Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 065a13e2 authored by Johan Hedberg's avatar Johan Hedberg Committed by Gustavo Padovan
Browse files

Bluetooth: SMP: Fix setting unknown auth_req bits 



When sending a pairing request or response we should not just blindly
copy the value that the remote device sent. Instead we should at least
make sure to mask out any unknown bits. This is particularly critical
from the upcoming LE Secure Connections feature perspective as
incorrectly indicating support for it (by copying the remote value)
would cause a failure to pair with devices that support it.

Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
Cc: stable@kernel.org
Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
parent a7be50b7

net/bluetooth/smp.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -32,6 +32,8 @@ 




#define SMP_TIMEOUT	msecs_to_jiffies(30000)

#define SMP_TIMEOUT	msecs_to_jiffies(30000)





#define AUTH_REQ_MASK   0x07



static inline void swap128(u8 src[16], u8 dst[16])

static inline void swap128(u8 src[16], u8 dst[16])

{

{

	int i;

	int i;
@@ -230,7 +232,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn, 
		req->max_key_size = SMP_MAX_ENC_KEY_SIZE;

		req->max_key_size = SMP_MAX_ENC_KEY_SIZE;

		req->init_key_dist = 0;

		req->init_key_dist = 0;

		req->resp_key_dist = dist_keys;

		req->resp_key_dist = dist_keys;

		req->auth_req = authreq;

		req->auth_req = (authreq & AUTH_REQ_MASK);

		return;

		return;

	}

	}
@@ -239,7 +241,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn, 
	rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;

	rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;

	rsp->init_key_dist = 0;

	rsp->init_key_dist = 0;

	rsp->resp_key_dist = req->resp_key_dist & dist_keys;

	rsp->resp_key_dist = req->resp_key_dist & dist_keys;

	rsp->auth_req = authreq;

	rsp->auth_req = (authreq & AUTH_REQ_MASK);

}

}





static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)

static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)