* [PATCH 04/22] Add L2CAP_CID_A2MP_CHAN definition, it's fixed channel 3
From: haijun liu @ 2010-08-25 22:30 UTC (permalink / raw)
To: linux-bluetooth
>From cfa4ccc6baa017ffb3deea50286467de03176632 Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Sun, 22 Aug 2010 23:35:19 +0800
Subject: [PATCH 04/22] Add L2CAP_CID_A2MP_CHAN definition, it's fixed channel 3.
---
include/net/bluetooth/l2cap.h | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 39f8118..0d48e61 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -174,6 +174,7 @@ struct l2cap_conn_rsp {
/* channel indentifier */
#define L2CAP_CID_SIGNALING 0x0001
#define L2CAP_CID_CONN_LESS 0x0002
+#define L2CAP_CID_A2MP_CHAN 0x0003
#define L2CAP_CID_DYN_START 0x0040
#define L2CAP_CID_DYN_END 0xffff
--
1.6.3.3
^ permalink raw reply related
* [PATCH 03/22] Add eL2cap fixed channel bitmask definition
From: haijun liu @ 2010-08-25 22:29 UTC (permalink / raw)
To: linux-bluetooth
>From 7cee9cfecbe626a5671db96c30d4e60b69f0d191 Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Wed, 18 Aug 2010 22:34:56 +0800
Subject: [PATCH 03/22] Add eL2cap fixed channel bitmask definition.
---
include/net/bluetooth/l2cap.h | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 2e782d0..39f8118 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -105,6 +105,12 @@ struct l2cap_conninfo {
#define L2CAP_FEAT_UCDR 0x00000200
#define L2CAP_FEAT_RESERVED 0x80000000
+/* L2CAP fixed channel bitmask */
+#define L2CAP_FIXCHAN_NULLID 0x01
+#define L2CAP_FIXCHAN_SIG 0x02
+#define L2CAP_FIXCHAN_CL 0x04
+#define L2CAP_FIXCHAN_A2MP 0x08
+
/* L2CAP checksum option */
#define L2CAP_FCS_NONE 0x00
#define L2CAP_FCS_CRC16 0x01
--
1.6.3.3
^ permalink raw reply related
* [PATCH 02/22] Add eL2cap new features macro definition
From: haijun liu @ 2010-08-25 22:27 UTC (permalink / raw)
To: linux-bluetooth
>From fb2a4d17435dbd6d8787e6928c1da4f12a839265 Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Wed, 18 Aug 2010 22:33:22 +0800
Subject: [PATCH 02/22] Add eL2cap new features macro definition.
---
include/net/bluetooth/l2cap.h | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index bf0ea10..2e782d0 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -99,7 +99,11 @@ struct l2cap_conninfo {
#define L2CAP_FEAT_ERTM 0x00000008
#define L2CAP_FEAT_STREAMING 0x00000010
#define L2CAP_FEAT_FCS 0x00000020
+#define L2CAP_FEAT_EFS_BREDR 0x00000040
#define L2CAP_FEAT_FIXED_CHAN 0x00000080
+#define L2CAP_FEAT_EXT_WINSIZE 0x00000100
+#define L2CAP_FEAT_UCDR 0x00000200
+#define L2CAP_FEAT_RESERVED 0x80000000
/* L2CAP checksum option */
#define L2CAP_FCS_NONE 0x00
--
1.6.3.3
^ permalink raw reply related
* [PATCH 01/22] Add eL2cap signal macro definition
From: haijun liu @ 2010-08-25 22:22 UTC (permalink / raw)
To: linux-bluetooth
>From 0ce1315590e4bfe0d344acad7e770710833795aa Mon Sep 17 00:00:00 2001
From: haijun <haijun@haijun-laptop.(none)>
Date: Wed, 18 Aug 2010 22:26:19 +0800
Subject: [PATCH 01/22] Add eL2cap signal macro definition.
---
include/net/bluetooth/l2cap.h | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 7df70e4..bf0ea10 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -86,6 +86,12 @@ struct l2cap_conninfo {
#define L2CAP_ECHO_RSP 0x09
#define L2CAP_INFO_REQ 0x0a
#define L2CAP_INFO_RSP 0x0b
+#define L2CAP_CREATECHAN_REQ 0x0c
+#define L2CAP_CREATECHAN_RSP 0x0d
+#define L2CAP_MOVECHAN_REQ 0x0e
+#define L2CAP_MOVECHAN_RSP 0x0f
+#define L2CAP_MOVECHAN_CFM 0x10
+#define L2CAP_MOVECHAN_CFM_RSP 0x11
/* L2CAP feature mask */
#define L2CAP_FEAT_FLOWCTL 0x00000001
--
1.6.3.3
^ permalink raw reply related
* Re: bluetoothd does not check remote names for valid utf8 data
From: Johan Hedberg @ 2010-08-25 21:38 UTC (permalink / raw)
To: David Vrabel, Marcel Holtmann, linux-bluetooth
In-Reply-To: <20100825150323.GA28680@jh-x301>
Hi again,
On Wed, Aug 25, 2010, Johan Hedberg wrote:
> Good catch. At least the legacy name queries are already protected
> (remote_name_information function in security.c) so I think this is the only
> place missing the UTF-8 validation. However, your patch doesn't compile cleanly
> so some fine tuning is still needed (always check compilation with
> "./bootstrap-configure && make" before sending upstream):
>
> src/dbus-hci.c: In function ‘extract_eir_name’:
> src/dbus-hci.c:466: error: pointer targets in passing argument 1 of ‘g_utf8_validate’ differ in signedness
> /usr/include/glib-2.0/glib/gunicode.h:356: note: expected ‘const gchar *’ but argument is of type ‘uint8_t *’
> make[1]: *** [src/dbus-hci.o] Error 1
Since this was the only thing blocking a new release I went ahead and
fixed the issue myself. The (fixed) patch is now upstream.
Johan
^ permalink raw reply
* Re: 2.6.36-rc1 on zaurus: bluetooth regression
From: Maciej Rutecki @ 2010-08-25 18:55 UTC (permalink / raw)
To: Pavel Machek
Cc: rpurdie, lenz, kernel list, arminlitzel, Cyril Hrubis,
thommycheck, linux-arm-kernel, dbaryshkov, omegamoon, eric.y.miao,
utx, zaurus-devel, Rafael J. Wysocki, linux-bluetooth
In-Reply-To: <20100821152445.GA1536@ucw.cz>
On sobota, 21 sierpnia 2010 o 17:24:45 Pavel Machek wrote:
> Hi!
>
> Good news is that it boots, suspends and resumes.
>
> Bad news is that bluetooth broke for me. I'm using CF bluetooth
> card.
>
> Socket 0 Bridge: [pxa2xx-pcmcia] (bus ID: pxa2xx-pcmcia)
> Configuration: state: on ready: yes
> Voltage: 3.3V Vcc: 3.3V Vpp: 0.0V
> Socket 0 Device 0: [serial_cs] (bus ID: 0.0)
> Configuration: state: on
> Product Name: Compact Flash Bluetooth Card
> Identification: manf_id: 0x0279 card_id: 0x950b
> function: 2 (serial)
> prod_id(1): "Compact Flash" (0x95521410)
> prod_id(2): "Bluetooth Card" (0x7664fb1d)
> prod_id(3): --- (---)
> prod_id(4): --- (---)
> Socket 1 Bridge: [pxa2xx-pcmcia] (bus ID: pxa2xx-pcmcia)
> Configuration: state: on ready: yes
> Voltage: 3.3V Vcc: 3.3V Vpp: 0.0V
> Socket 1 Device 0: [ide-cs] (bus ID: 1.0)
> Configuration: state: on
> Product Name: HITACHI microdrive
> Identification: manf_id: 0x0319 card_id: 0x0000
> function: 4 (fixed disk)
> prod_id(1): "HITACHI" (0xf4f43949)
> prod_id(2): "microdrive" (0xa6d76178)
> prod_id(3): --- (---)
> prod_id(4): --- (---)
>
>
> In 2.6.35, I have lots of messages in the syslog, and speed is slow,
> but it works.
>
> Aug 19 08:01:06 toy kernel: bcsp_recv: Out-of-order packet arrived, got 3
> expected 2 Aug 19 08:01:06 toy kernel: bcsp_recv: Out-of-order packet
> arrived, got 4 expected 2 Aug 19 08:01:11 toy kernel: bcsp_recv: Short
> BCSP packet
> Aug 19 08:01:11 toy kernel: bcsp_recv: Out-of-order packet arrived, got 3
> expected 2 Aug 19 08:01:11 toy kernel: bcsp_recv: Out-of-order packet
> arrived, got 4 expected 2 Aug 19 08:01:12 toy kernel: bcsp_recv:
> Out-of-order packet arrived, got 5 expected 2 Aug 19 08:01:16 toy kernel:
> bcsp_recv: Short BCSP packet
> Aug 19 08:01:16 toy kernel: bcsp_recv: Out-of-order packet arrived, got 2
> expected 1 Aug 19 08:01:16 toy kernel: bcsp_recv: Out-of-order packet
> arrived, got 3 expected 1 Aug 19 08:01:16 toy kernel: bcsp_recv:
> Out-of-order packet arrived, got 4 expected 1
>
> In 2.6.36-rc1, I get:
>
> Aug 20 08:38:27 toy bluetoothd[1318]: HCI dev 0 down
> Aug 20 08:38:27 toy bluetoothd[1318]: Adapter /org/bluez/1318/hci0 has been
> disabled Aug 20 08:38:27 toy bluetoothd[1318]: Stopping security manager 0
> Aug 20 08:38:27 toy kernel: pcmcia_socket pcmcia_socket0: pccard: card
> ejected from slot 0 Aug 20 08:38:27 toy kernel: PM: Removing info for
> pcmcia:0.0
> Aug 20 08:38:27 toy kernel: PM: Removing info for No Bus:ttyS0
> Aug 20 08:38:27 toy bluetoothd[1318]: HCI dev 0 unregistered
> Aug 20 08:38:27 toy bluetoothd[1318]: Unregister path: /org/bluez/1318/hci0
> Aug 20 08:38:27 toy kernel: PM: Removing info for No Bus:hci0
> Aug 20 08:38:27 toy kernel: PM: Adding info for No Bus:ttyS0
> Aug 20 08:38:31 toy kernel: pcmcia_socket pcmcia_socket0: pccard: PCMCIA
> card inserted into slot 0 Aug 20 08:38:31 toy kernel: pcmcia 0.0: pcmcia:
> registering new device pcmcia0.0 (IRQ: 201) Aug 20 08:38:31 toy kernel:
> PM: Adding info for pcmcia:0.0
> Aug 20 08:38:31 toy kernel: PM: Removing info for No Bus:ttyS0
> Aug 20 08:38:31 toy kernel: 0.0: ttyS0 at I/O 0xc48402f8 (irq = 201) is a
> 16C950/954 Aug 20 08:38:31 toy kernel: PM: Adding info for No Bus:ttyS0
> Aug 20 08:38:36 toy bluetoothd[1318]: HCI dev 0 registered
> Aug 20 08:38:36 toy kernel: PM: Adding info for No Bus:hci0
> Aug 20 08:38:36 toy kernel: bcsp_recv: Out-of-order packet arrived, got 1
> expected 0 Aug 20 08:38:37 toy bluetoothd[1318]: accept: Socket operation
> on non-socket (88) Aug 20 08:38:37 toy bluetoothd[1318]: HCI dev 0 up
> Aug 20 08:38:37 toy bluetoothd[1318]: Starting security manager 0
> Aug 20 08:38:37 toy kernel: bcsp_recv: Short BCSP packet
> Aug 20 08:38:39 toy kernel: PM: Removing info for No Bus:rfcomm1
> Aug 20 08:38:39 toy kernel: PM: Adding info for No Bus:rfcomm1
> Aug 20 08:38:40 toy pand[1546]: Bluetooth PAN daemon version 4.66
> Aug 20 08:38:40 toy pand[1546]: Connecting to 00:21:BA:FF:2D:37
> Aug 20 08:38:40 toy kernel: hci_cmd_task: hci0 command tx timeout
> Aug 20 08:38:42 toy bluetoothd[1318]: Can't read version info for
> /org/bluez/1318/hci0: Connection timed out (110) Aug 20 08:38:44 toy
> modprobe: FATAL: Could not load /lib/modules/2.6.36-rc1/modules.dep: No
> such file or directory
>
> Any ideas?
> Pavel
I created a Bugzilla entry at
https://bugzilla.kernel.org/show_bug.cgi?id=17061
for your bug report, please add your address to the CC list in there, thanks!
--
Maciej Rutecki
http://www.maciek.unixy.pl
^ permalink raw reply
* Re: [PATCH v2 0/4] Fix error reporting for SDP Requests
From: Johan Hedberg @ 2010-08-25 17:11 UTC (permalink / raw)
To: Angela Bartholomaus; +Cc: linux-bluetooth, rshaffer, marcel
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Hi Angela,
On Wed, Aug 25, 2010, Angela Bartholomaus wrote:
> Fixed the following issues revealed while performing bluez qualification:
> - Incorrect error code was being reported for requests with invalid PDU size;
> - No error was being reported if a request less than 0x07 was received.
Thanks. All four patches have been pushed upstream.
Johan
^ permalink raw reply
* Re: [PATCH 1/5] Bluetooth: Only enable for L2CAP FCS for ERTM or streaming
From: Gustavo F. Padovan @ 2010-08-25 17:11 UTC (permalink / raw)
To: Mat Martineau; +Cc: linux-bluetooth, marcel, gustavo, rshaffer, linux-arm-msm
In-Reply-To: <1282689346-20371-2-git-send-email-mathewm@codeaurora.org>
Hi Mat,
* Mat Martineau <mathewm@codeaurora.org> [2010-08-24 15:35:42 -0700]:
> This fixes a bug which caused the FCS setting to show L2CAP_FCS_CRC16
> with L2CAP modes other than ERTM or streaming. At present, this only
> affects the FCS value shown with getsockopt() for basic mode.
>
> Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
> ---
> net/bluetooth/l2cap.c | 19 +++++++++++++------
> 1 files changed, 13 insertions(+), 6 deletions(-)
This one is on bluetooth-testing, but Marcel should move it to
bluetooth-2.6 as this patch is planned to go into 2.6.36
--
Gustavo F. Padovan
ProFUSION embedded systems - http://profusion.mobi
^ permalink raw reply
* [PATCH 4/4] Bluetooth: Send Invalid Syntax Error if Resp Size Less Than 0x07
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel, Angela Bartholomaus
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Byte cnt range min 0x07 per Core v2.1, sec 4.61 for TP/SERVER/SA/BI-02-C
---
src/sdpd-request.c | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index 8547939..205b27b 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -684,6 +684,15 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf)
SDPDBG("max_rsp_size : %d", max_rsp_size);
/*
+ * Check that max_rsp_size is within valid range
+ * a minimum size of 0x0007 has to be used for data field
+ */
+ if (max_rsp_size < 0x0007) {
+ status = SDP_INVALID_SYNTAX;
+ goto done;
+ }
+
+ /*
* Calculate Attribute size acording to MTU
* We can send only (MTU - sizeof(sdp_pdu_hdr_t) - sizeof(sdp_cont_state_t))
*/
--
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related
* [PATCH 3/4] Bluetooth: Send an Invalid PDU Size Error Resp for Service Attr Search Req
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel, Angela Bartholomaus
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SSA/BI-02-C
---
src/sdpd-request.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index ccbd920..8547939 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -818,7 +818,7 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf)
plen = ntohs(((sdp_pdu_hdr_t *)(req->buf))->plen);
if (plen < totscanned || plen != totscanned + *(uint8_t *)pdata) {
- status = SDP_INVALID_SYNTAX;
+ status = SDP_INVALID_PDU_SIZE;
goto done;
}
--
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related
* [PATCH 2/4] Bluetooth: Send an Invalid PDU Size Error Response for Service Attr Req
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel, Angela Bartholomaus
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SA/BI-03-C
---
src/sdpd-request.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index cc9fe82..ccbd920 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -667,7 +667,7 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf)
mlen = scanned + sizeof(uint32_t) + sizeof(uint16_t) + 1;
// ensure we don't read past buffer
if (plen < mlen || plen != mlen + *(uint8_t *)pdata) {
- status = SDP_INVALID_SYNTAX;
+ status = SDP_INVALID_PDU_SIZE;
goto done;
}
--
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related
* [PATCH 1/4] Bluetooth: Send an Invalid PDU Size Error Response for Service Search Req
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel, Angela Bartholomaus
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SS/BI-01-C
---
src/sdpd-request.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index d56ffc2..cc9fe82 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -367,7 +367,7 @@ static int service_search_req(sdp_req_t *req, sdp_buf_t *buf)
mlen = scanned + sizeof(uint16_t) + 1;
// ensure we don't read past buffer
if (plen < mlen || plen != mlen + *(uint8_t *)(pdata+sizeof(uint16_t))) {
- status = SDP_INVALID_SYNTAX;
+ status = SDP_INVALID_PDU_SIZE;
goto done;
}
--
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related
* [PATCH v2 0/4] Fix error reporting for SDP Requests
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel
Fixed the following issues revealed while performing bluez qualification:
- Incorrect error code was being reported for requests with invalid PDU size;
- No error was being reported if a request less than 0x07 was received.
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply
* Re: bluetoothd does not check remote names for valid utf8 data
From: Johan Hedberg @ 2010-08-25 15:03 UTC (permalink / raw)
To: David Vrabel; +Cc: Marcel Holtmann, linux-bluetooth
In-Reply-To: <4C75292E.9080304@csr.com>
Hi David,
On Wed, Aug 25, 2010, David Vrabel wrote:
> bluetoothd does not check in some (all?) places that the remote name
> reported by a device is valid utf8 data. e.g., extract_eir_name() in
> src/dbus-hci.c.
>
> The reception of an extended inquiry response containing a name with
> invalid utf8 data can cause the dbus interface to disappear. This is
> therefore a denial-of-service vulnerability (at the very least).
>
> The following patch fixes the above problem but there are probably other
> places where the check needs to be done.
>
> --- bluez-4.51.orig/src/dbus-hci.c
> +++ bluez-4.51/src/dbus-hci.c
> @@ -450,6 +450,8 @@
> switch (*type) {
> case 0x08:
> case 0x09:
> + if (!g_utf8_validate(data + 2, data[0] - 1, NULL))
> + return strdup("");
> return strndup((char *) (data + 2), data[0] - 1);
> }
Good catch. At least the legacy name queries are already protected
(remote_name_information function in security.c) so I think this is the only
place missing the UTF-8 validation. However, your patch doesn't compile cleanly
so some fine tuning is still needed (always check compilation with
"./bootstrap-configure && make" before sending upstream):
src/dbus-hci.c: In function ‘extract_eir_name’:
src/dbus-hci.c:466: error: pointer targets in passing argument 1 of ‘g_utf8_validate’ differ in signedness
/usr/include/glib-2.0/glib/gunicode.h:356: note: expected ‘const gchar *’ but argument is of type ‘uint8_t *’
make[1]: *** [src/dbus-hci.o] Error 1
After fixing that, could you prepare the patch through git format-patch so that
I can easily apply it using git am? Thanks.
Johan
^ permalink raw reply
* bluetoothd does not check remote names for valid utf8 data
From: David Vrabel @ 2010-08-25 14:31 UTC (permalink / raw)
To: Marcel Holtmann; +Cc: linux-bluetooth
Hi,
bluetoothd does not check in some (all?) places that the remote name
reported by a device is valid utf8 data. e.g., extract_eir_name() in
src/dbus-hci.c.
The reception of an extended inquiry response containing a name with
invalid utf8 data can cause the dbus interface to disappear. This is
therefore a denial-of-service vulnerability (at the very least).
The following patch fixes the above problem but there are probably other
places where the check needs to be done.
--- bluez-4.51.orig/src/dbus-hci.c
+++ bluez-4.51/src/dbus-hci.c
@@ -450,6 +450,8 @@
switch (*type) {
case 0x08:
case 0x09:
+ if (!g_utf8_validate(data + 2, data[0] - 1, NULL))
+ return strdup("");
return strndup((char *) (data + 2), data[0] - 1);
}
David
--
David Vrabel, Senior Software Engineer, Drivers
CSR, Churchill House, Cambridge Business Park, Tel: +44 (0)1223 692562
Cowley Road, Cambridge, CB4 0WZ http://www.csr.com/
Member of the CSR plc group of companies. CSR plc registered in England and Wales, registered number 4187346, registered office Churchill House, Cambridge Business Park, Cowley Road, Cambridge, CB4 0WZ, United Kingdom
^ permalink raw reply
* Re: [PATCH] No error message on interrupted syscall
From: Johan Hedberg @ 2010-08-25 13:29 UTC (permalink / raw)
To: Colin Didier; +Cc: linux-bluetooth
In-Reply-To: <20100825130749.GB7199@cybione.org>
Hi Colin,
On Wed, Aug 25, 2010, Colin Didier wrote:
> An interrupted syscall is not an error when returning from poll().
> ---
> audio/pcm_bluetooth.c | 6 ++++--
> 1 files changed, 4 insertions(+), 2 deletions(-)
This one has also been pushed upstream. Thanks.
Johan
^ permalink raw reply
* Re: [PATCH] Fix leftovers handling
From: Johan Hedberg @ 2010-08-25 13:28 UTC (permalink / raw)
To: Colin Didier; +Cc: linux-bluetooth
In-Reply-To: <20100825130607.GA7199@cybione.org>
Hi Colin,
On Wed, Aug 25, 2010, Colin Didier wrote:
> If for some reason there is not enough data provided to the function
> bluetooth_a2dp_write() and there are leftovers to handle, the ALSA
> module will segfault.
> ---
> audio/pcm_bluetooth.c | 8 ++++++--
> 1 files changed, 6 insertions(+), 2 deletions(-)
Thanks. This patch is now upstream.
Johan
^ permalink raw reply
* [PATCH] No error message on interrupted syscall
From: Colin Didier @ 2010-08-25 13:07 UTC (permalink / raw)
To: Johan Hedberg; +Cc: linux-bluetooth
In-Reply-To: <20100825112831.GB23943@jh-x301>
An interrupted syscall is not an error when returning from poll().
---
audio/pcm_bluetooth.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/audio/pcm_bluetooth.c b/audio/pcm_bluetooth.c
index ff463fe..799f17f 100644
--- a/audio/pcm_bluetooth.c
+++ b/audio/pcm_bluetooth.c
@@ -237,9 +237,11 @@ iter_sleep:
ret = poll(fds, 2, poll_timeout);
if (ret < 0) {
- SNDERR("poll error: %s (%d)", strerror(errno), errno);
- if (errno != EINTR)
+ if (errno != EINTR) {
+ SNDERR("poll error: %s (%d)", strerror(errno),
+ errno);
break;
+ }
} else if (ret > 0) {
ret = (fds[0].revents) ? 0 : 1;
SNDERR("poll fd %d revents %d", ret, fds[ret].revents);
--
1.7.1
^ permalink raw reply related
* [PATCH] Fix leftovers handling
From: Colin Didier @ 2010-08-25 13:06 UTC (permalink / raw)
To: Johan Hedberg; +Cc: linux-bluetooth
In-Reply-To: <20100825112636.GA23943@jh-x301>
If for some reason there is not enough data provided to the function
bluetooth_a2dp_write() and there are leftovers to handle, the ALSA
module will segfault.
