From patchwork Wed Aug 28 18:10:50 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luiz Augusto von Dentz X-Patchwork-Id: 824226 Received: from mail-vs1-f43.google.com (mail-vs1-f43.google.com [209.85.217.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6772D1A7067 for ; Wed, 28 Aug 2024 18:10:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.217.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724868657; cv=none; b=ZwTxn19GSpir9OYAysJWNwjFCuY22F85vDlFPruBGFHrH14H2dTxPLEm4/NYWPK1wxMKD838UQOGrfFZVsz/+FfXGs3fZOuUMkoCuY31F5++6le/Hl0IJQsCQ6CN39Jd5ZJi4yr5ceZ9DRUaSgA5z/o2CR3slEL7Nl1Ji/8nEWE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724868657; c=relaxed/simple; bh=P9UYFIm0r4hMTwWWB9cWRZjjSgXz2ITdgIOgMooOwvw=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=mDbqaiwT3/q7ccZLWdjSLGxmDiDCtBcbPoJ46iwFeOgxstmQ81JTbgAsLhiYWMmDbLBZJ8UMoQyHiqrsDqrxSs+aQWOvzHvz36rk/VV6UiJ6SmTkOQ4+N8fzuBMOTT3/yE2OX/v7CwxxqhyaLOSJYzHKlGTUdDxtbbkMOfaYS+A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VzR7Vkij; arc=none smtp.client-ip=209.85.217.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VzR7Vkij" Received: by mail-vs1-f43.google.com with SMTP id ada2fe7eead31-498e1e3bee8so2205563137.0 for ; Wed, 28 Aug 2024 11:10:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1724868653; x=1725473453; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=ei8wPc+vZHo1/MEG4WE7GCMxNufKRbLT+Ky/Z6kQ/ao=; b=VzR7Vkijn7vs5Uxo30vYFOtyd/+guy1lOtnNHjiqJvR0D+320vGIDCC+MN/amFigxK besoYJKTVM7PuG+G0GRuVwWai+gmOlPA/fKFEaOLkcuhn86BZDnI6yBWz23A44FpIR3Y Q2z8DwRwZfUeQ36CBxJ1ZJV5wz1mJ8fJEN/LKY1rPjlQ+nh69nBzCerZz3h/aVw2cFe4 9geKm6T5IyVaOIE12dlxy3/r4eQjeo6sxPguJkuMqeSRjLNw1jE3n9sxr7goI8OknqlV Iwvki3iE6T4laWla1fLEmldpsYoizbOMrJHbPH4weqJKtj79A3wrPNoC2AYlOFQ1Xi+v F8Mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1724868653; x=1725473453; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ei8wPc+vZHo1/MEG4WE7GCMxNufKRbLT+Ky/Z6kQ/ao=; b=nTj/y5kVWKUuxf+lh/YpyoM3EiPlJbkARtbMzKiyMANGQ3KyrVc1xLnZ3JBfXZLfjR X5jLsTfl88y3ok8UtZNahw4PapeWM/GT0n39yoWw92mcWtSaGh6usMCMSj1Tfq1p5DCq eAEiaG2YVrWwLaVWAbcoIVRuEObij1nafN8cY60NQl0u44hNKFL8VySqeLWgL5F8IIiy WYZ6MgdLWgqv10BN5vVj6wK/cP1UjyxKAKBqB7mdkWC/rCj8SW42PPGptiGHslAxL0Ut iZATqFeFAdXzJ5GbvQRdR6TMgqX9SFm4rcmeH7dmPQ+uzQ+VgBq2RU3PfQWtJgLW3Dz3 2NTQ== X-Gm-Message-State: AOJu0YyiFRuqBOHzzFHozwcF2Iq2qp+9DjZIBDuiBeFRA457+++umYt0 LYattYwcjjr941xjcdxkunwvdHRdopQ3+MxT5y7MqcH9o1NK0SaugVy+rQ== X-Google-Smtp-Source: AGHT+IEtSYScuzYACnEwPACTDUJuz7DX4XvZjrZBv7AKdjRtdiQZphXORIVuboZqd2CGSQEaDsM1hg== X-Received: by 2002:a05:6102:c10:b0:498:e21c:cc66 with SMTP id ada2fe7eead31-49a5b0dfca8mr579155137.6.1724868653404; Wed, 28 Aug 2024 11:10:53 -0700 (PDT) Received: from lvondent-mobl5.. (syn-107-146-107-067.res.spectrum.com. [107.146.107.67]) by smtp.gmail.com with ESMTPSA id ada2fe7eead31-498e48c9e0fsm1843280137.24.2024.08.28.11.10.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Aug 2024 11:10:52 -0700 (PDT) From: Luiz Augusto von Dentz To: linux-bluetooth@vger.kernel.org Subject: [PATCH v2 1/2] Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE" Date: Wed, 28 Aug 2024 14:10:50 -0400 Message-ID: <20240828181051.876598-1-luiz.dentz@gmail.com> X-Mailer: git-send-email 2.46.0 Precedence: bulk X-Mailing-List: linux-bluetooth@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Luiz Augusto von Dentz This reverts commit 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 which breaks compatibility with commands like: bluetoothd[46328]: @ MGMT Command: Load.. (0x0013) plen 74 {0x0001} [hci0] Keys: 2 BR/EDR Address: C0:DC:DA:A5:E5:47 (Samsung Electronics Co.,Ltd) Key type: Authenticated key from P-256 (0x03) Central: 0x00 Encryption size: 16 Diversifier[2]: 0000 Randomizer[8]: 0000000000000000 Key[16]: 6ed96089bd9765be2f2c971b0b95f624 LE Address: D7:2A:DE:1E:73:A2 (Static) Key type: Unauthenticated key from P-256 (0x02) Central: 0x00 Encryption size: 16 Diversifier[2]: 0000 Randomizer[8]: 0000000000000000 Key[16]: 87dd2546ededda380ffcdc0a8faa4597 @ MGMT Event: Command Status (0x0002) plen 3 {0x0001} [hci0] Load Long Term Keys (0x0013) Status: Invalid Parameters (0x0d) Cc: stable@vger.kernel.org Link: https://github.com/bluez/bluez/issues/875 Fixes: 59b047bc9808 ("Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE") Signed-off-by: Luiz Augusto von Dentz --- include/net/bluetooth/hci_core.h | 5 ----- net/bluetooth/mgmt.c | 25 +++++++------------------ net/bluetooth/smp.c | 7 ------- 3 files changed, 7 insertions(+), 30 deletions(-) diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index e449dba698f3..1a32e602630e 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -186,7 +186,6 @@ struct blocked_key { struct smp_csrk { bdaddr_t bdaddr; u8 bdaddr_type; - u8 link_type; u8 type; u8 val[16]; }; @@ -196,7 +195,6 @@ struct smp_ltk { struct rcu_head rcu; bdaddr_t bdaddr; u8 bdaddr_type; - u8 link_type; u8 authenticated; u8 type; u8 enc_size; @@ -211,7 +209,6 @@ struct smp_irk { bdaddr_t rpa; bdaddr_t bdaddr; u8 addr_type; - u8 link_type; u8 val[16]; }; @@ -219,8 +216,6 @@ struct link_key { struct list_head list; struct rcu_head rcu; bdaddr_t bdaddr; - u8 bdaddr_type; - u8 link_type; u8 type; u8 val[HCI_LINK_KEY_SIZE]; u8 pin_len; diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 4c20dbf92c71..240dd8cf7c7d 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -2833,8 +2833,7 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, for (i = 0; i < key_count; i++) { struct mgmt_link_key_info *key = &cp->keys[i]; - /* Considering SMP over BREDR/LE, there is no need to check addr_type */ - if (key->type > 0x08) + if (key->addr.type != BDADDR_BREDR || key->type > 0x08) return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, MGMT_STATUS_INVALID_PARAMS); @@ -7089,7 +7088,6 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, for (i = 0; i < irk_count; i++) { struct mgmt_irk_info *irk = &cp->irks[i]; - u8 addr_type = le_addr_type(irk->addr.type); if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK, @@ -7099,12 +7097,8 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, continue; } - /* When using SMP over BR/EDR, the addr type should be set to BREDR */ - if (irk->addr.type == BDADDR_BREDR) - addr_type = BDADDR_BREDR; - hci_add_irk(hdev, &irk->addr.bdaddr, - addr_type, irk->val, + le_addr_type(irk->addr.type), irk->val, BDADDR_ANY); } @@ -7185,7 +7179,6 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, for (i = 0; i < key_count; i++) { struct mgmt_ltk_info *key = &cp->keys[i]; u8 type, authenticated; - u8 addr_type = le_addr_type(key->addr.type); if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK, @@ -7220,12 +7213,8 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, continue; } - /* When using SMP over BR/EDR, the addr type should be set to BREDR */ - if (key->addr.type == BDADDR_BREDR) - addr_type = BDADDR_BREDR; - hci_add_ltk(hdev, &key->addr.bdaddr, - addr_type, type, authenticated, + le_addr_type(key->addr.type), type, authenticated, key->val, key->enc_size, key->ediv, key->rand); } @@ -9519,7 +9508,7 @@ void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, ev.store_hint = persistent; bacpy(&ev.key.addr.bdaddr, &key->bdaddr); - ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); + ev.key.addr.type = BDADDR_BREDR; ev.key.type = key->type; memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); ev.key.pin_len = key->pin_len; @@ -9570,7 +9559,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) ev.store_hint = persistent; bacpy(&ev.key.addr.bdaddr, &key->bdaddr); - ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); + ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); ev.key.type = mgmt_ltk_type(key); ev.key.enc_size = key->enc_size; ev.key.ediv = key->ediv; @@ -9599,7 +9588,7 @@ void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) bacpy(&ev.rpa, &irk->rpa); bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); - ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type); + ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); memcpy(ev.irk.val, irk->val, sizeof(irk->val)); mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); @@ -9628,7 +9617,7 @@ void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, ev.store_hint = persistent; bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); - ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type); + ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); ev.key.type = csrk->type; memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 4f9fdf400584..8b9724fd752a 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1060,7 +1060,6 @@ static void smp_notify_keys(struct l2cap_conn *conn) } if (smp->remote_irk) { - smp->remote_irk->link_type = hcon->type; mgmt_new_irk(hdev, smp->remote_irk, persistent); /* Now that user space can be considered to know the @@ -1080,28 +1079,24 @@ static void smp_notify_keys(struct l2cap_conn *conn) } if (smp->csrk) { - smp->csrk->link_type = hcon->type; smp->csrk->bdaddr_type = hcon->dst_type; bacpy(&smp->csrk->bdaddr, &hcon->dst); mgmt_new_csrk(hdev, smp->csrk, persistent); } if (smp->responder_csrk) { - smp->responder_csrk->link_type = hcon->type; smp->responder_csrk->bdaddr_type = hcon->dst_type; bacpy(&smp->responder_csrk->bdaddr, &hcon->dst); mgmt_new_csrk(hdev, smp->responder_csrk, persistent); } if (smp->ltk) { - smp->ltk->link_type = hcon->type; smp->ltk->bdaddr_type = hcon->dst_type; bacpy(&smp->ltk->bdaddr, &hcon->dst); mgmt_new_ltk(hdev, smp->ltk, persistent); } if (smp->responder_ltk) { - smp->responder_ltk->link_type = hcon->type; smp->responder_ltk->bdaddr_type = hcon->dst_type; bacpy(&smp->responder_ltk->bdaddr, &hcon->dst); mgmt_new_ltk(hdev, smp->responder_ltk, persistent); @@ -1121,8 +1116,6 @@ static void smp_notify_keys(struct l2cap_conn *conn) key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst, smp->link_key, type, 0, &persistent); if (key) { - key->link_type = hcon->type; - key->bdaddr_type = hcon->dst_type; mgmt_new_link_key(hdev, key, persistent); /* Don't keep debug keys around if the relevant From patchwork Wed Aug 28 18:10:51 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luiz Augusto von Dentz X-Patchwork-Id: 823180 Received: from mail-vs1-f50.google.com (mail-vs1-f50.google.com [209.85.217.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D2C51AAE2C for ; Wed, 28 Aug 2024 18:10:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.217.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724868658; cv=none; b=IxODy1D1p3rC07f8YS5FMIGjr5fy6FM/2dtyqpm3y6aDfA//a8q9RYpNEd8VZdqXfsbSyguds1dVeOBtw/brldGjKnOU3Dx5mF4SAbBpkuWDPpcNyvp+T1hsgoVFhhfFC56A+EE3NPEVCyIvlbEkQ2K54ngs+wz7P/HRVnbWcPs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724868658; c=relaxed/simple; bh=1gK0IdA27HujfdTxFGE8IlatyCq9h4hz19jHa/7SC2Q=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eOlrLBQpkGqnbdVor5SrBULsMEIUFyUTXY/v8Cm2CkVFCJanD3yhNQ2MxCYa0aTluWRJntW5Pcc9x3Bu5MstDXc7evJ4YZEM8qOoEtEPfGXpVaBLf9CcXj4FmJLTbhJxzFC8r4FaNWJlqNaM1hXqZtBd3RM2D5ajPGDI2kGLB6g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RvD8AqBh; arc=none smtp.client-ip=209.85.217.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RvD8AqBh" Received: by mail-vs1-f50.google.com with SMTP id ada2fe7eead31-498de7a11b9so2309929137.2 for ; Wed, 28 Aug 2024 11:10:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1724868655; x=1725473455; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=miPIrcJtiQTyXHplzwiPVK6d4OA4XunJfp7gjICeoso=; b=RvD8AqBhy9h6SsJrJ8f0/GmLblUL2AMjfZBBM242aY9zQDlYz2cgj04PvlnZJfcubh 5BM1u7lI6uaEKUkFV9uxZLcTYtKNQWWOKzQL50jL24AKUE1idjf/IqbHLPj2aoD6CRGC 02BltYERCNCCyKw/p7BipoQj3Sxi/T9QDlSMEy2F+yO8z52WVi9MJp6j9AaHws2yLV0b Qrc5O+ONh2Kiw54tEofRaDjqblrFPAnfe5gD7gSFzvPTrvU3Bs7EF/p3azDio5N87suI ouX61Pq0w4BAbrzgi9xWrY57cl5Rg6/hY9+mmfRQ429r1KLoiRO4SFV4QY5usISCjcF+ qxTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1724868655; x=1725473455; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=miPIrcJtiQTyXHplzwiPVK6d4OA4XunJfp7gjICeoso=; b=YIHnFe7ACihqIUyUrq9mY9r2ALyahcMQAPc4uW3M300/tV6ET2FxCZd/kSvNK5daiO eSTbqaIBO0V1ysYW+xGBlQQh02dXXfbLo2dRjoYymuqZL+wUalRKN4Eglv/kRGTXcIzz GuH6do0et5QVdFQZhqgfGg0kPWkr051Ecn564bOtx6mC2RXO75zLnMmgW7aVYdtrhVYG 0a+Xh1ol3/VMUb+eZN/j7LoCa2xV26d2Dpie8tiZBupPzyPK5ZTUFEgfwAqUyxsgZrMD 0Cxq0ZoWOlIco0qszRT/76D6JX5XNpjUAVyxYOWWXu0ahGlBGK0Ue87l0qc9nolmBT8n yh5A== X-Gm-Message-State: AOJu0YxG29OP68n5azXgxNbGGnrXLXJ+3NIzdPnz9J1SZ5UWCDXApOl0 b9i2Kih+YTh+EaePWm6XXPCqpQFyEBdjgNYtUVDv6iFbfgQC8cXVZ9Hb6g== X-Google-Smtp-Source: AGHT+IHBrdoqx40STjbD8qHx49U7OHQr2XzC1y84RZtgWJy7d+XM1OH7FoJIa9kANNg/0ajVIYLW7Q== X-Received: by 2002:a05:6102:4428:b0:49a:42f8:dd20 with SMTP id ada2fe7eead31-49a5ae70caamr725917137.14.1724868655330; Wed, 28 Aug 2024 11:10:55 -0700 (PDT) Received: from lvondent-mobl5.. (syn-107-146-107-067.res.spectrum.com. [107.146.107.67]) by smtp.gmail.com with ESMTPSA id ada2fe7eead31-498e48c9e0fsm1843280137.24.2024.08.28.11.10.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Aug 2024 11:10:53 -0700 (PDT) From: Luiz Augusto von Dentz To: linux-bluetooth@vger.kernel.org Subject: [PATCH v2 2/2] Bluetooth: MGMT: Ignore keys being loaded with invalid type Date: Wed, 28 Aug 2024 14:10:51 -0400 Message-ID: <20240828181051.876598-2-luiz.dentz@gmail.com> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20240828181051.876598-1-luiz.dentz@gmail.com> References: <20240828181051.876598-1-luiz.dentz@gmail.com> Precedence: bulk X-Mailing-List: linux-bluetooth@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Luiz Augusto von Dentz Due to 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 there could be keys stored with the wrong address type so this attempt to detect it and ignore them instead of just failing to load all keys. Cc: stable@vger.kernel.org Link: https://github.com/bluez/bluez/issues/875 Fixes: 59b047bc9808 ("Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE") Signed-off-by: Luiz Augusto von Dentz --- net/bluetooth/mgmt.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 240dd8cf7c7d..2c46316dfb2e 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -2830,15 +2830,6 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, key_count); - for (i = 0; i < key_count; i++) { - struct mgmt_link_key_info *key = &cp->keys[i]; - - if (key->addr.type != BDADDR_BREDR || key->type > 0x08) - return mgmt_cmd_status(sk, hdev->id, - MGMT_OP_LOAD_LINK_KEYS, - MGMT_STATUS_INVALID_PARAMS); - } - hci_dev_lock(hdev); hci_link_keys_clear(hdev); @@ -2863,6 +2854,19 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, continue; } + if (key->addr.type != BDADDR_BREDR) { + bt_dev_warn(hdev, + "Invalid link address type %u for %pMR", + &key->addr.type); + continue; + } + + if (key->type > 0x08) { + bt_dev_warn(hdev, "Invalid link key type %u for %pMR", + key->type, &key->addr.bdaddr); + continue; + } + /* Always ignore debug keys and require a new pairing if * the user wants to use them. */ @@ -7163,15 +7167,6 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, bt_dev_dbg(hdev, "key_count %u", key_count); - for (i = 0; i < key_count; i++) { - struct mgmt_ltk_info *key = &cp->keys[i]; - - if (!ltk_is_valid(key)) - return mgmt_cmd_status(sk, hdev->id, - MGMT_OP_LOAD_LONG_TERM_KEYS, - MGMT_STATUS_INVALID_PARAMS); - } - hci_dev_lock(hdev); hci_smp_ltks_clear(hdev); @@ -7188,6 +7183,12 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, continue; } + if (!ltk_is_valid(key)) { + bt_dev_warn(hdev, "Invalid LTK for %pMR", + &key->addr.bdaddr); + continue; + } + switch (key->type) { case MGMT_LTK_UNAUTHENTICATED: authenticated = 0x00;