[v1] Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ

Commit Message

Luiz Augusto von Dentz May 20, 2024, 8:10 p.m. UTC

From: Luiz Augusto von Dentz <[e-mail]>

This removes the bogus check for max > hcon->le_conn_max_interval since
the later is just the initial maximum conn interval not the maximum the
stack could support which is really 3200=4000ms.

In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values
of the following fields in IXIT that would cause hci_check_conn_params
to fail:

TSPX_conn_update_int_min
TSPX_conn_update_int_max
TSPX_conn_update_peripheral_latency
TSPX_conn_update_supervision_timeout

Link: https://github.com/bluez/bluez/issues/847
Fixes: e4b019515f95 ("Bluetooth: Enforce validation on max value of connection interval")
Signed-off-by: Luiz Augusto von Dentz <[e-mail]>
---
 net/bluetooth/l2cap_core.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

Comments

[e-mail] May 20, 2024, 8:43 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=854501

---Test result---

Test Summary:
CheckPatch                    PASS      0.68 seconds
GitLint                       PASS      0.33 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      29.82 seconds
CheckAllWarning               PASS      32.69 seconds
CheckSparse                   PASS      38.48 seconds
CheckSmatch                   FAIL      35.08 seconds
BuildKernel32                 PASS      28.84 seconds
TestRunnerSetup               PASS      527.11 seconds
TestRunner_l2cap-tester       PASS      24.49 seconds
TestRunner_iso-tester         FAIL      32.53 seconds
TestRunner_bnep-tester        PASS      4.68 seconds
TestRunner_mgmt-tester        PASS      110.10 seconds
TestRunner_rfcomm-tester      PASS      7.30 seconds
TestRunner_sco-tester         PASS      14.93 seconds
TestRunner_ioctl-tester       PASS      7.78 seconds
TestRunner_mesh-tester        PASS      6.02 seconds
TestRunner_smp-tester         PASS      6.81 seconds
TestRunner_userchan-tester    PASS      4.95 seconds
IncrementalBuild              PASS      27.92 seconds

Details
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:

Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
Total: 122, Passed: 117 (95.9%), Failed: 1, Not Run: 4

Failed Test Cases
ISO Connect Suspend - Success                        Failed       4.176 seconds


---
Regards,
Linux Bluetooth

Luiz Augusto von Dentz May 20, 2024, 8:48 p.m. UTC | #2

Hi Kai,

On Mon, May 20, 2024 at 4:10 PM Luiz Augusto von Dentz
<[e-mail]> wrote:
>
> From: Luiz Augusto von Dentz <[e-mail]>
>
> This removes the bogus check for max > hcon->le_conn_max_interval since
> the later is just the initial maximum conn interval not the maximum the
> stack could support which is really 3200=4000ms.
>
> In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values
> of the following fields in IXIT that would cause hci_check_conn_params
> to fail:
>
> TSPX_conn_update_int_min
> TSPX_conn_update_int_max
> TSPX_conn_update_peripheral_latency
> TSPX_conn_update_supervision_timeout
>
> Link: https://github.com/bluez/bluez/issues/847
> Fixes: e4b019515f95 ("Bluetooth: Enforce validation on max value of connection interval")
> Signed-off-by: Luiz Augusto von Dentz <[e-mail]>
> ---
>  net/bluetooth/l2cap_core.c | 8 +-------
>  1 file changed, 1 insertion(+), 7 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 5b509b767557..c49e0d4b3c0d 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4647,13 +4647,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
>
>         memset(&rsp, 0, sizeof(rsp));
>
> -       if (max > hcon->le_conn_max_interval) {
> -               BT_DBG("requested connection interval exceeds current bounds.");
> -               err = -EINVAL;
> -       } else {
> -               err = hci_check_conn_params(min, max, latency, to_multiplier);
> -       }
> -
> +       err = hci_check_conn_params(min, max, latency, to_multiplier);
>         if (err)
>                 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
>         else
> --
> 2.45.1

I hope that doesn't break the testing you have done, you should really
be setting the invalid values with use of the fields about and not use
hcon->le_conn_max_interval as upper limit of the stack, for more
details check the discussion at
https://github.com/bluez/bluez/issues/847.

Patch

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 5b509b767557..c49e0d4b3c0d 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4647,13 +4647,7 @@  static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
 
 	memset(&rsp, 0, sizeof(rsp));
 
-	if (max > hcon->le_conn_max_interval) {
-		BT_DBG("requested connection interval exceeds current bounds.");
-		err = -EINVAL;
-	} else {
-		err = hci_check_conn_params(min, max, latency, to_multiplier);
-	}
-
+	err = hci_check_conn_params(min, max, latency, to_multiplier);
 	if (err)
 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
 	else