---
audio/pcm_bluetooth.c | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/audio/pcm_bluetooth.c b/audio/pcm_bluetooth.c
index 4c0ab6f..ff463fe 100644
--- a/audio/pcm_bluetooth.c
+++ b/audio/pcm_bluetooth.c
@@ -1050,8 +1050,11 @@ static snd_pcm_sframes_t bluetooth_a2dp_write(snd_pcm_ioplug_t *io,
}
/* Check if we have any left over data from the last write */
- if (data->count > 0 && (bytes_left - data->count) >= a2dp->codesize) {
- int additional_bytes_needed = a2dp->codesize - data->count;
+ if (data->count > 0) {
+ unsigned int additional_bytes_needed =
+ a2dp->codesize - data->count;
+ if (additional_bytes_needed > bytes_left)
+ goto out;
memcpy(data->buffer + data->count, buff,
additional_bytes_needed);
@@ -1122,6 +1125,7 @@ static snd_pcm_sframes_t bluetooth_a2dp_write(snd_pcm_ioplug_t *io,
}
}
+out:
/* Copy the extra to our temp buffer for the next write */
if (bytes_left > 0) {
memcpy(data->buffer + data->count, buff, bytes_left);
--
1.7.1
^ permalink raw reply related
* Re: [PATCH] An interrupted syscall is not an error when returning from poll() in audio/pcm_bluetooth.c
From: Johan Hedberg @ 2010-08-25 11:28 UTC (permalink / raw)
To: Colin Didier; +Cc: linux-bluetooth
In-Reply-To: <20100825085454.GB27072@cybione.org>
Hi Colin,
On Wed, Aug 25, 2010, Colin Didier wrote:
> An interrupted syscall is not an error when returning from poll() at
> line 240 of audio/pcm_bluetooth.c. So no need to freak out.
>
> Here is a patch to fix this.
The patch itself seems fine, but the same comments apply for the commit
message as with your other patch. I.e. prepare with git format-patch and
make sure that you don't have overly long lines (e.g. the summary line
is much too long in this one).
Johan
^ permalink raw reply
* Re: [PATCH] Fix left overs handling in bluetooth_a2dp_write() of audio/pcm_bluetooth.c
From: Johan Hedberg @ 2010-08-25 11:26 UTC (permalink / raw)
To: Colin Didier; +Cc: linux-bluetooth
In-Reply-To: <20100825084932.GA27072@cybione.org>
Hi Colin,
On Wed, Aug 25, 2010, Colin Didier wrote:
> If for some reason there is not enough data provided to the function
> bluetooth_a2dp_write() and there are left overs to handle, the ALSA
> module will segfault.
>
> The test at the line 1053 of audio/pcm_bluetooth.c is wrong because it
> compares unsigned integers and will lead to an unsigned integer overflow
> if bytes_left is inferior to a2dp->codesize - data->count.
>
> Here is a patch to fix this issue.
Thanks for the patch, however it doesn't compile cleanly:
audio/pcm_bluetooth.c: In function ‘bluetooth_a2dp_write’:
audio/pcm_bluetooth.c:1055: error: comparison between signed and unsigned integer expressions
make[1]: *** [audio/audio_libasound_module_pcm_bluetooth_la-pcm_bluetooth.lo] Error 1
make: *** [all] Error 2
Always make sure that patches compile cleanly with
./bootstrap-configure. Also, could you please use git format-patch to
create the patches and make sure they have properly formated commit
messages (fits within an 80-column terminal with git log, not formated
like an email, etc). Thanks.
Johan
^ permalink raw reply
* [PATCH] An interrupted syscall is not an error when returning from poll() in audio/pcm_bluetooth.c
From: Colin Didier @ 2010-08-25 8:54 UTC (permalink / raw)
To: linux-bluetooth
Hello,
An interrupted syscall is not an error when returning from poll() at
line 240 of audio/pcm_bluetooth.c. So no need to freak out.
Here is a patch to fix this.
Cheers,
Colin DIDIER
--- a/audio/pcm_bluetooth.c 2010-08-25 10:08:37.000000000 +0200
+++ b/audio/pcm_bluetooth.c 2010-08-25 10:08:59.000000000 +0200
@@ -237,9 +237,11 @@
ret = poll(fds, 2, poll_timeout);
if (ret < 0) {
- SNDERR("poll error: %s (%d)", strerror(errno), errno);
- if (errno != EINTR)
+ if (errno != EINTR) {
+ SNDERR("poll error: %s (%d)", strerror(errno),
+ errno);
break;
+ }
} else if (ret > 0) {
ret = (fds[0].revents) ? 0 : 1;
SNDERR("poll fd %d revents %d", ret, fds[ret].revents);
^ permalink raw reply
* [PATCH] Fix left overs handling in bluetooth_a2dp_write() of audio/pcm_bluetooth.c
From: Colin Didier @ 2010-08-25 8:49 UTC (permalink / raw)
To: linux-bluetooth
Hello,
If for some reason there is not enough data provided to the function
bluetooth_a2dp_write() and there are left overs to handle, the ALSA
module will segfault.
The test at the line 1053 of audio/pcm_bluetooth.c is wrong because it
compares unsigned integers and will lead to an unsigned integer overflow
if bytes_left is inferior to a2dp->codesize - data->count.
Here is a patch to fix this issue.
Cheers,
Colin DIDIER
--- a/audio/pcm_bluetooth.c 2010-08-25 09:35:28.000000000 +0200
+++ b/audio/pcm_bluetooth.c 2010-08-25 09:37:47.000000000 +0200
@@ -1050,8 +1050,10 @@
}
/* Check if we have any left over data from the last write */
- if (data->count > 0 && (bytes_left - data->count) >= a2dp->codesize) {
- int additional_bytes_needed = a2dp->codesize - data->count;
+ if (data->count > 0) {
+ int additional_bytes_needed = a2dp->codesize - data->count;
+ if (additional_bytes_needed > bytes_left)
+ goto out;
memcpy(data->buffer + data->count, buff,
additional_bytes_needed);
@@ -1122,6 +1124,7 @@
}
}
+out:
/* Copy the extra to our temp buffer for the next write */
if (bytes_left > 0) {
memcpy(data->buffer + data->count, buff, bytes_left);
^ permalink raw reply
* Re: [RFCOMM] Cannot complete connections into Ubuntu
From: Luiz Augusto von Dentz @ 2010-08-25 3:00 UTC (permalink / raw)
To: Shreesh Holla; +Cc: linux-bluetooth
In-Reply-To: <131634.48135.qm@web56506.mail.re3.yahoo.com>
Hi,
On Mon, Aug 23, 2010 at 3:22 AM, Shreesh Holla <hshreesh@yahoo.com> wrote:
> Hi,
>
> I'm running Ubuntu with 2.6.32.24 kernel.
> I have a simple RFCOMM program running on Windows Mobile which would connect
> into the Ubuntu machine. Of course I have the corresponding service running on
> the Ubuntu machine. The RFCOMM port numbers do match up.
>
> This was working a few days back and now with no changes(i.e. the same
> executable), it refuses to work anymore.
>
> So is there some configuration needed now?
>
> I have the dongle running in Ubuntu as : hciconfig hci0 noauth noencrypt pscan
Had you tried the latest bluez, I did some changes to pair that solve
some problem with RFCOMM and ssp. If that doesn't help maybe you
should try to produce some logs of the so we can take a look.
Regards,
--
Luiz Augusto von Dentz
Computer Engineer
^ permalink raw reply
* Re: [PATCH 0/4] Fix error reporting for SDP Requests
From: Johan Hedberg @ 2010-08-24 23:15 UTC (permalink / raw)
To: angelab; +Cc: Marcel Holtmann, linux-bluetooth
In-Reply-To: <f5a72626c821919cb059a7efc6e7fb9f.squirrel@www.codeaurora.org>
Hi Angela,
On Tue, Aug 24, 2010, angelab@codeaurora.org wrote:
> Section 4.4 of the Bluetooth Corev2.1 spec, states that the error code
> shall be 0x04 when an invalid PDU size is received. BlueZ is returning
> error code 0x03 for the following:
> TP/SERVER/SS/BI-01-C [PATCH 1/4]
> TP/SERVER/SA/BI-03-C [PATCH 2/4]
> TP/SERVER/SSA/BI-02-C [PATCH 3/4]
>
> For this test case I sent a bad search attribute request where the max
> amount Of Attribute Data to return is 0, but blueZ fails to respond with
> an error code. The "max amount of attribute data" field has to be set to a
> minimum size of 0x0007 for the request to be valid.
> TP/SERVER/SA/BI-02-C [PATCH 4/4]
Ok, so it sounds like you're using your own test system for this? I
don't think Marcel was referring to what the spec says but what the BITE
tester test vectors require in practice. So far there haven't been any
issues with the BITE with respect to this. Of course it's good to not
just pass with the BITE but to also be consistent with the spec, and so
these patches seem like a good idea. However, could you resend them with
the test case reference in each commit message as well as any other
relevant info like the section in the core spec? Thanks.
Johan
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox