Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cd41a24a authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Greg Kroah-Hartman
Browse files

Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ 

[ Upstream commit 806a5198c05987b748b50f3d0c0cfb3d417381a4 ]

This removes the bogus check for max > hcon->le_conn_max_interval since
the later is just the initial maximum conn interval not the maximum the
stack could support which is really 3200=4000ms.

In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values
of the following fields in IXIT that would cause hci_check_conn_params
to fail:

TSPX_conn_update_int_min
TSPX_conn_update_int_max
TSPX_conn_update_peripheral_latency
TSPX_conn_update_supervision_timeout

Link: https://github.com/bluez/bluez/issues/847


Fixes: e4b019515f95 ("Bluetooth: Enforce validation on max value of connection interval")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 860abda3

include/net/bluetooth/hci_core.h

+32 −4
Original line number Diff line number Diff line
@@ -1451,18 +1451,46 @@ static inline int hci_check_conn_params(u16 min, u16 max, u16 latency, 
{

	u16 max_latency;



	if (min > max || min < 6 || max > 3200)

	if (min > max) {

		BT_WARN("min %d > max %d", min, max);

		return -EINVAL;

	}



	if (min < 6) {

		BT_WARN("min %d < 6", min);

		return -EINVAL;

	}



	if (max > 3200) {

		BT_WARN("max %d > 3200", max);

		return -EINVAL;

	}



	if (to_multiplier < 10) {

		BT_WARN("to_multiplier %d < 10", to_multiplier);

		return -EINVAL;

	}



	if (to_multiplier < 10 || to_multiplier > 3200)

	if (to_multiplier > 3200) {

		BT_WARN("to_multiplier %d > 3200", to_multiplier);

		return -EINVAL;

	}



	if (max >= to_multiplier * 8)

	if (max >= to_multiplier * 8) {

		BT_WARN("max %d >= to_multiplier %d * 8", max, to_multiplier);

		return -EINVAL;

	}



	max_latency = (to_multiplier * 4 / max) - 1;

	if (latency > 499 || latency > max_latency)

	if (latency > 499) {

		BT_WARN("latency %d > 499", latency);

		return -EINVAL;

	}



	if (latency > max_latency) {

		BT_WARN("latency %d > max_latency %d", latency, max_latency);

		return -EINVAL;

	}



	return 0;

}

net/bluetooth/l2cap_core.c

+1 −7
Original line number Diff line number Diff line
@@ -5334,13 +5334,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, 


	memset(&rsp, 0, sizeof(rsp));



	if (max > hcon->le_conn_max_interval) {

		BT_DBG("requested connection interval exceeds current bounds.");

		err = -EINVAL;

	} else {

	err = hci_check_conn_params(min, max, latency, to_multiplier);

	}



	if (err)

		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);

	else