* [BUG 0 / 6] L2cap: Spec violations
@ 2022-11-18 3:52 Sungwoo Kim
2022-11-18 3:55 ` [BUG 1 " Sungwoo Kim
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: Sungwoo Kim @ 2022-11-18 3:52 UTC (permalink / raw)
To: marcel
Cc: johan.hedberg, luiz.dentz, davem, edumazet, kuba, pabeni,
linux-bluetooth, netdev, linux-kernel
Hello,
Our fuzzer found six spec violations, illegal state transition.
1. BT_CONNECT2 -> BT_CONFIG by L2CAP_CONN_RSP
2. BT_CONNECT2 -> BT_CONNECTED by L2CAP_CONF_RSP
3. BT_CONNECT2 -> BT_DISCONN by L2CAP_CONF_RSP
4. BT_CONNECTED -> BT_CONFIG by L2CAP_CONN_RSP
5. BT_DISCONN -> BT_CONFIG by L2CAP_CONN_RSP
6. BT_DISCONN -> BT_CONNECTED by L2CAP_CONN_RSP
All expected behaviors are ignoring incoming packets as described in
the spec v5.3 | Vol 3, Part A 6. STATE MACHINE.
Also, I assumed BT_CONNECT2 is corresponding to WAIT_CONNECT in the spec.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [BUG 1 / 6] L2cap: Spec violations
2022-11-18 3:52 [BUG 0 / 6] L2cap: Spec violations Sungwoo Kim
@ 2022-11-18 3:55 ` Sungwoo Kim
2022-11-18 4:02 ` [BUG 2 " Sungwoo Kim
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Sungwoo Kim @ 2022-11-18 3:55 UTC (permalink / raw)
To: iam
Cc: davem, edumazet, johan.hedberg, kuba, linux-bluetooth,
linux-kernel, luiz.dentz, marcel, netdev, pabeni
1. BT_CONNECT2 -> BT_CONFIG by L2CAP_CONN_RSP
btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 15.924193
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 15.935617
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 15.935617
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 15.942943
invalid packet size (16 != 2061)
0c 00 01 00 03 01 08 00 00 00 00 00 00 00 00 00 ................
^ permalink raw reply [flat|nested] 7+ messages in thread
* [BUG 2 / 6] L2cap: Spec violations
2022-11-18 3:52 [BUG 0 / 6] L2cap: Spec violations Sungwoo Kim
2022-11-18 3:55 ` [BUG 1 " Sungwoo Kim
@ 2022-11-18 4:02 ` Sungwoo Kim
2022-11-18 4:02 ` [BUG 3 " Sungwoo Kim
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Sungwoo Kim @ 2022-11-18 4:02 UTC (permalink / raw)
To: iam
Cc: davem, edumazet, johan.hedberg, kuba, linux-bluetooth,
linux-kernel, luiz.dentz, marcel, netdev, pabeni
2. BT_CONNECT2 -> BT_CONNECTED by L2CAP_CONF_RSP
btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 23.498353
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 23.498635
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 23.498635
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
= bluetoothd: Failed to obtain handles for "Service Changed" char.. 23.555719
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 23.527295
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 90 00 07 00 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 1547 #34 [hci0] 23.538671
invalid packet size (14 != 1547)
0a 00 01 00 05 01 06 00 40 00 00 00 00 00 ........@.....
^ permalink raw reply [flat|nested] 7+ messages in thread
* [BUG 3 / 6] L2cap: Spec violations
2022-11-18 3:52 [BUG 0 / 6] L2cap: Spec violations Sungwoo Kim
2022-11-18 3:55 ` [BUG 1 " Sungwoo Kim
2022-11-18 4:02 ` [BUG 2 " Sungwoo Kim
@ 2022-11-18 4:02 ` Sungwoo Kim
2022-11-18 4:03 ` [BUG 4 " Sungwoo Kim
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Sungwoo Kim @ 2022-11-18 4:02 UTC (permalink / raw)
To: iam
Cc: davem, edumazet, johan.hedberg, kuba, linux-bluetooth,
linux-kernel, luiz.dentz, marcel, netdev, pabeni
3. BT_CONNECT2 -> BT_DISCONN by L2CAP_CONF_RSP
btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.266186
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 14.282303
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 14.282303
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
= bluetoothd: Failed to obtain handles for "Service Changed" char.. 14.362392
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 14.283096
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 01 02 00 00 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.299480
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 02 00 ff ff ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.300143
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 01 00 00 01 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 1547 #36 [hci0] 14.300750
invalid packet size (14 != 1547)
0a 00 01 00 05 01 06 00 40 00 ff ff 01 00 ........@.....
^ permalink raw reply [flat|nested] 7+ messages in thread
* [BUG 4 / 6] L2cap: Spec violations
2022-11-18 3:52 [BUG 0 / 6] L2cap: Spec violations Sungwoo Kim
` (2 preceding siblings ...)
2022-11-18 4:02 ` [BUG 3 " Sungwoo Kim
@ 2022-11-18 4:03 ` Sungwoo Kim
2022-11-18 4:03 ` [BUG 5 " Sungwoo Kim
2022-11-18 4:03 ` [BUG 6 " Sungwoo Kim
5 siblings, 0 replies; 7+ messages in thread
From: Sungwoo Kim @ 2022-11-18 4:03 UTC (permalink / raw)
To: iam
Cc: davem, edumazet, johan.hedberg, kuba, linux-bluetooth,
linux-kernel, luiz.dentz, marcel, netdev, pabeni
4. BT_CONNECTED -> BT_CONFIG by L2CAP_CONN_RSP
btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 12.003575
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 12.024700
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 12.024700
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
= bluetoothd: Failed to obtain handles for "Service Changed" char.. 12.049885
> ACL Data RX: Handle 200 flags 0x00 dlen 1804 #33 [hci0] 12.003613
invalid packet size (15 != 1804)
0b 00 01 00 04 01 07 00 40 00 00 00 05 01 00 ........@......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 12.004416
invalid packet size (16 != 2061)
0c 00 01 00 05 01 08 00 40 00 00 00 01 00 ff 80 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 12.004968
invalid packet size (16 != 2061)
0c 00 01 00 03 01 08 00 00 00 00 00 00 00 00 00 ................
^ permalink raw reply [flat|nested] 7+ messages in thread
* [BUG 5 / 6] L2cap: Spec violations
2022-11-18 3:52 [BUG 0 / 6] L2cap: Spec violations Sungwoo Kim
` (3 preceding siblings ...)
2022-11-18 4:03 ` [BUG 4 " Sungwoo Kim
@ 2022-11-18 4:03 ` Sungwoo Kim
2022-11-18 4:03 ` [BUG 6 " Sungwoo Kim
5 siblings, 0 replies; 7+ messages in thread
From: Sungwoo Kim @ 2022-11-18 4:03 UTC (permalink / raw)
To: iam
Cc: davem, edumazet, johan.hedberg, kuba, linux-bluetooth,
linux-kernel, luiz.dentz, marcel, netdev, pabeni
5. BT_DISCONN -> BT_CONFIG by L2CAP_CONN_RSP
btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 11.525124
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 11.546310
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 11.546310
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 11.540575
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 07 02 00 00 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 11.543844
invalid packet size (16 != 2061)
0c 00 01 00 03 01 08 00 00 00 00 00 00 00 00 00 ................
^ permalink raw reply [flat|nested] 7+ messages in thread
* [BUG 6 / 6] L2cap: Spec violations
2022-11-18 3:52 [BUG 0 / 6] L2cap: Spec violations Sungwoo Kim
` (4 preceding siblings ...)
2022-11-18 4:03 ` [BUG 5 " Sungwoo Kim
@ 2022-11-18 4:03 ` Sungwoo Kim
5 siblings, 0 replies; 7+ messages in thread
From: Sungwoo Kim @ 2022-11-18 4:03 UTC (permalink / raw)
To: iam
Cc: davem, edumazet, johan.hedberg, kuba, linux-bluetooth,
linux-kernel, luiz.dentz, marcel, netdev, pabeni
6. BT_DISCONN -> BT_CONNECTED by L2CAP_CONN_RSP
btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.240003
= Note: Bluetooth subsystem version 2.22 0.240035
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 12.777814
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0001} [hci0] 12.797646
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Connected (0x000b) plen 13 {0x0002} [hci0] 12.797646
BR/EDR Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
Flags: 0x00000000
Data length: 0
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #33 [hci0] 12.778616
invalid packet size (16 != 2061)
0c 00 01 00 03 01 08 00 00 00 00 00 00 00 00 00 ................
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 12.778858
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 07 00 00 01 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 12.778882
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 07 02 00 00 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 1547 #36 [hci0] 12.778905
invalid packet size (14 != 1547)
0a 00 01 00 05 01 06 00 40 00 00 00 00 00 ........@.....
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-11-18 4:05 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-18 3:52 [BUG 0 / 6] L2cap: Spec violations Sungwoo Kim
2022-11-18 3:55 ` [BUG 1 " Sungwoo Kim
2022-11-18 4:02 ` [BUG 2 " Sungwoo Kim
2022-11-18 4:02 ` [BUG 3 " Sungwoo Kim
2022-11-18 4:03 ` [BUG 4 " Sungwoo Kim
2022-11-18 4:03 ` [BUG 5 " Sungwoo Kim
2022-11-18 4:03 ` [BUG 6 " Sungwoo Kim
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).