linux-kernel - Re: [PATCH] Bluetooth: Add SCO fallback for invalid LMP parameters error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 18 May 2020 10:01:13 +0200
From:   Marcel Holtmann <marcel@...tmann.org>
To:     Hsin-Yu Chao <hychao@...omium.org>
Cc:     linux-bluetooth@...r.kernel.org,
        chromeos-bluetooth-upstreaming@...omium.org, alainm@...omium.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Bluetooth: Add SCO fallback for invalid LMP parameters
 error

Hi Hsin-Yu,

> Bluetooth PTS test case HFP/AG/ACC/BI-12-I accepts SCO connection
> with invalid parameter at the first SCO request expecting AG to
> attempt another SCO request with the use of "safe settings" for
> given codec, base on section 5.7.1.2 of HFP 1.7 specification.
> 
> This patch addresses it by adding "Invalid LMP Parameters" (0x1e)
> to the SCO fallback case. Verified with below log:
> 
> < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
>        Handle: 256
>        Transmit bandwidth: 8000
>        Receive bandwidth: 8000
>        Max latency: 13
>        Setting: 0x0003
>          Input Coding: Linear
>          Input Data Format: 1's complement
>          Input Sample Size: 8-bit
>          # of bits padding at MSB: 0
>          Air Coding Format: Transparent Data
>        Retransmission effort: Optimize for link quality (0x02)
>        Packet type: 0x0380
>          3-EV3 may not be used
>          2-EV5 may not be used
>          3-EV5 may not be used
>> HCI Event: Command Status (0x0f) plen 4
>      Setup Synchronous Connection (0x01|0x0028) ncmd 1
>        Status: Success (0x00)
>> HCI Event: Number of Completed Packets (0x13) plen 5
>        Num handles: 1
>        Handle: 256
>        Count: 1
>> HCI Event: Max Slots Change (0x1b) plen 3
>        Handle: 256
>        Max slots: 1
>> HCI Event: Synchronous Connect Complete (0x2c) plen 17
>        Status: Invalid LMP Parameters / Invalid LL Parameters (0x1e)
>        Handle: 0
>        Address: 00:1B:DC:F2:21:59 (OUI 00-1B-DC)
>        Link type: eSCO (0x02)
>        Transmission interval: 0x00
>        Retransmission window: 0x02
>        RX packet length: 0
>        TX packet length: 0
>        Air mode: Transparent (0x03)
> < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
>        Handle: 256
>        Transmit bandwidth: 8000
>        Receive bandwidth: 8000
>        Max latency: 8
>        Setting: 0x0003
>          Input Coding: Linear
>          Input Data Format: 1's complement
>          Input Sample Size: 8-bit
>          # of bits padding at MSB: 0
>          Air Coding Format: Transparent Data
>        Retransmission effort: Optimize for link quality (0x02)
>        Packet type: 0x03c8
>          EV3 may be used
>          2-EV3 may not be used
>          3-EV3 may not be used
>          2-EV5 may not be used
>          3-EV5 may not be used
>> HCI Event: Command Status (0x0f) plen 4
>      Setup Synchronous Connection (0x01|0x0028) ncmd 1
>        Status: Success (0x00)
>> HCI Event: Max Slots Change (0x1b) plen 3
>        Handle: 256
>        Max slots: 5
>> HCI Event: Max Slots Change (0x1b) plen 3
>        Handle: 256
>        Max slots: 1
>> HCI Event: Synchronous Connect Complete (0x2c) plen 17
>        Status: Success (0x00)
>        Handle: 257
>        Address: 00:1B:DC:F2:21:59 (OUI 00-1B-DC)
>        Link type: eSCO (0x02)
>        Transmission interval: 0x06
>        Retransmission window: 0x04
>        RX packet length: 30
>        TX packet length: 30
>        Air mode: Transparent (0x03)
> 
> Signed-off-by: Hsin-Yu Chao <hychao@...omium.org>
> ---
> net/bluetooth/hci_event.c | 1 +
> 1 file changed, 1 insertion(+)

patch has been applied to bluetooth-next tree.

Regards

Marcel