linux-stable.git/net/bluetooth/smp.c, branch linux-3.4.y

Bluetooth: Fix setting correct security level when initiating SMP

2015-02-02T09:04:37+00:00

commit 5eb596f55cacc2389554a8d7572d90d5e9d4269d upstream.

We can only determine the final security level when both pairing request
and response have been exchanged. When initiating pairing the starting
target security level is set to MEDIUM unless explicitly specified to be
HIGH, so that we can still perform pairing even if the remote doesn't
have MITM capabilities. However, once we've received the pairing
response we should re-consult the remote and local IO capabilities and
upgrade the target security level if necessary.

Without this patch the resulting Long Term Key will occasionally be
reported to be unauthenticated when it in reality is an authenticated
one.

Signed-off-by: Johan Hedberg 
Signed-off-by: Marcel Holtmann 
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li

Bluetooth: Fix handling of unexpected SMP PDUs

2013-02-14T18:48:53+00:00

commit 8cf9fa1240229cbdd888236c0c43fcbad680cf00 upstream.

The conn->smp_chan pointer can be NULL if SMP PDUs arrive at unexpected
moments. To avoid NULL pointer dereferences the code should be checking
for this and disconnect if an unexpected SMP PDU arrives. This patch
fixes the issue by adding a check for conn->smp_chan for all other PDUs
except pairing request and security request (which are are the first
PDUs to come to initialize the SMP context).

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: SMP: Fix setting unknown auth_req bits

2012-10-31T17:03:02+00:00

commit 065a13e2cc665f6547dc7e8a9d6b6565badf940a upstream.

When sending a pairing request or response we should not just blindly
copy the value that the remote device sent. Instead we should at least
make sure to mask out any unknown bits. This is particularly critical
from the upcoming LE Secure Connections feature perspective as
incorrectly indicating support for it (by copying the remote value)
would cause a failure to pair with devices that support it.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Change signature of smp_conn_security()

2012-10-02T17:30:34+00:00

commit cc110922da7e902b62d18641a370fec01a9fa794 upstream.

To make it clear that it may be called from contexts that may not have
any knowledge of L2CAP, we change the connection parameter, to receive
a hci_conn.

This also makes it clear that it is checking the security of the link.

Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix use-after-free bug in SMP

2012-10-02T17:30:34+00:00

commit 61a0cfb008f57ecf7eb28ee762952fb42dc15d15 upstream.

If SMP fails, we should always cancel security_timer delayed work.
Otherwise, security_timer function may run after l2cap_conn object
has been freed.

This patch fixes the following warning reported by ODEBUG:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: Bochs
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x27
Modules linked in: btusb bluetooth
Pid: 440, comm: kworker/u:2 Not tainted 3.5.0-rc1+ #4
Call Trace:
 [] ? free_obj_work+0x4a/0x7f
 [] warn_slowpath_common+0x7e/0x97
 [] warn_slowpath_fmt+0x41/0x43
 [] debug_print_object+0x7c/0x8d
 [] ? __queue_work+0x241/0x241
 [] debug_check_no_obj_freed+0x92/0x159
 [] slab_free_hook+0x6f/0x77
 [] ? l2cap_conn_del+0x148/0x157 [bluetooth]
 [] kfree+0x59/0xac
 [] l2cap_conn_del+0x148/0x157 [bluetooth]
 [] l2cap_recv_frame+0xa77/0xfa4 [bluetooth]
 [] ? trace_hardirqs_on_caller+0x112/0x1ad
 [] l2cap_recv_acldata+0xe2/0x264 [bluetooth]
 [] hci_rx_work+0x235/0x33c [bluetooth]
 [] ? process_one_work+0x126/0x2fe
 [] process_one_work+0x185/0x2fe
 [] ? process_one_work+0x126/0x2fe
 [] ? lock_acquired+0x1b5/0x1cf
 [] ? le_scan_work+0x11d/0x11d [bluetooth]
 [] ? spin_lock_irq+0x9/0xb
 [] worker_thread+0xcf/0x175
 [] ? rescuer_thread+0x175/0x175
 [] kthread+0x95/0x9d
 [] kernel_threadi_helper+0x4/0x10
 [] ? retint_restore_args+0x13/0x13
 [] ? flush_kthread_worker+0xdb/0xdb
 [] ? gs_change+0x13/0x13

This bug can be reproduced using hctool lecc or l2test tools and
bluetoothd not running.

Signed-off-by: Andre Guedes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Set security level on incoming pairing request

2012-03-08T05:26:04+00:00

If a master would like to raise the security level, it will send a
pairing request. While the pending security level is set on an incoming
security request (from a slave), it is not set on a pairing request. As
a result, the security level would not be raised on the slave in such
case.

Fix this by setting the pending security when receiving pairing
requests according to the requested authorization.

Signed-off-by: Ido Yariv 
Acked-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo F. Padovan

Bluetooth: Fix access to the STK generation methods matrix

2012-03-08T05:25:00+00:00

The major index of the table is actually the remote I/O capabilities, not
the local ones. As a result, devices with different I/O capabilities
could have used wrong or even unsupported generation methods.

Signed-off-by: Ido Yariv 
CC: Brian Gix 
Acked-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo F. Padovan

Bluetooth: fix conding style issues all over the tree

2012-03-08T05:02:26+00:00

Signed-off-by: Gustavo F. Padovan

Bluetooth: Update MGMT and SMP timeout constants to use msecs_to_jiffies

2012-03-01T22:35:57+00:00

The MGMT and SMP timeout constants are always used in form of jiffies. So
just include the conversion from msecs in the define itself. This has the
advantage of making the code where the timeout is used more readable.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: Add address type to mgmt_ev_auth_failed

2012-02-13T15:01:37+00:00

This patch updates the Authentication Failed mgmt event to match the
latest API specification by adding an address type to it.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann