Skip to content

Commit

Permalink
Bluetooth: MGMT: Ignore keys being loaded with invalid type
Browse files Browse the repository at this point in the history
Due to 59b047b there could be keys stored
with the wrong address type so this attempt to detect it and ignore them
instead of just failing to load all keys.

Cc: stable@vger.kernel.org
Link: https://github.com/bluez/bluez/issues/875
Fixes: 59b047b ("Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  • Loading branch information
Luiz Augusto von Dentz committed Aug 30, 2024
1 parent 532f8bc commit 1e9683c
Showing 1 changed file with 19 additions and 18 deletions.
37 changes: 19 additions & 18 deletions net/bluetooth/mgmt.c
Original file line number Diff line number Diff line change
Expand Up @@ -2830,15 +2830,6 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
key_count);

for (i = 0; i < key_count; i++) {
struct mgmt_link_key_info *key = &cp->keys[i];

if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
return mgmt_cmd_status(sk, hdev->id,
MGMT_OP_LOAD_LINK_KEYS,
MGMT_STATUS_INVALID_PARAMS);
}

hci_dev_lock(hdev);

hci_link_keys_clear(hdev);
Expand All @@ -2863,6 +2854,19 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
continue;
}

if (key->addr.type != BDADDR_BREDR) {
bt_dev_warn(hdev,
"Invalid link address type %u for %pMR",
key->addr.type, &key->addr.bdaddr);
continue;
}

if (key->type > 0x08) {
bt_dev_warn(hdev, "Invalid link key type %u for %pMR",
key->type, &key->addr.bdaddr);
continue;
}

/* Always ignore debug keys and require a new pairing if
* the user wants to use them.
*/
Expand Down Expand Up @@ -7163,15 +7167,6 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,

bt_dev_dbg(hdev, "key_count %u", key_count);

for (i = 0; i < key_count; i++) {
struct mgmt_ltk_info *key = &cp->keys[i];

if (!ltk_is_valid(key))
return mgmt_cmd_status(sk, hdev->id,
MGMT_OP_LOAD_LONG_TERM_KEYS,
MGMT_STATUS_INVALID_PARAMS);
}

hci_dev_lock(hdev);

hci_smp_ltks_clear(hdev);
Expand All @@ -7188,6 +7183,12 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
continue;
}

if (!ltk_is_valid(key)) {
bt_dev_warn(hdev, "Invalid LTK for %pMR",
&key->addr.bdaddr);
continue;
}

switch (key->type) {
case MGMT_LTK_UNAUTHENTICATED:
authenticated = 0x00;
Expand Down

0 comments on commit 1e9683c

Please sign in to comment.