Bluetooth: MGMT: Ignore keys being loaded with invalid type

Due to 59b047bc there could be keys stored
with the wrong address type so this attempt to detect it and ignore them
instead of just failing to load all keys.

Cc: stable@vger.kernel.org
Link: https://github.com/bluez/bluez/issues/875
Fixes: 59b047bc ("Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 532f8bcd
...@@ -2830,15 +2830,6 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, ...@@ -2830,15 +2830,6 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
key_count); key_count);
for (i = 0; i < key_count; i++) {
struct mgmt_link_key_info *key = &cp->keys[i];
if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
return mgmt_cmd_status(sk, hdev->id,
MGMT_OP_LOAD_LINK_KEYS,
MGMT_STATUS_INVALID_PARAMS);
}
hci_dev_lock(hdev); hci_dev_lock(hdev);
hci_link_keys_clear(hdev); hci_link_keys_clear(hdev);
...@@ -2863,6 +2854,19 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, ...@@ -2863,6 +2854,19 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
continue; continue;
} }
if (key->addr.type != BDADDR_BREDR) {
bt_dev_warn(hdev,
"Invalid link address type %u for %pMR",
key->addr.type, &key->addr.bdaddr);
continue;
}
if (key->type > 0x08) {
bt_dev_warn(hdev, "Invalid link key type %u for %pMR",
key->type, &key->addr.bdaddr);
continue;
}
/* Always ignore debug keys and require a new pairing if /* Always ignore debug keys and require a new pairing if
* the user wants to use them. * the user wants to use them.
*/ */
...@@ -7163,15 +7167,6 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, ...@@ -7163,15 +7167,6 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
bt_dev_dbg(hdev, "key_count %u", key_count); bt_dev_dbg(hdev, "key_count %u", key_count);
for (i = 0; i < key_count; i++) {
struct mgmt_ltk_info *key = &cp->keys[i];
if (!ltk_is_valid(key))
return mgmt_cmd_status(sk, hdev->id,
MGMT_OP_LOAD_LONG_TERM_KEYS,
MGMT_STATUS_INVALID_PARAMS);
}
hci_dev_lock(hdev); hci_dev_lock(hdev);
hci_smp_ltks_clear(hdev); hci_smp_ltks_clear(hdev);
...@@ -7188,6 +7183,12 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, ...@@ -7188,6 +7183,12 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
continue; continue;
} }
if (!ltk_is_valid(key)) {
bt_dev_warn(hdev, "Invalid LTK for %pMR",
&key->addr.bdaddr);
continue;
}
switch (key->type) { switch (key->type) {
case MGMT_LTK_UNAUTHENTICATED: case MGMT_LTK_UNAUTHENTICATED:
authenticated = 0x00; authenticated = 0x00;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment