lkml.org 
[lkml]   [2019]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.1 361/371] Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
    Date
    From: Szymon Janc <szymon.janc@codecoup.pl>

    commit 1d87b88ba26eabd4745e158ecfd87c93a9b51dc2 upstream.

    Microsoft Surface Precision Mouse provides bogus identity address when
    pairing. It connects with Static Random address but provides Public
    Address in SMP Identity Address Information PDU. Address has same
    value but type is different. Workaround this by dropping IRK if ID
    address discrepancy is detected.

    > HCI Event: LE Meta Event (0x3e) plen 19
    LE Connection Complete (0x01)
    Status: Success (0x00)
    Handle: 75
    Role: Master (0x00)
    Peer address type: Random (0x01)
    Peer address: E0:52:33:93:3B:21 (Static)
    Connection interval: 50.00 msec (0x0028)
    Connection latency: 0 (0x0000)
    Supervision timeout: 420 msec (0x002a)
    Master clock accuracy: 0x00

    ....

    > ACL Data RX: Handle 75 flags 0x02 dlen 12
    SMP: Identity Address Information (0x09) len 7
    Address type: Public (0x00)
    Address: E0:52:33:93:3B:21

    Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
    Tested-by: Maarten Fonville <maarten.fonville@gmail.com>
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199461
    Cc: stable@vger.kernel.org
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/bluetooth/smp.c | 13 +++++++++++++
    1 file changed, 13 insertions(+)

    --- a/net/bluetooth/smp.c
    +++ b/net/bluetooth/smp.c
    @@ -2580,6 +2580,19 @@ static int smp_cmd_ident_addr_info(struc
    goto distribute;
    }

    + /* Drop IRK if peer is using identity address during pairing but is
    + * providing different address as identity information.
    + *
    + * Microsoft Surface Precision Mouse is known to have this bug.
    + */
    + if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
    + (bacmp(&info->bdaddr, &hcon->dst) ||
    + info->addr_type != hcon->dst_type)) {
    + bt_dev_err(hcon->hdev,
    + "ignoring IRK with invalid identity address");
    + goto distribute;
    + }
    +
    bacpy(&smp->id_addr, &info->bdaddr);
    smp->id_addr_type = info->addr_type;


    \
     
     \ /
      Last update: 2019-07-24 22:39    [W:4.160 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site