Bluetooth: Remove hci_request.{c,h}

This removes hci_request.{c,h} since it shall no longer be used.

Signed-off-by: Luiz Augusto von Dentz <[email protected]>

Bluetooth: Fix TOCTOU in HCI debugfs implementation

struct hci_dev members conn_info_max_age, conn_info_min_age,
le_conn_max_interval, le_conn_min_interval, le_adv_max_interval,
and le_adv_min_inter

Bluetooth: Fix TOCTOU in HCI debugfs implementation

struct hci_dev members conn_info_max_age, conn_info_min_age,
le_conn_max_interval, le_conn_min_interval, le_adv_max_interval,
and le_adv_min_interval can be modified from the HCI core code, as well
through debugfs.

The debugfs implementation, that's only available to privileged users,
will check for boundaries, making sure that the minimum value being set
is strictly above the maximum value that already exists, and vice-versa.

However, as both minimum and maximum values can be changed concurrently
to us modifying them, we need to make sure that the value we check is
the value we end up using.

For example, with ->conn_info_max_age set to 10, conn_info_min_age_set()
gets called from vfs handlers to set conn_info_min_age to 8.

In conn_info_min_age_set(), this goes through:
if (val == 0 || val > hdev->conn_info_max_age)
return -EINVAL;

Concurrently, conn_info_max_age_set() gets called to set to set the
conn_info_max_age to 7:
if (val == 0 || val > hdev->conn_info_max_age)
return -EINVAL;
That check will also pass because we used the old value (10) for
conn_info_max_age.

After those checks that both passed, the struct hci_dev access
is mutex-locked, disabling concurrent access, but that does not matter
because the invalid value checks both passed, and we'll end up with
conn_info_min_age = 8 and conn_info_max_age = 7

To fix this problem, we need to lock the structure access before so the
check and assignment are not interrupted.

This fix was originally devised by the BassCheck[1] team, and
considered the problem to be an atomicity one. This isn't the case as
there aren't any concerns about the variable changing while we check it,
but rather after we check it parallel to another change.

This patch fixes CVE-2024-24858 and CVE-2024-24857.

[1] https://sites.google.com/view/basscheck/

Co-developed-by: Gui-Dong Han <[email protected]>
Signed-off-by: Gui-Dong Han <[email protected]>
Link: https://lore.kernel.org/linux-bluetooth/[email protected]/
Link: https://nvd.nist.gov/vuln/detail/CVE-2024-24858
Link: https://lore.kernel.org/linux-bluetooth/[email protected]/
Link: https://lore.kernel.org/linux-bluetooth/[email protected]/
Link: https://nvd.nist.gov/vuln/detail/CVE-2024-24857
Fixes: 31ad169148df ("Bluetooth: Add conn info lifetime parameters to debugfs")
Fixes: 729a1051da6f ("Bluetooth: Expose default LE advertising interval via debugfs")
Fixes: 71c3b60ec6d2 ("Bluetooth: Move BR/EDR debugfs file creation into hci_debugfs.c")
Signed-off-by: Bastien Nocera <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>

show more ...

Bluetooth: Fix atomicity violation in {min,max}_key_size_set

In min_key_size_set():
if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE)
return -EINVAL;
hci_dev_lock(hdev);

Bluetooth: Fix atomicity violation in {min,max}_key_size_set

In min_key_size_set():
if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE)
return -EINVAL;
hci_dev_lock(hdev);
hdev->le_min_key_size = val;
hci_dev_unlock(hdev);

In max_key_size_set():
if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size)
return -EINVAL;
hci_dev_lock(hdev);
hdev->le_max_key_size = val;
hci_dev_unlock(hdev);

The atomicity violation occurs due to concurrent execution of set_min and
set_max funcs.Consider a scenario where setmin writes a new, valid 'min'
value, and concurrently, setmax writes a value that is greater than the
old 'min' but smaller than the new 'min'. In this case, setmax might check
against the old 'min' value (before acquiring the lock) but write its
value after the 'min' has been updated by setmin. This leads to a
situation where the 'max' value ends up being smaller than the 'min'
value, which is an inconsistency.

This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 5.17.

To resolve this issue, it is suggested to encompass the validity checks
within the locked sections in both set_min and set_max funcs. The
modification ensures that the validation of 'val' against the
current min/max values is atomic, thus maintaining the integrity of the
settings. With this patch applied, our tool no longer reports the bug,
with the kernel configuration allyesconfig for x86_64. Due to the lack of
associated hardware, we cannot test the patch in runtime testing, and just
verify it according to the code logic.

[1] https://sites.google.com/view/basscheck/

Fixes: 18f81241b74f ("Bluetooth: Move {min,max}_key_size debugfs ...")
Cc: [email protected]
Signed-off-by: Gui-Dong Han <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>

show more ...

Bluetooth: hci_debugfs: Use kstrtobool() instead of strtobool()

strtobool() is the same as kstrtobool().
However, the latter is more used within the kernel.

In order to remove strtobool() and sligh

Bluetooth: hci_debugfs: Use kstrtobool() instead of strtobool()

strtobool() is the same as kstrtobool().
However, the latter is more used within the kernel.

In order to remove strtobool() and slightly simplify kstrtox.h, switch to
the other function name.

While at it, include the corresponding header file (<linux/kstrtox.h>)

Signed-off-by: Christophe JAILLET <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>

show more ...

Bluetooth: fix inconsistent indenting

Fixed a wrong indentation before "return".This line uses a 7 space
indent instead of a tab.

Signed-off-by: Lanzhe Li <[email protected]>
Signed-off-by: Lu

Bluetooth: fix inconsistent indenting

Fixed a wrong indentation before "return".This line uses a 7 space
indent instead of a tab.

Signed-off-by: Lanzhe Li <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>

show more ...

Bluetooth: hci_sync: Fix not able to set force_static_address

force_static_address shall be writable while hdev is initing but is not
considered powered yet since the static address is written only

Bluetooth: hci_sync: Fix not able to set force_static_address

force_static_address shall be writable while hdev is initing but is not
considered powered yet since the static address is written only when
powered.

Signed-off-by: Luiz Augusto von Dentz <[email protected]>
Tested-by: Brian Gix <[email protected]>

show more ...

Bluetooth: hci_debugfs: Fix not checking conn->debugfs

hci_debugfs_create_conn shall check if conn->debugfs has already been
created and don't attempt to overwrite it.

Signed-off-by: Luiz Augusto v

Bluetooth: hci_debugfs: Fix not checking conn->debugfs

hci_debugfs_create_conn shall check if conn->debugfs has already been
created and don't attempt to overwrite it.

Signed-off-by: Luiz Augusto von Dentz <[email protected]>

show more ...

Bluetooth: hci_core: Move all debugfs handling to hci_debugfs.c

This moves hci_debugfs_create_basic to hci_debugfs.c which is where all
the others debugfs entries are handled.

Signed-off-by: Luiz A

Bluetooth: hci_core: Move all debugfs handling to hci_debugfs.c

This moves hci_debugfs_create_basic to hci_debugfs.c which is where all
the others debugfs entries are handled.

Signed-off-by: Luiz Augusto von Dentz <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: use inclusive language when filtering devices

This patch replaces some non-inclusive terms based on the appropriate
language mapping table compiled by the Bluetooth SIG:
https://specifica

Bluetooth: use inclusive language when filtering devices

This patch replaces some non-inclusive terms based on the appropriate
language mapping table compiled by the Bluetooth SIG:
https://specificationrefs.bluetooth.com/language-mapping/Appropriate_Language_Mapping_Table.pdf

Specifically, these terms are replaced:
blacklist -> reject list
whitelist -> accept list

Signed-off-by: Archie Pusaka <[email protected]>
Reviewed-by: Miao-chen Chou <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: Coding style fix

1. Add space when needed;
2. Block comments style fix;
3. Move open brace '{' following function definitions to the next line;
4. Remove unnecessary braces '{}' for singl

Bluetooth: Coding style fix

1. Add space when needed;
2. Block comments style fix;
3. Move open brace '{' following function definitions to the next line;
4. Remove unnecessary braces '{}' for single statement blocks.

Signed-off-by: Meng Yu <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: fix coccicheck warnings debugfs

Use DEFINE_DEBUGFS_ATTRIBUTE rather than DEFINE_SIMPLE_ATTRIBUTE
for debugfs files.

Reported-by: Abaci Robot<[email protected]>
Signed-off-by: Jiape

Bluetooth: fix coccicheck warnings debugfs

Use DEFINE_DEBUGFS_ATTRIBUTE rather than DEFINE_SIMPLE_ATTRIBUTE
for debugfs files.

Reported-by: Abaci Robot<[email protected]>
Signed-off-by: Jiapeng Zhong <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: Move force_bredr_smp debugfs into hci_debugfs_create_bredr

Avoid multiple attempts to create the debugfs entry, force_bredr_smp,
by moving it from the SMP registration to the BR/EDR contr

Bluetooth: Move force_bredr_smp debugfs into hci_debugfs_create_bredr

Avoid multiple attempts to create the debugfs entry, force_bredr_smp,
by moving it from the SMP registration to the BR/EDR controller init
section. hci_debugfs_create_bredr is only called when HCI_SETUP and
HCI_CONFIG is not set.

Signed-off-by: Claire Chang <[email protected]>
Reviewed-by: Alain Michaud <[email protected]>
Reviewed-by: Luiz Augusto von Dentz <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: debugfs option to unset MITM flag

The BT qualification test SM/MAS/PKE/BV-01-C needs us to turn off
the MITM flag when pairing, and at the same time also set the io
capability to somethin

Bluetooth: debugfs option to unset MITM flag

The BT qualification test SM/MAS/PKE/BV-01-C needs us to turn off
the MITM flag when pairing, and at the same time also set the io
capability to something other than no input no output.

Currently the MITM flag is only unset when the io capability is set
to no input no output, therefore the test cannot be executed.

This patch introduces a debugfs option to force MITM flag to be
turned off.

Signed-off-by: Archie Pusaka <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: Move {min,max}_key_size debugfs into hci_debugfs_create_le

The debugfs entries for {min,max}_key_size are created during SMP
registration and thus it might lead to multiple attempts to cr

Bluetooth: Move {min,max}_key_size debugfs into hci_debugfs_create_le

The debugfs entries for {min,max}_key_size are created during SMP
registration and thus it might lead to multiple attempts to create the
same entries. Avoid this by moving them to the LE controller init
section.

Signed-off-by: Marcel Holtmann <[email protected]>
Signed-off-by: Johan Hedberg <[email protected]>

show more ...

Bluetooth: Implementation of MGMT_OP_SET_BLOCKED_KEYS.

MGMT command is added to receive the list of blocked keys from
user-space.

The list is used to:
1) Block keys from being distributed by the de

Bluetooth: Implementation of MGMT_OP_SET_BLOCKED_KEYS.

MGMT command is added to receive the list of blocked keys from
user-space.

The list is used to:
1) Block keys from being distributed by the device during
the ke distribution phase of SMP.
2) Filter out any keys that were previously saved so
they are no longer used.

Signed-off-by: Alain Michaud <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: Add debug setting for changing minimum encryption key size

For testing and qualification purposes it is useful to allow changing
the minimum encryption key size value that the host stack

Bluetooth: Add debug setting for changing minimum encryption key size

For testing and qualification purposes it is useful to allow changing
the minimum encryption key size value that the host stack is going to
enforce. This adds a new debugfs setting min_encrypt_key_size to achieve
this functionality.

Signed-off-by: Marcel Holtmann <[email protected]>
Signed-off-by: Johan Hedberg <[email protected]>

show more ...

Bluetooth: Add support for LE ping feature

Changes made to add HCI Write Authenticated Payload timeout
command for LE Ping feature.

As per the Core Specification 5.0 Volume 2 Part E Section 7.3.94,

Bluetooth: Add support for LE ping feature

Changes made to add HCI Write Authenticated Payload timeout
command for LE Ping feature.

As per the Core Specification 5.0 Volume 2 Part E Section 7.3.94,
the following code changes implements
HCI Write Authenticated Payload timeout command for LE Ping feature.

Signed-off-by: Spoorthi Ravishankar Koppad <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: Store Resolv list size

When the controller supports the Read LE Resolv List size feature, the
maximum list size are read and now stored.

Before patch:
< HCI Command: LE Read White List..

Bluetooth: Store Resolv list size

When the controller supports the Read LE Resolv List size feature, the
maximum list size are read and now stored.

Before patch:
< HCI Command: LE Read White List... (0x08|0x000f) plen 0 #55 [hci0] 17.979791
> HCI Event: Command Complete (0x0e) plen 5 #56 [hci0] 17.980629
LE Read White List Size (0x08|0x000f) ncmd 1
Status: Success (0x00)
Size: 25
< HCI Command: LE Clear White List (0x08|0x0010) plen 0 #57 [hci0] 17.980786
> HCI Event: Command Complete (0x0e) plen 4 #58 [hci0] 17.981627
LE Clear White List (0x08|0x0010) ncmd 1
Status: Success (0x00)
< HCI Command: LE Read Maximum Dat.. (0x08|0x002f) plen 0 #59 [hci0] 17.981786
> HCI Event: Command Complete (0x0e) plen 12 #60 [hci0] 17.982636
LE Read Maximum Data Length (0x08|0x002f) ncmd 1
Status: Success (0x00)
Max TX octets: 251
Max TX time: 17040
Max RX octets: 251
Max RX time: 17040

After patch:
< HCI Command: LE Read White List... (0x08|0x000f) plen 0 #55 [hci0] 13.338168
> HCI Event: Command Complete (0x0e) plen 5 #56 [hci0] 13.338842
LE Read White List Size (0x08|0x000f) ncmd 1
Status: Success (0x00)
Size: 25
< HCI Command: LE Clear White List (0x08|0x0010) plen 0 #57 [hci0] 13.339029
> HCI Event: Command Complete (0x0e) plen 4 #58 [hci0] 13.339939
LE Clear White List (0x08|0x0010) ncmd 1
Status: Success (0x00)
< HCI Command: LE Read Resolving L.. (0x08|0x002a) plen 0 #59 [hci0] 13.340152
> HCI Event: Command Complete (0x0e) plen 5 #60 [hci0] 13.340952
LE Read Resolving List Size (0x08|0x002a) ncmd 1
Status: Success (0x00)
Size: 25
< HCI Command: LE Read Maximum Dat.. (0x08|0x002f) plen 0 #61 [hci0] 13.341180
> HCI Event: Command Complete (0x0e) plen 12 #62 [hci0] 13.341898
LE Read Maximum Data Length (0x08|0x002f) ncmd 1
Status: Success (0x00)
Max TX octets: 251
Max TX time: 17040
Max RX octets: 251
Max RX time: 17040

Signed-off-by: Ankit Navik <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: Re-use kstrtobool_from_user()

Re-use kstrtobool_from_user() instead of open coded variant.

Signed-off-by: Andy Shevchenko <[email protected]>
Signed-off-by: Marcel Holtma

Bluetooth: Re-use kstrtobool_from_user()

Re-use kstrtobool_from_user() instead of open coded variant.

Signed-off-by: Andy Shevchenko <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

seq_file: Introduce DEFINE_SHOW_ATTRIBUTE() helper macro

The DEFINE_SHOW_ATTRIBUTE() helper macro would be useful for current
users, which are many of them, and for new comers to decrease code
dupli

seq_file: Introduce DEFINE_SHOW_ATTRIBUTE() helper macro

The DEFINE_SHOW_ATTRIBUTE() helper macro would be useful for current
users, which are many of them, and for new comers to decrease code
duplication.

Acked-by: Lee Jones <[email protected]>
Acked-by: Darren Hart (VMware) <[email protected]>
Signed-off-by: Andy Shevchenko <[email protected]>

show more ...

Bluetooth: introduce DEFINE_SHOW_ATTRIBUTE() macro

This macro deduplicates a lot of similar code across the hci_debugfs.c
module. Targeting to be moved to seq_file.h eventually.

Signed-off-by: Andy

Bluetooth: introduce DEFINE_SHOW_ATTRIBUTE() macro

This macro deduplicates a lot of similar code across the hci_debugfs.c
module. Targeting to be moved to seq_file.h eventually.

Signed-off-by: Andy Shevchenko <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: Utilize %*ph specifier

Instead of open coding byte-by-byte printing, re-use %*ph specifier.

Signed-off-by: Andy Shevchenko <[email protected]>
Signed-off-by: Marcel Holtm

Bluetooth: Utilize %*ph specifier

Instead of open coding byte-by-byte printing, re-use %*ph specifier.

Signed-off-by: Andy Shevchenko <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...

Bluetooth: Add debugfs fields for hardware and firmware info

Some Bluetooth controllers allow for reading hardware and firmware
related vendor specific infos. If they are available, then they can be

Bluetooth: Add debugfs fields for hardware and firmware info

Some Bluetooth controllers allow for reading hardware and firmware
related vendor specific infos. If they are available, then they can be
exposed via debugfs now.

Signed-off-by: Marcel Holtmann <[email protected]>
Signed-off-by: Johan Hedberg <[email protected]>

show more ...

Bluetooth: Expose current Device ID information via debugfs

For debugging purposes it is good to be able to read the current
configured Device ID details.

Signed-off-by: Marcel Holtmann <marcel@hol

Bluetooth: Expose current Device ID information via debugfs

For debugging purposes it is good to be able to read the current
configured Device ID details.

Signed-off-by: Marcel Holtmann <[email protected]>
Signed-off-by: Johan Hedberg <[email protected]>

show more ...

Bluetooth: Expose quirks through debugfs

This patch expose controller quirks through debugfs. It would be
useful for BlueZ tests using vhci. Currently there is no way to
test quirk dependent behavio

Bluetooth: Expose quirks through debugfs

This patch expose controller quirks through debugfs. It would be
useful for BlueZ tests using vhci. Currently there is no way to
test quirk dependent behaviour. It might be also useful for manual
testing.

Signed-off-by: Jakub Pawlowski <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>

show more ...