db, ts_tail_db, NULL,
{});
--
2.56.0
next prev parent reply other threads:[~2026-11-09 15:45 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-09 15:44 [PATCH BlueZ v1 00/10] shared/gatt: Use util_iov helpers for PDU handling Luiz Augusto von Dentz
2026-11-09 15:44 ` [PATCH BlueZ v1 01/10] shared/att: Use util_iov helpers to build and parse PDUs Luiz Augusto von Dentz
2026-11-10 6:49 ` shared/gatt: Use util_iov helpers for PDU handling bluez.test.bot
2026-11-09 15:44 ` [PATCH BlueZ v1 02/10] shared/gatt-server: Use util_iov helpers to build and parse PDUs Luiz Augusto von Dentz
2026-11-09 15:44 ` [PATCH BlueZ v1 03/10] shared/gatt-helpers: " Luiz Augusto von Dentz
2026-11-09 15:44 ` [PATCH BlueZ v1 04/10] shared/gatt-client: " Luiz Augusto von Dentz
2026-11-09 15:44 ` Luiz Augusto von Dentz [this message]
2026-11-09 15:44 ` [PATCH BlueZ v1 06/10] shared/gatt-server: Fix authorize callback getting handle 0 on write Luiz Augusto von Dentz
2026-11-09 15:44 ` [PATCH BlueZ v1 07/10] shared/gatt-server: Fix double response on prepare write failure Luiz Augusto von Dentz
2026-11-09 15:44 ` [PATCH BlueZ v1 08/10] shared/gatt-server: Fix return value of handler registration Luiz Augusto von Dentz
2026-11-09 15:45 ` [PATCH BlueZ v1 09/10] shared/att: Fix reference leak on signature verification failure Luiz Augusto von Dentz
2026-11-09 15:45 ` [PATCH BlueZ v1 10/10] shared/att: Fix signature length subtracted once per handler Luiz Augusto von Dentz
2026-11-10 16:40 ` [PATCH BlueZ v1 00/10] shared/gatt: Use util_iov helpers for PDU handling patchwork-bot+bluetooth
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261109154501.1362649-6-luiz.dentz@gmail.com \
--to=luiz.dentz@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox