linux-kernel - Regression caused by "Bluetooth: Map sec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <yunboy7a2so.fsf@aiko.keithp.com>
Date:	Thu, 09 Jun 2011 00:20:55 -0700
From:	"Keith Packard" <keithp@...thp.com>
To:	"Gustavo F. Padovan" <padovan@...fusion.mobi>,
	Waldemar Rymarkiewicz <waldemar.rymarkiewicz@...to.com>
cc:	Marcel Holtmann <marcel@...tmann.org>,
	linux-bluetooth@...r.kernel.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Regression caused by "Bluetooth: Map sec_level to link key requirements"


Patch 13d39315c22b128f4796fc008b04914a7c32bb1a is causing a regression
From 2.6.39. I cannot communicate with my Nokia N900 using either the
SyncML or DUN RFCOMM services.  I get a connection reset error shortly
after startup.

I've reverted this patch on top of something past -rc2 (to be precise,
I'm branching from ef2398019b305827ea7130ebaf7bf521b444530e).
With the following fix-up to make things build again, my bluetooth works
again.

From 9774a1309ef662308c6ffb7db160788f6e2b5e35 Mon Sep 17 00:00:00 2001
From: Keith Packard <keithp@...thp.com>
Date: Thu, 9 Jun 2011 00:11:33 -0700
Subject: [PATCH 2/2] net/bluetooth: Clean up revert of 13d39315c22b128f4796fc008b04914a7c32bb1a.

This removes lingering references to key_type and makes the code work
like it did before the offending commit.

Signed-off-by: Keith Packard <keithp@...thp.com>
---
 net/bluetooth/hci_conn.c    |   17 -----------------
 net/bluetooth/hci_core.c    |    4 +---
 net/bluetooth/hci_event.c   |    1 -
 net/bluetooth/rfcomm/core.c |    2 +-
 4 files changed, 2 insertions(+), 22 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 25c4ea0..de3a4c0 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -582,23 +582,6 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 }
 EXPORT_SYMBOL(hci_conn_security);
 
-/* Check secure link requirement */
-int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
-{
-	BT_DBG("conn %p", conn);
-
-	if (sec_level != BT_SECURITY_HIGH)
-		return 1; /* Accept if non-secure is required */
-
-	if (conn->key_type == HCI_LK_AUTH_COMBINATION ||
-			(conn->key_type == HCI_LK_COMBINATION &&
-			conn->pin_length == 16))
-		return 1;
-
-	return 0; /* Reject not secure link */
-}
-EXPORT_SYMBOL(hci_conn_check_secure);
-
 /* Change link key */
 int hci_conn_change_link_key(struct hci_conn *conn)
 {
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 815269b..47dff20 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1067,7 +1067,7 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 		old_key_type = old_key->type;
 		key = old_key;
 	} else {
-		old_key_type = conn ? conn->key_type : 0xff;
+		old_key_type = 0xff;
 		key = kzalloc(sizeof(*key), GFP_ATOMIC);
 		if (!key)
 			return -ENOMEM;
@@ -1083,8 +1083,6 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 					(!conn || conn->remote_auth == 0xff) &&
 					old_key_type == 0xff) {
 		type = HCI_LK_COMBINATION;
-		if (conn)
-			conn->key_type = type;
 	}
 
 	bacpy(&key->bdaddr, bdaddr);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index a61ca11..b57b971 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2095,7 +2095,6 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
 			goto not_found;
 		}
 
-		conn->key_type = key->type;
 		conn->pin_length = key->pin_len;
 	}
 
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 5759bb7..121a5c1 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2096,7 +2096,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
 		if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
 			continue;
 
-		if (!status && hci_conn_check_secure(conn, d->sec_level))
+		if (!status)
 			set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
 		else
 			set_bit(RFCOMM_AUTH_REJECT, &d->flags);
-- 
1.7.5.3

-- 
keith.packard@...el.com

Content of type "application/pgp-signature" skipped