From: Jiri Slaby <jslaby@suse.cz>
To: stable@vger.kernel.org
Cc: linux-kernel@vger.kernel.org,
Claudio Takahasi <claudio.takahasi@openbossa.org>,
Johan Hedberg <johan.hedberg@intel.com>,
Jiri Slaby <jslaby@suse.cz>
Subject: [PATCH 3.12 35/50] Bluetooth: Fix removing Long Term Key
Date: Mon, 5 May 2014 14:43:17 +0200 [thread overview]
Message-ID: <626d6cde21ad38e531efeb37f3ae81920e8c9a2f.1399292849.git.jslaby@suse.cz> (raw)
In-Reply-To: <7d4f4737432af6216e86975e587331b9d8b08063.1399292849.git.jslaby@suse.cz>
In-Reply-To: <cover.1399292849.git.jslaby@suse.cz>
From: Claudio Takahasi <claudio.takahasi@openbossa.org>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 5981a8821b774ada0be512fd9bad7c241e17657e upstream.
This patch fixes authentication failure on LE link re-connection when
BlueZ acts as slave (peripheral). LTK is removed from the internal list
after its first use causing PIN or Key missing reply when re-connecting
the link. The LE Long Term Key Request event indicates that the master
is attempting to encrypt or re-encrypt the link.
Pre-condition: BlueZ host paired and running as slave.
How to reproduce(master):
1) Establish an ACL LE encrypted link
2) Disconnect the link
3) Try to re-establish the ACL LE encrypted link (fails)
> HCI Event: LE Meta Event (0x3e) plen 19
LE Connection Complete (0x01)
Status: Success (0x00)
Handle: 64
Role: Slave (0x01)
...
@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000
> HCI Event: LE Meta Event (0x3e) plen 13
LE Long Term Key Request (0x05)
Handle: 64
Random number: 875be18439d9aa37
Encryption diversifier: 0x76ed
< HCI Command: LE Long Term Key Request Reply (0x08|0x001a) plen 18
Handle: 64
Long term key: 2aa531db2fce9f00a0569c7d23d17409
> HCI Event: Command Complete (0x0e) plen 6
LE Long Term Key Request Reply (0x08|0x001a) ncmd 1
Status: Success (0x00)
Handle: 64
> HCI Event: Encryption Change (0x08) plen 4
Status: Success (0x00)
Handle: 64
Encryption: Enabled with AES-CCM (0x01)
...
@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 3
< HCI Command: LE Set Advertise Enable (0x08|0x000a) plen 1
Advertising: Enabled (0x01)
> HCI Event: Command Complete (0x0e) plen 4
LE Set Advertise Enable (0x08|0x000a) ncmd 1
Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 19
LE Connection Complete (0x01)
Status: Success (0x00)
Handle: 64
Role: Slave (0x01)
...
@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000
> HCI Event: LE Meta Event (0x3e) plen 13
LE Long Term Key Request (0x05)
Handle: 64
Random number: 875be18439d9aa37
Encryption diversifier: 0x76ed
< HCI Command: LE Long Term Key Request Neg Reply (0x08|0x001b) plen 2
Handle: 64
> HCI Event: Command Complete (0x0e) plen 6
LE Long Term Key Request Neg Reply (0x08|0x001b) ncmd 1
Status: Success (0x00)
Handle: 64
> HCI Event: Disconnect Complete (0x05) plen 4
Status: Success (0x00)
Handle: 64
Reason: Authentication Failure (0x05)
@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 0
Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
net/bluetooth/hci_event.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 8db3e89fae35..a3af2b750e96 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3565,7 +3565,13 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
- if (ltk->type & HCI_SMP_STK) {
+ /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
+ * temporary key used to encrypt a connection following
+ * pairing. It is used during the Encrypted Session Setup to
+ * distribute the keys. Later, security can be re-established
+ * using a distributed LTK.
+ */
+ if (ltk->type == HCI_SMP_STK_SLAVE) {
list_del(<k->list);
kfree(ltk);
}
--
1.9.2
next prev parent reply other threads:[~2014-05-05 12:57 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-05 12:28 [PATCH 3.12 00/50] 3.12.19-stable review Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 01/50] openvswitch: fix vport-netdev unregister Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 02/50] brcmsmac: fix deadlock on missing firmware Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 03/50] /dev/mem: handle out-of-bounds read/write Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 04/50] drivers/net: tulip_remove_one needs to call pci_disable_device() Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 05/50] Bluetooth: Add support for Intel Bluetooth device [8087:0a2a] Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 06/50] iommu/amd: Fix PASID format in INVALIDATE_IOTLB_PAGES command Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 07/50] usbatm: Fix dynamic_debug / ratelimited atm_dbg and atm_rldbg macros Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 08/50] printk: pr_debug_ratelimited: check state first to reduce "callbacks suppressed" messages Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 09/50] dcache: restore error on restart in prepend_path Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 10/50] __dentry_path() fixes Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 11/50] i2c: i801: enable Intel BayTrail SMBUS Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 12/50] e1000e: Fix no connectivity when driver loaded with cable out Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 13/50] ACPI / EC: Process rather than discard events in acpi_ec_clear Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 14/50] ARM: 7840/1: LPAE: don't reject mapping /dev/mem above 4GB Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 15/50] x86/quirks: Add workaround for AMD F16h Erratum792 Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 16/50] amd64_edac: Fix logic to determine channel for F15 M30h processors Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 17/50] backing_dev: fix hung task on sync Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 18/50] bdi: avoid oops on device removal Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 19/50] virtio_balloon: don't softlockup on huge balloon changes Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 20/50] ipmi: Fix a race restarting the timer Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 21/50] KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155) Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 22/50] net: ipv4: current group_info should be put after using Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 24/50] powerpc/8xx: mfspr SPRN_TBRx in lieu of mftb/mftbu is not supported Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 25/50] ACPI / sleep: remove panic in case hardware has changed after S4 Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 26/50] user namespace: fix incorrect memory barriers Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 27/50] x86: Adjust irq remapping quirk for older revisions of 5500/5520 chipsets Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 28/50] PCI: designware: Fix RC BAR to be single 64-bit non-prefetchable memory BAR Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 29/50] PCI: designware: Fix iATU programming for cfg1, io and mem viewport Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 30/50] ACPI / button: Add ACPI Button event via netlink routine Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 31/50] staging: comedi: 8255_pci: initialize MITE data window Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 32/50] tty: Set correct tty name in 'active' sysfs attribute Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 33/50] tty: Fix low_latency BUG Jiri Slaby
2014-05-05 12:43 ` Jiri Slaby [this message]
2014-05-05 12:43 ` [PATCH 3.12 36/50] xfs: fix directory hash ordering bug Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 37/50] Btrfs: skip submitting barrier for missing device Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 38/50] Btrfs: fix deadlock with nested trans handles Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 39/50] ext4: fix error return from ext4_ext_handle_uninitialized_extents() Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 40/50] ext4: fix partial cluster handling for bigalloc file systems Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 41/50] ext4: fix premature freeing of partial clusters split across leaf blocks Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 42/50] jffs2: Fix segmentation fault found in stress test Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 43/50] jffs2: Fix crash due to truncation of csize Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 44/50] jffs2: avoid soft-lockup in jffs2_reserve_space_gc() Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 45/50] jffs2: remove from wait queue after schedule() Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 46/50] sparc32: fix build failure for arch_jump_label_transform Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 47/50] sparc64: don't treat 64-bit syscall return codes as 32-bit Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 48/50] sparc64: Make sure %pil interrupts are enabled during hypervisor yield Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 49/50] wait: fix reparent_leader() vs EXIT_DEAD->EXIT_ZOMBIE race Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 50/50] exit: call disassociate_ctty() before exit_task_namespaces() Jiri Slaby
2014-05-05 15:45 ` [PATCH 3.12 00/50] 3.12.19-stable review Guenter Roeck
2014-05-06 14:57 ` Shuah Khan
2014-05-09 8:32 ` Jiri Slaby
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=626d6cde21ad38e531efeb37f3ae81920e8c9a2f.1399292849.git.jslaby@suse.cz \
--to=jslaby@suse.cz \
--cc=claudio.takahasi@openbossa.org \
--cc=johan.hedberg@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).