* [PATCH 09/22] Add candidate values for service type
From: haijun liu @ 2010-08-25 22:34 UTC (permalink / raw)
To: linux-bluetooth
>From 7e080dd0ad217e69b3abd614a981a861febbefa8 Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Sun, 22 Aug 2010 23:50:53 +0800
Subject: [PATCH 09/22] Add candidate values for service type.
---
include/net/bluetooth/l2cap.h | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 4bbc1ff..c609e04 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -256,6 +256,10 @@ struct l2cap_conf_efs {
#define L2CAP_MODE_ERTM 0x03
#define L2CAP_MODE_STREAMING 0x04
+#define L2CAP_SERVTYPE_NOTRAFIC 0x00
+#define L2CAP_SERVTYPE_BESTEFFORT 0x01
+#define L2CAP_SERVTYPE_GUARANTEED 0x02
+
struct l2cap_disconn_req {
__le16 dcid;
__le16 scid;
--
1.6.3.3
^ permalink raw reply related
* [PATCH 08/22] Add struct l2cap_conf_efs for configuration process
From: haijun liu @ 2010-08-25 22:33 UTC (permalink / raw)
To: linux-bluetooth
>From dc02dc170ea5bc4106e49307e57fafca57afbc9c Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Sun, 22 Aug 2010 23:49:37 +0800
Subject: [PATCH 08/22] Add struct l2cap_conf_efs for configuration process.
---
include/net/bluetooth/l2cap.h | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index a1931ae..4bbc1ff 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -241,6 +241,15 @@ struct l2cap_conf_rfc {
__le16 max_pdu_size;
} __attribute__ ((packed));
+struct l2cap_conf_efs {
+ __u8 id;
+ __u8 service_type;
+ __le16 max_sdu_size;
+ __le32 sdu_inter_time;
+ __le32 access_latency;
+ __le32 flush_timeout;
+} __attribute__ ((packed));
+
#define L2CAP_MODE_BASIC 0x00
#define L2CAP_MODE_RETRANS 0x01
#define L2CAP_MODE_FLOWCTL 0x02
--
1.6.3.3
^ permalink raw reply related
* [PATCH 07/22] Add a candidate value definition for flag of configuration response packet
From: haijun liu @ 2010-08-25 22:33 UTC (permalink / raw)
To: linux-bluetooth
>From 27541871ae9d3a2a510349bae155a63e8adf91f0 Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Sun, 22 Aug 2010 23:46:58 +0800
Subject: [PATCH 07/22] Add a candidate value definition for flag of
configuration response packet.
---
include/net/bluetooth/l2cap.h | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 9df9d70..a1931ae 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -210,6 +210,8 @@ struct l2cap_conf_rsp {
#define L2CAP_CONF_PENDING 0x0004
#define L2CAP_CONF_FLOWSPEC_REJECT 0x0005
+#define L2CAP_CONF_FLAG_CONT 0x0001
+
struct l2cap_conf_opt {
__u8 type;
__u8 len;
--
1.6.3.3
^ permalink raw reply related
* [PATCH 06/22] Add two new configuration status definition
From: haijun liu @ 2010-08-25 22:31 UTC (permalink / raw)
To: linux-bluetooth
>From 8bfa66f68795e697e23cf4efe8fa7d2d135c176c Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Sun, 22 Aug 2010 23:41:02 +0800
Subject: [PATCH 06/22] Add two new configuration status definition.
---
include/net/bluetooth/l2cap.h | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index fe95a63..9df9d70 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -207,6 +207,8 @@ struct l2cap_conf_rsp {
#define L2CAP_CONF_UNACCEPT 0x0001
#define L2CAP_CONF_REJECT 0x0002
#define L2CAP_CONF_UNKNOWN 0x0003
+#define L2CAP_CONF_PENDING 0x0004
+#define L2CAP_CONF_FLOWSPEC_REJECT 0x0005
struct l2cap_conf_opt {
__u8 type;
--
1.6.3.3
^ permalink raw reply related
* [PATCH 05/22] Add two new configuration items id of efs&wfs
From: haijun liu @ 2010-08-25 22:31 UTC (permalink / raw)
To: linux-bluetooth
>From b891acaee7f0b77daa2e3f1ba201c76604bf4594 Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Sun, 22 Aug 2010 23:39:40 +0800
Subject: [PATCH 05/22] Add two new configuration items id of efs&wfs.
---
include/net/bluetooth/l2cap.h | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 0d48e61..fe95a63 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -223,6 +223,8 @@ struct l2cap_conf_opt {
#define L2CAP_CONF_QOS 0x03
#define L2CAP_CONF_RFC 0x04
#define L2CAP_CONF_FCS 0x05
+#define L2CAP_CONF_EFS 0x06
+#define L2CAP_CONF_EWS 0x07
#define L2CAP_CONF_MAX_SIZE 22
--
1.6.3.3
^ permalink raw reply related
* [PATCH 04/22] Add L2CAP_CID_A2MP_CHAN definition, it's fixed channel 3
From: haijun liu @ 2010-08-25 22:30 UTC (permalink / raw)
To: linux-bluetooth
>From cfa4ccc6baa017ffb3deea50286467de03176632 Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Sun, 22 Aug 2010 23:35:19 +0800
Subject: [PATCH 04/22] Add L2CAP_CID_A2MP_CHAN definition, it's fixed channel 3.
---
include/net/bluetooth/l2cap.h | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 39f8118..0d48e61 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -174,6 +174,7 @@ struct l2cap_conn_rsp {
/* channel indentifier */
#define L2CAP_CID_SIGNALING 0x0001
#define L2CAP_CID_CONN_LESS 0x0002
+#define L2CAP_CID_A2MP_CHAN 0x0003
#define L2CAP_CID_DYN_START 0x0040
#define L2CAP_CID_DYN_END 0xffff
--
1.6.3.3
^ permalink raw reply related
* [PATCH 03/22] Add eL2cap fixed channel bitmask definition
From: haijun liu @ 2010-08-25 22:29 UTC (permalink / raw)
To: linux-bluetooth
>From 7cee9cfecbe626a5671db96c30d4e60b69f0d191 Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Wed, 18 Aug 2010 22:34:56 +0800
Subject: [PATCH 03/22] Add eL2cap fixed channel bitmask definition.
---
include/net/bluetooth/l2cap.h | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 2e782d0..39f8118 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -105,6 +105,12 @@ struct l2cap_conninfo {
#define L2CAP_FEAT_UCDR 0x00000200
#define L2CAP_FEAT_RESERVED 0x80000000
+/* L2CAP fixed channel bitmask */
+#define L2CAP_FIXCHAN_NULLID 0x01
+#define L2CAP_FIXCHAN_SIG 0x02
+#define L2CAP_FIXCHAN_CL 0x04
+#define L2CAP_FIXCHAN_A2MP 0x08
+
/* L2CAP checksum option */
#define L2CAP_FCS_NONE 0x00
#define L2CAP_FCS_CRC16 0x01
--
1.6.3.3
^ permalink raw reply related
* [PATCH 02/22] Add eL2cap new features macro definition
From: haijun liu @ 2010-08-25 22:27 UTC (permalink / raw)
To: linux-bluetooth
>From fb2a4d17435dbd6d8787e6928c1da4f12a839265 Mon Sep 17 00:00:00 2001
From: haijun.liu <haijun.liu@atheros.com>
Date: Wed, 18 Aug 2010 22:33:22 +0800
Subject: [PATCH 02/22] Add eL2cap new features macro definition.
---
include/net/bluetooth/l2cap.h | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index bf0ea10..2e782d0 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -99,7 +99,11 @@ struct l2cap_conninfo {
#define L2CAP_FEAT_ERTM 0x00000008
#define L2CAP_FEAT_STREAMING 0x00000010
#define L2CAP_FEAT_FCS 0x00000020
+#define L2CAP_FEAT_EFS_BREDR 0x00000040
#define L2CAP_FEAT_FIXED_CHAN 0x00000080
+#define L2CAP_FEAT_EXT_WINSIZE 0x00000100
+#define L2CAP_FEAT_UCDR 0x00000200
+#define L2CAP_FEAT_RESERVED 0x80000000
/* L2CAP checksum option */
#define L2CAP_FCS_NONE 0x00
--
1.6.3.3
^ permalink raw reply related
* [PATCH 01/22] Add eL2cap signal macro definition
From: haijun liu @ 2010-08-25 22:22 UTC (permalink / raw)
To: linux-bluetooth
>From 0ce1315590e4bfe0d344acad7e770710833795aa Mon Sep 17 00:00:00 2001
From: haijun <haijun@haijun-laptop.(none)>
Date: Wed, 18 Aug 2010 22:26:19 +0800
Subject: [PATCH 01/22] Add eL2cap signal macro definition.
---
include/net/bluetooth/l2cap.h | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 7df70e4..bf0ea10 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -86,6 +86,12 @@ struct l2cap_conninfo {
#define L2CAP_ECHO_RSP 0x09
#define L2CAP_INFO_REQ 0x0a
#define L2CAP_INFO_RSP 0x0b
+#define L2CAP_CREATECHAN_REQ 0x0c
+#define L2CAP_CREATECHAN_RSP 0x0d
+#define L2CAP_MOVECHAN_REQ 0x0e
+#define L2CAP_MOVECHAN_RSP 0x0f
+#define L2CAP_MOVECHAN_CFM 0x10
+#define L2CAP_MOVECHAN_CFM_RSP 0x11
/* L2CAP feature mask */
#define L2CAP_FEAT_FLOWCTL 0x00000001
--
1.6.3.3
^ permalink raw reply related
* Re: bluetoothd does not check remote names for valid utf8 data
From: Johan Hedberg @ 2010-08-25 21:38 UTC (permalink / raw)
To: David Vrabel, Marcel Holtmann, linux-bluetooth
In-Reply-To: <20100825150323.GA28680@jh-x301>
Hi again,
On Wed, Aug 25, 2010, Johan Hedberg wrote:
> Good catch. At least the legacy name queries are already protected
> (remote_name_information function in security.c) so I think this is the only
> place missing the UTF-8 validation. However, your patch doesn't compile cleanly
> so some fine tuning is still needed (always check compilation with
> "./bootstrap-configure && make" before sending upstream):
>
> src/dbus-hci.c: In function ‘extract_eir_name’:
> src/dbus-hci.c:466: error: pointer targets in passing argument 1 of ‘g_utf8_validate’ differ in signedness
> /usr/include/glib-2.0/glib/gunicode.h:356: note: expected ‘const gchar *’ but argument is of type ‘uint8_t *’
> make[1]: *** [src/dbus-hci.o] Error 1
Since this was the only thing blocking a new release I went ahead and
fixed the issue myself. The (fixed) patch is now upstream.
Johan
^ permalink raw reply
* Re: 2.6.36-rc1 on zaurus: bluetooth regression
From: Maciej Rutecki @ 2010-08-25 18:55 UTC (permalink / raw)
To: Pavel Machek
Cc: rpurdie, lenz, kernel list, arminlitzel, Cyril Hrubis,
thommycheck, linux-arm-kernel, dbaryshkov, omegamoon, eric.y.miao,
utx, zaurus-devel, Rafael J. Wysocki, linux-bluetooth
In-Reply-To: <20100821152445.GA1536@ucw.cz>
On sobota, 21 sierpnia 2010 o 17:24:45 Pavel Machek wrote:
> Hi!
>
> Good news is that it boots, suspends and resumes.
>
> Bad news is that bluetooth broke for me. I'm using CF bluetooth
> card.
>
> Socket 0 Bridge: [pxa2xx-pcmcia] (bus ID: pxa2xx-pcmcia)
> Configuration: state: on ready: yes
> Voltage: 3.3V Vcc: 3.3V Vpp: 0.0V
> Socket 0 Device 0: [serial_cs] (bus ID: 0.0)
> Configuration: state: on
> Product Name: Compact Flash Bluetooth Card
> Identification: manf_id: 0x0279 card_id: 0x950b
> function: 2 (serial)
> prod_id(1): "Compact Flash" (0x95521410)
> prod_id(2): "Bluetooth Card" (0x7664fb1d)
> prod_id(3): --- (---)
> prod_id(4): --- (---)
> Socket 1 Bridge: [pxa2xx-pcmcia] (bus ID: pxa2xx-pcmcia)
> Configuration: state: on ready: yes
> Voltage: 3.3V Vcc: 3.3V Vpp: 0.0V
> Socket 1 Device 0: [ide-cs] (bus ID: 1.0)
> Configuration: state: on
> Product Name: HITACHI microdrive
> Identification: manf_id: 0x0319 card_id: 0x0000
> function: 4 (fixed disk)
> prod_id(1): "HITACHI" (0xf4f43949)
> prod_id(2): "microdrive" (0xa6d76178)
> prod_id(3): --- (---)
> prod_id(4): --- (---)
>
>
> In 2.6.35, I have lots of messages in the syslog, and speed is slow,
> but it works.
>
> Aug 19 08:01:06 toy kernel: bcsp_recv: Out-of-order packet arrived, got 3
> expected 2 Aug 19 08:01:06 toy kernel: bcsp_recv: Out-of-order packet
> arrived, got 4 expected 2 Aug 19 08:01:11 toy kernel: bcsp_recv: Short
> BCSP packet
> Aug 19 08:01:11 toy kernel: bcsp_recv: Out-of-order packet arrived, got 3
> expected 2 Aug 19 08:01:11 toy kernel: bcsp_recv: Out-of-order packet
> arrived, got 4 expected 2 Aug 19 08:01:12 toy kernel: bcsp_recv:
> Out-of-order packet arrived, got 5 expected 2 Aug 19 08:01:16 toy kernel:
> bcsp_recv: Short BCSP packet
> Aug 19 08:01:16 toy kernel: bcsp_recv: Out-of-order packet arrived, got 2
> expected 1 Aug 19 08:01:16 toy kernel: bcsp_recv: Out-of-order packet
> arrived, got 3 expected 1 Aug 19 08:01:16 toy kernel: bcsp_recv:
> Out-of-order packet arrived, got 4 expected 1
>
> In 2.6.36-rc1, I get:
>
> Aug 20 08:38:27 toy bluetoothd[1318]: HCI dev 0 down
> Aug 20 08:38:27 toy bluetoothd[1318]: Adapter /org/bluez/1318/hci0 has been
> disabled Aug 20 08:38:27 toy bluetoothd[1318]: Stopping security manager 0
> Aug 20 08:38:27 toy kernel: pcmcia_socket pcmcia_socket0: pccard: card
> ejected from slot 0 Aug 20 08:38:27 toy kernel: PM: Removing info for
> pcmcia:0.0
> Aug 20 08:38:27 toy kernel: PM: Removing info for No Bus:ttyS0
> Aug 20 08:38:27 toy bluetoothd[1318]: HCI dev 0 unregistered
> Aug 20 08:38:27 toy bluetoothd[1318]: Unregister path: /org/bluez/1318/hci0
> Aug 20 08:38:27 toy kernel: PM: Removing info for No Bus:hci0
> Aug 20 08:38:27 toy kernel: PM: Adding info for No Bus:ttyS0
> Aug 20 08:38:31 toy kernel: pcmcia_socket pcmcia_socket0: pccard: PCMCIA
> card inserted into slot 0 Aug 20 08:38:31 toy kernel: pcmcia 0.0: pcmcia:
> registering new device pcmcia0.0 (IRQ: 201) Aug 20 08:38:31 toy kernel:
> PM: Adding info for pcmcia:0.0
> Aug 20 08:38:31 toy kernel: PM: Removing info for No Bus:ttyS0
> Aug 20 08:38:31 toy kernel: 0.0: ttyS0 at I/O 0xc48402f8 (irq = 201) is a
> 16C950/954 Aug 20 08:38:31 toy kernel: PM: Adding info for No Bus:ttyS0
> Aug 20 08:38:36 toy bluetoothd[1318]: HCI dev 0 registered
> Aug 20 08:38:36 toy kernel: PM: Adding info for No Bus:hci0
> Aug 20 08:38:36 toy kernel: bcsp_recv: Out-of-order packet arrived, got 1
> expected 0 Aug 20 08:38:37 toy bluetoothd[1318]: accept: Socket operation
> on non-socket (88) Aug 20 08:38:37 toy bluetoothd[1318]: HCI dev 0 up
> Aug 20 08:38:37 toy bluetoothd[1318]: Starting security manager 0
> Aug 20 08:38:37 toy kernel: bcsp_recv: Short BCSP packet
> Aug 20 08:38:39 toy kernel: PM: Removing info for No Bus:rfcomm1
> Aug 20 08:38:39 toy kernel: PM: Adding info for No Bus:rfcomm1
> Aug 20 08:38:40 toy pand[1546]: Bluetooth PAN daemon version 4.66
> Aug 20 08:38:40 toy pand[1546]: Connecting to 00:21:BA:FF:2D:37
> Aug 20 08:38:40 toy kernel: hci_cmd_task: hci0 command tx timeout
> Aug 20 08:38:42 toy bluetoothd[1318]: Can't read version info for
> /org/bluez/1318/hci0: Connection timed out (110) Aug 20 08:38:44 toy
> modprobe: FATAL: Could not load /lib/modules/2.6.36-rc1/modules.dep: No
> such file or directory
>
> Any ideas?
> Pavel
I created a Bugzilla entry at
https://bugzilla.kernel.org/show_bug.cgi?id=17061
for your bug report, please add your address to the CC list in there, thanks!
--
Maciej Rutecki
http://www.maciek.unixy.pl
^ permalink raw reply
* Re: [PATCH v2 0/4] Fix error reporting for SDP Requests
From: Johan Hedberg @ 2010-08-25 17:11 UTC (permalink / raw)
To: Angela Bartholomaus; +Cc: linux-bluetooth, rshaffer, marcel
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Hi Angela,
On Wed, Aug 25, 2010, Angela Bartholomaus wrote:
> Fixed the following issues revealed while performing bluez qualification:
> - Incorrect error code was being reported for requests with invalid PDU size;
> - No error was being reported if a request less than 0x07 was received.
Thanks. All four patches have been pushed upstream.
Johan
^ permalink raw reply
* Re: [PATCH 1/5] Bluetooth: Only enable for L2CAP FCS for ERTM or streaming
From: Gustavo F. Padovan @ 2010-08-25 17:11 UTC (permalink / raw)
To: Mat Martineau; +Cc: linux-bluetooth, marcel, gustavo, rshaffer, linux-arm-msm
In-Reply-To: <1282689346-20371-2-git-send-email-mathewm@codeaurora.org>
Hi Mat,
* Mat Martineau <mathewm@codeaurora.org> [2010-08-24 15:35:42 -0700]:
> This fixes a bug which caused the FCS setting to show L2CAP_FCS_CRC16
> with L2CAP modes other than ERTM or streaming. At present, this only
> affects the FCS value shown with getsockopt() for basic mode.
>
> Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
> ---
> net/bluetooth/l2cap.c | 19 +++++++++++++------
> 1 files changed, 13 insertions(+), 6 deletions(-)
This one is on bluetooth-testing, but Marcel should move it to
bluetooth-2.6 as this patch is planned to go into 2.6.36
--
Gustavo F. Padovan
ProFUSION embedded systems - http://profusion.mobi
^ permalink raw reply
* [PATCH 4/4] Bluetooth: Send Invalid Syntax Error if Resp Size Less Than 0x07
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel, Angela Bartholomaus
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Byte cnt range min 0x07 per Core v2.1, sec 4.61 for TP/SERVER/SA/BI-02-C
---
src/sdpd-request.c | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index 8547939..205b27b 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -684,6 +684,15 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf)
SDPDBG("max_rsp_size : %d", max_rsp_size);
/*
+ * Check that max_rsp_size is within valid range
+ * a minimum size of 0x0007 has to be used for data field
+ */
+ if (max_rsp_size < 0x0007) {
+ status = SDP_INVALID_SYNTAX;
+ goto done;
+ }
+
+ /*
* Calculate Attribute size acording to MTU
* We can send only (MTU - sizeof(sdp_pdu_hdr_t) - sizeof(sdp_cont_state_t))
*/
--
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related
* [PATCH 3/4] Bluetooth: Send an Invalid PDU Size Error Resp for Service Attr Search Req
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel, Angela Bartholomaus
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SSA/BI-02-C
---
src/sdpd-request.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index ccbd920..8547939 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -818,7 +818,7 @@ static int service_search_attr_req(sdp_req_t *req, sdp_buf_t *buf)
plen = ntohs(((sdp_pdu_hdr_t *)(req->buf))->plen);
if (plen < totscanned || plen != totscanned + *(uint8_t *)pdata) {
- status = SDP_INVALID_SYNTAX;
+ status = SDP_INVALID_PDU_SIZE;
goto done;
}
--
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related
* [PATCH 2/4] Bluetooth: Send an Invalid PDU Size Error Response for Service Attr Req
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel, Angela Bartholomaus
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SA/BI-03-C
---
src/sdpd-request.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index cc9fe82..ccbd920 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -667,7 +667,7 @@ static int service_attr_req(sdp_req_t *req, sdp_buf_t *buf)
mlen = scanned + sizeof(uint32_t) + sizeof(uint16_t) + 1;
// ensure we don't read past buffer
if (plen < mlen || plen != mlen + *(uint8_t *)pdata) {
- status = SDP_INVALID_SYNTAX;
+ status = SDP_INVALID_PDU_SIZE;
goto done;
}
--
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related
* [PATCH 1/4] Bluetooth: Send an Invalid PDU Size Error Response for Service Search Req
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel, Angela Bartholomaus
In-Reply-To: <1282755705-28400-1-git-send-email-angelab@codeaurora.org>
Send error code 0x04 per CoreSpecv2.1, sec 4.4 for TP/SERVER/SS/BI-01-C
---
src/sdpd-request.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/sdpd-request.c b/src/sdpd-request.c
index d56ffc2..cc9fe82 100644
--- a/src/sdpd-request.c
+++ b/src/sdpd-request.c
@@ -367,7 +367,7 @@ static int service_search_req(sdp_req_t *req, sdp_buf_t *buf)
mlen = scanned + sizeof(uint16_t) + 1;
// ensure we don't read past buffer
if (plen < mlen || plen != mlen + *(uint8_t *)(pdata+sizeof(uint16_t))) {
- status = SDP_INVALID_SYNTAX;
+ status = SDP_INVALID_PDU_SIZE;
goto done;
}
--
1.7.2.2
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related
* [PATCH v2 0/4] Fix error reporting for SDP Requests
From: Angela Bartholomaus @ 2010-08-25 17:01 UTC (permalink / raw)
To: linux-bluetooth; +Cc: rshaffer, johan.hedberg, marcel
Fixed the following issues revealed while performing bluez qualification:
- Incorrect error code was being reported for requests with invalid PDU size;
- No error was being reported if a request less than 0x07 was received.
--
Angela Bartholomaus
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply
* Re: bluetoothd does not check remote names for valid utf8 data
From: Johan Hedberg @ 2010-08-25 15:03 UTC (permalink / raw)
To: David Vrabel; +Cc: Marcel Holtmann, linux-bluetooth
In-Reply-To: <4C75292E.9080304@csr.com>
Hi David,
On Wed, Aug 25, 2010, David Vrabel wrote:
> bluetoothd does not check in some (all?) places that the remote name
> reported by a device is valid utf8 data. e.g., extract_eir_name() in
> src/dbus-hci.c.
>
> The reception of an extended inquiry response containing a name with
> invalid utf8 data can cause the dbus interface to disappear. This is
> therefore a denial-of-service vulnerability (at the very least).
>
> The following patch fixes the above problem but there are probably other
> places where the check needs to be done.
>
> --- bluez-4.51.orig/src/dbus-hci.c
> +++ bluez-4.51/src/dbus-hci.c
> @@ -450,6 +450,8 @@
> switch (*type) {
> case 0x08:
> case 0x09:
> + if (!g_utf8_validate(data + 2, data[0] - 1, NULL))
> + return strdup("");
> return strndup((char *) (data + 2), data[0] - 1);
> }
Good catch. At least the legacy name queries are already protected
(remote_name_information function in security.c) so I think this is the only
place missing the UTF-8 validation. However, your patch doesn't compile cleanly
so some fine tuning is still needed (always check compilation with
"./bootstrap-configure && make" before sending upstream):
src/dbus-hci.c: In function ‘extract_eir_name’:
src/dbus-hci.c:466: error: pointer targets in passing argument 1 of ‘g_utf8_validate’ differ in signedness
/usr/include/glib-2.0/glib/gunicode.h:356: note: expected ‘const gchar *’ but argument is of type ‘uint8_t *’
make[1]: *** [src/dbus-hci.o] Error 1
After fixing that, could you prepare the patch through git format-patch so that
I can easily apply it using git am? Thanks.
Johan
^ permalink raw reply
* bluetoothd does not check remote names for valid utf8 data
From: David Vrabel @ 2010-08-25 14:31 UTC (permalink / raw)
To: Marcel Holtmann; +Cc: linux-bluetooth
Hi,
bluetoothd does not check in some (all?) places that the remote name
reported by a device is valid utf8 data. e.g., extract_eir_name() in
src/dbus-hci.c.
The reception of an extended inquiry response containing a name with
invalid utf8 data can cause the dbus interface to disappear. This is
therefore a denial-of-service vulnerability (at the very least).
The following patch fixes the above problem but there are probably other
places where the check needs to be done.
--- bluez-4.51.orig/src/dbus-hci.c
+++ bluez-4.51/src/dbus-hci.c
@@ -450,6 +450,8 @@
switch (*type) {
case 0x08:
case 0x09:
+ if (!g_utf8_validate(data + 2, data[0] - 1, NULL))
+ return strdup("");
return strndup((char *) (data + 2), data[0] - 1);
}
David
--
David Vrabel, Senior Software Engineer, Drivers
CSR, Churchill House, Cambridge Business Park, Tel: +44 (0)1223 692562
Cowley Road, Cambridge, CB4 0WZ http://www.csr.com/
Member of the CSR plc group of companies. CSR plc registered in England and Wales, registered number 4187346, registered office Churchill House, Cambridge Business Park, Cowley Road, Cambridge, CB4 0WZ, United Kingdom
^ permalink raw reply
* Re: [PATCH] No error message on interrupted syscall
From: Johan Hedberg @ 2010-08-25 13:29 UTC (permalink / raw)
To: Colin Didier; +Cc: linux-bluetooth
In-Reply-To: <20100825130749.GB7199@cybione.org>
Hi Colin,
On Wed, Aug 25, 2010, Colin Didier wrote:
> An interrupted syscall is not an error when returning from poll().
> ---
> audio/pcm_bluetooth.c | 6 ++++--
> 1 files changed, 4 insertions(+), 2 deletions(-)
This one has also been pushed upstream. Thanks.
Johan
^ permalink raw reply
* Re: [PATCH] Fix leftovers handling
From: Johan Hedberg @ 2010-08-25 13:28 UTC (permalink / raw)
To: Colin Didier; +Cc: linux-bluetooth
In-Reply-To: <20100825130607.GA7199@cybione.org>
Hi Colin,
On Wed, Aug 25, 2010, Colin Didier wrote:
> If for some reason there is not enough data provided to the function
> bluetooth_a2dp_write() and there are leftovers to handle, the ALSA
> module will segfault.
> ---
> audio/pcm_bluetooth.c | 8 ++++++--
> 1 files changed, 6 insertions(+), 2 deletions(-)
Thanks. This patch is now upstream.
Johan
^ permalink raw reply
* [PATCH] No error message on interrupted syscall
From: Colin Didier @ 2010-08-25 13:07 UTC (permalink / raw)
To: Johan Hedberg; +Cc: linux-bluetooth
In-Reply-To: <20100825112831.GB23943@jh-x301>
An interrupted syscall is not an error when returning from poll().
---
audio/pcm_bluetooth.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/audio/pcm_bluetooth.c b/audio/pcm_bluetooth.c
index ff463fe..799f17f 100644
--- a/audio/pcm_bluetooth.c
+++ b/audio/pcm_bluetooth.c
@@ -237,9 +237,11 @@ iter_sleep:
ret = poll(fds, 2, poll_timeout);
if (ret < 0) {
- SNDERR("poll error: %s (%d)", strerror(errno), errno);
- if (errno != EINTR)
+ if (errno != EINTR) {
+ SNDERR("poll error: %s (%d)", strerror(errno),
+ errno);
break;
+ }
} else if (ret > 0) {
ret = (fds[0].revents) ? 0 : 1;
SNDERR("poll fd %d revents %d", ret, fds[ret].revents);
--
1.7.1
^ permalink raw reply related
* [PATCH] Fix leftovers handling
From: Colin Didier @ 2010-08-25 13:06 UTC (permalink / raw)
To: Johan Hedberg; +Cc: linux-bluetooth
In-Reply-To: <20100825112636.GA23943@jh-x301>
If for some reason there is not enough data provided to the function
bluetooth_a2dp_write() and there are leftovers to handle, the ALSA
module will segfault.
---
audio/pcm_bluetooth.c | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/audio/pcm_bluetooth.c b/audio/pcm_bluetooth.c
index 4c0ab6f..ff463fe 100644
--- a/audio/pcm_bluetooth.c
+++ b/audio/pcm_bluetooth.c
@@ -1050,8 +1050,11 @@ static snd_pcm_sframes_t bluetooth_a2dp_write(snd_pcm_ioplug_t *io,
}
/* Check if we have any left over data from the last write */
- if (data->count > 0 && (bytes_left - data->count) >= a2dp->codesize) {
- int additional_bytes_needed = a2dp->codesize - data->count;
+ if (data->count > 0) {
+ unsigned int additional_bytes_needed =
+ a2dp->codesize - data->count;
+ if (additional_bytes_needed > bytes_left)
+ goto out;
memcpy(data->buffer + data->count, buff,
additional_bytes_needed);
@@ -1122,6 +1125,7 @@ static snd_pcm_sframes_t bluetooth_a2dp_write(snd_pcm_ioplug_t *io,
}
}
+out:
/* Copy the extra to our temp buffer for the next write */
if (bytes_left > 0) {
memcpy(data->buffer + data->count, buff, bytes_left);
--
1.7.1
^ permalink raw reply related
* Re: [PATCH] An interrupted syscall is not an error when returning from poll() in audio/pcm_bluetooth.c
From: Johan Hedberg @ 2010-08-25 11:28 UTC (permalink / raw)
To: Colin Didier; +Cc: linux-bluetooth
In-Reply-To: <20100825085454.GB27072@cybione.org>
Hi Colin,
On Wed, Aug 25, 2010, Colin Didier wrote:
> An interrupted syscall is not an error when returning from poll() at
> line 240 of audio/pcm_bluetooth.c. So no need to freak out.
>
> Here is a patch to fix this.
The patch itself seems fine, but the same comments apply for the commit
message as with your other patch. I.e. prepare with git format-patch and
make sure that you don't have overly long lines (e.g. the summary line
is much too long in this one).
Johan
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox