[<prev] [next>] [day] [month] [year] [list]
Message-ID: <780d3461-a920-4f44-8d32-06bcb3988cea@buaa.edu.cn>
Date: Wed, 15 Nov 2023 16:14:56 +0800
From: Si-Jie Bai <sy2239101@...a.edu.cn>
To: marcel@...tmann.org, johan.hedberg@...il.com, luiz.dentz@...il.com,
davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com
Cc: baijiaju1990@...il.com, 20373622@...a.edu.cn, zhenghaoran@...a.edu.cn,
linux-bluetooth@...r.kernel.org, linux-kernel@...r.kernel.org,
netdev@...r.kernel.org
Subject: [BUG]Bluetooth: possible semantic bug when HCI_Command_Status event
triggered without prior HCI_Inquiry command
Hello,
Our fuzzing tool finds a possible semantic bug in the Bluetooth system
in Linux 6.2:
According to the core specification v5.4, the HCI_Inquiry command
triggers the BR/EDR Controller to enter Inquiry Mode, a process used for
discovering nearby BR/EDR Controllers. Furthermore, it is specified that
an HCI_Command_Status event should be sent to the Host when the BR/EDR
Controller has started the Inquiry process.
In our testing, if a related HCI_Command_Status event is sent by the
controller without a preceding HCI_Inquiry command from the host, this
could lead to a failure in establishing Bluetooth connections.
Through our examination and debugging of the Linux 6.2 source code, we
have identified the underlying cause of the observed phenomenon:
(1.1) When the HCI_Command_Status event related to the HCI_Inquiry
command is received, the function hci_cs_inquiry
(/net/bluetooth/hci_event.c:2289) is called.
(1.2) This leads to the execution of set_bit(HCI_INQUIRY, &hdev->flags);
(/net/bluetooth/hci_event.c:2298).
(2.1) Upon initiating an ACL connection for the first time, the function
hci_acl_create_connection (/net/bluetooth/hci_conn.c:212) is called.
(2.2) The result of test_bit(HCI_INQUIRY, &hdev->flags)
(/net/bluetooth/hci_conn.c:228) being true causes the connection's state
to change to BT_CONNECT2, and the HCI_Inquiry_Cancel command is sent.
(3.1) When the HCI_Command_Complete event related to the
HCI_Inquiry_Cancel command is received, the function
hci_cc_inquiry_cancel (/net/bluetooth/hci_event.c:84) is called.
(3.2) The Status field of the HCI_Command_Complete event being 0x0c
results in the execution of return rp->status;
(/net/bluetooth/hci_event.c:104).
(4.1) A timeout triggers hci_conn_timeout
(/net/bluetooth/hci_conn.c:638), which in turn calls hci_abort_conn
(/net/bluetooth/hci_conn.c:2771).
(4.2) This leads to the execution of case BT_CONNECT2:
(/net/bluetooth/hci_conn.c:2771), where the
HCI_Reject_Connection_Request command is sent.
We are not sure whether this is a semantic bug or implementation feature
in the Linux kernel. Any feedback would be appreciated, thanks!
Best wishes,
Sijie Bai
Powered by blists - more mailing lists