mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
This removes the bogus check for max > hcon->le_conn_max_interval since
the later is just the initial maximum conn interval not the maximum the
stack could support which is really 3200=4000ms.
In order to pass GAP/CONN/CPUP/BV-05-C one shall probably enter values
of the following fields in IXIT that would cause hci_check_conn_params
to fail:
TSPX_conn_update_int_min
TSPX_conn_update_int_max
TSPX_conn_update_peripheral_latency
TSPX_conn_update_supervision_timeout
Link: https://github.com/bluez/bluez/issues/847
Fixes: e4b019515f
("Bluetooth: Enforce validation on max value of connection interval")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
parent
86fbd9f63a
commit
806a5198c0
|
@ -2113,18 +2113,46 @@ static inline int hci_check_conn_params(u16 min, u16 max, u16 latency,
|
||||||
{
|
{
|
||||||
u16 max_latency;
|
u16 max_latency;
|
||||||
|
|
||||||
if (min > max || min < 6 || max > 3200)
|
if (min > max) {
|
||||||
|
BT_WARN("min %d > max %d", min, max);
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
if (to_multiplier < 10 || to_multiplier > 3200)
|
if (min < 6) {
|
||||||
|
BT_WARN("min %d < 6", min);
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
if (max >= to_multiplier * 8)
|
if (max > 3200) {
|
||||||
|
BT_WARN("max %d > 3200", max);
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (to_multiplier < 10) {
|
||||||
|
BT_WARN("to_multiplier %d < 10", to_multiplier);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (to_multiplier > 3200) {
|
||||||
|
BT_WARN("to_multiplier %d > 3200", to_multiplier);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (max >= to_multiplier * 8) {
|
||||||
|
BT_WARN("max %d >= to_multiplier %d * 8", max, to_multiplier);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
max_latency = (to_multiplier * 4 / max) - 1;
|
max_latency = (to_multiplier * 4 / max) - 1;
|
||||||
if (latency > 499 || latency > max_latency)
|
if (latency > 499) {
|
||||||
|
BT_WARN("latency %d > 499", latency);
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (latency > max_latency) {
|
||||||
|
BT_WARN("latency %d > max_latency %d", latency, max_latency);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
|
@ -4647,13 +4647,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
|
||||||
|
|
||||||
memset(&rsp, 0, sizeof(rsp));
|
memset(&rsp, 0, sizeof(rsp));
|
||||||
|
|
||||||
if (max > hcon->le_conn_max_interval) {
|
|
||||||
BT_DBG("requested connection interval exceeds current bounds.");
|
|
||||||
err = -EINVAL;
|
|
||||||
} else {
|
|
||||||
err = hci_check_conn_params(min, max, latency, to_multiplier);
|
err = hci_check_conn_params(min, max, latency, to_multiplier);
|
||||||
}
|
|
||||||
|
|
||||||
if (err)
|
if (err)
|
||||||
rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
|
rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
|
||||||
else
|
else
|
||||||
|
|
Loading…
Reference in a new issue