[PATCH] Bluetooth: SMP: Workaround Microsoft Surface Precision Mouse bug

[PATCH] Bluetooth: SMP: Workaround Microsoft Surface Precision Mouse bug

[Szymon Janc]

Microsoft Surface Precision Mouse provides bogus identity address when
pairing. It connects with Static Random address but provides Public
Address in SMP Identity Address Information PDU. Address has same
value but type is different. Workaround this by dropping IRK if ID
address discrepancy is detected.

> HCI Event: LE Meta Event (0x3e) plen 19
      LE Connection Complete (0x01)
        Status: Success (0x00)
        Handle: 75
        Role: Master (0x00)
        Peer address type: Random (0x01)
        Peer address: E0:52:33:93:3B:21 (Static)
        Connection interval: 50.00 msec (0x0028)
        Connection latency: 0 (0x0000)
        Supervision timeout: 420 msec (0x002a)
        Master clock accuracy: 0x00

....

> ACL Data RX: Handle 75 flags 0x02 dlen 12
      SMP: Identity Address Information (0x09) len 7
        Address type: Public (0x00)
        Address: E0:52:33:93:3B:21

Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
Tested-by: Maarten Fonville <maarten.fonville@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199461
Cc: stable@vger.kernel.org
---
 net/bluetooth/smp.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index e68c715f8d37..d528d95a2c27 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2579,6 +2579,20 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
 		goto distribute;
 	}
 
+	/*
+	 * Drop IRK if peer is using identity address during pairing but is
+	 * providing different address as identity information.
+	 *
+	 * Microsoft Surface Precision Mouse is known to have this bug.
+	 */
+	if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
+	    (bacmp(&info->bdaddr, &hcon->dst) ||
+	     info->addr_type != hcon->dst_type)) {
+		bt_dev_err(hcon->hdev,
+			   "ignoring IRK with invalid identity address");
+		goto distribute;
+	}
+
 	bacpy(&smp->id_addr, &info->bdaddr);
 	smp->id_addr_type = info->addr_type;
 
-- 
2.21.0

Re: [PATCH] Bluetooth: SMP: Workaround Microsoft Surface Precision Mouse bug

[Marcel Holtmann]

Hi Szymon,

> Microsoft Surface Precision Mouse provides bogus identity address when
> pairing. It connects with Static Random address but provides Public
> Address in SMP Identity Address Information PDU. Address has same
> value but type is different. Workaround this by dropping IRK if ID
> address discrepancy is detected.
> 
>> HCI Event: LE Meta Event (0x3e) plen 19
>      LE Connection Complete (0x01)
>        Status: Success (0x00)
>        Handle: 75
>        Role: Master (0x00)
>        Peer address type: Random (0x01)
>        Peer address: E0:52:33:93:3B:21 (Static)
>        Connection interval: 50.00 msec (0x0028)
>        Connection latency: 0 (0x0000)
>        Supervision timeout: 420 msec (0x002a)
>        Master clock accuracy: 0x00
> 
> ....
> 
>> ACL Data RX: Handle 75 flags 0x02 dlen 12
>      SMP: Identity Address Information (0x09) len 7
>        Address type: Public (0x00)
>        Address: E0:52:33:93:3B:21
> 
> Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
> Tested-by: Maarten Fonville <maarten.fonville@gmail.com>
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199461
> Cc: stable@vger.kernel.org
> ---
> net/bluetooth/smp.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)

patch has been applied to bluetooth-next tree.

Regards

Marcel

Re: [PATCH] Bluetooth: SMP: Workaround Microsoft Surface Precision Mouse bug

[Marcel Holtmann]

Hi Szymon,

> Microsoft Surface Precision Mouse provides bogus identity address when
> pairing. It connects with Static Random address but provides Public
> Address in SMP Identity Address Information PDU. Address has same
> value but type is different. Workaround this by dropping IRK if ID
> address discrepancy is detected.
> 
>> HCI Event: LE Meta Event (0x3e) plen 19
>      LE Connection Complete (0x01)
>        Status: Success (0x00)
>        Handle: 75
>        Role: Master (0x00)
>        Peer address type: Random (0x01)
>        Peer address: E0:52:33:93:3B:21 (Static)
>        Connection interval: 50.00 msec (0x0028)
>        Connection latency: 0 (0x0000)
>        Supervision timeout: 420 msec (0x002a)
>        Master clock accuracy: 0x00
> 
> ....
> 
>> ACL Data RX: Handle 75 flags 0x02 dlen 12
>      SMP: Identity Address Information (0x09) len 7
>        Address type: Public (0x00)
>        Address: E0:52:33:93:3B:21
> 
> Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
> Tested-by: Maarten Fonville <maarten.fonville@gmail.com>
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199461
> Cc: stable@vger.kernel.org
> ---
> net/bluetooth/smp.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)

patch has been applied to bluetooth-next tree.

Regards

Marcel