Re: [PATCH] Bluetooth: Fix for L2CAP/LE/CFC/BV-15-C

Cc: Szymon Janc <redacted>
---
 include/net/bluetooth/hci_core.h |  1 +
 net/bluetooth/hci_core.c         |  1 +
 net/bluetooth/hci_debugfs.c      | 30 ++++++++++++++++++++++++++++++
 net/bluetooth/l2cap_core.c       | 25 +++++++++++++++++++++++++
 4 files changed, 57 insertions(+)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ebdd4afe30d2..0bf0543efec5 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h

@@ -379,6 +379,7 @@ struct hci_dev {
        __u16           auth_payload_timeout;
        __u8            min_enc_key_size;
        __u8            max_enc_key_size;
+       __u8            le_l2cap_min_key_size;
        __u8            pairing_opts;
        __u8            ssp_debug_mode;
        __u8            hw_error_code;

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b0d9c36acc03..9ef4b39b380c 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c

@@ -3788,6 +3788,7 @@ struct hci_dev *hci_alloc_dev(void)
        hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
        hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
        hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
+       hdev->le_l2cap_min_key_size = HCI_MIN_ENC_KEY_SIZE;

        /* default 1.28 sec page scan */
        hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;

diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index 1a0ab58bfad0..dec8b96b8427 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c

@@ -1096,6 +1096,34 @@ static int max_key_size_get(void *data, u64 *val)
 DEFINE_DEBUGFS_ATTRIBUTE(max_key_size_fops, max_key_size_get,
                          max_key_size_set, "%llu\n");

+static int le_l2cap_min_key_size_set(void *data, u64 val)
+{
+       struct hci_dev *hdev = data;
+
+       if (val > SMP_MAX_ENC_KEY_SIZE || val < SMP_MIN_ENC_KEY_SIZE)
+               return -EINVAL;
+
+       hci_dev_lock(hdev);
+       hdev->le_l2cap_min_key_size = val;
+       hci_dev_unlock(hdev);
+
+       return 0;
+}
+
+static int le_l2cap_min_key_size_get(void *data, u64 *val)
+{
+       struct hci_dev *hdev = data;
+
+       hci_dev_lock(hdev);
+       *val = hdev->le_l2cap_min_key_size;
+       hci_dev_unlock(hdev);
+
+       return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(le_l2cap_min_key_size_fops, le_l2cap_min_key_size_get,
+                        le_l2cap_min_key_size_set, "%llu\n");
+
 static int auth_payload_timeout_set(void *data, u64 val)
 {
        struct hci_dev *hdev = data;

@@ -1226,6 +1254,8 @@ void hci_debugfs_create_le(struct hci_dev *hdev)
                            &min_key_size_fops);
        debugfs_create_file("max_key_size", 0644, hdev->debugfs, hdev,
                            &max_key_size_fops);
+       debugfs_create_file("le_l2cap_min_key_size", 0644, hdev->debugfs, hdev,
+                           &le_l2cap_min_key_size_fops);
        debugfs_create_file("auth_payload_timeout", 0644, hdev->debugfs, hdev,
                            &auth_payload_timeout_fops);
        debugfs_create_file("force_no_mitm", 0644, hdev->debugfs, hdev,

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 72c2f5226d67..d9a3a1c1f366 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c

@@ -5742,6 +5742,20 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
        return err;
 }

+static bool le_l2cap_key_size_sufficient(struct hci_conn *hcon, u8 sec_level)
+{
+       struct smp_ltk *ltk;
+
+       if (sec_level == BT_SECURITY_LOW)
+               return true;
+
+       ltk = hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, hcon->role);
+       if (ltk && ltk->enc_size >= hcon->hdev->le_l2cap_min_key_size)
+               return true;
+
+       return false;
+}
+
 static int l2cap_le_connect_req(struct l2cap_conn *conn,
                                struct l2cap_cmd_hdr *cmd, u16 cmd_len,
                                u8 *data)

@@ -5788,6 +5802,12 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,
                goto response_unlock;
        }

+       if (!le_l2cap_key_size_sufficient(conn->hcon, pchan->sec_level)) {
+               result = L2CAP_CR_LE_BAD_KEY_SIZE;
+               chan = NULL;
+               goto response_unlock;
+       }
+
        /* Check for valid dynamic CID range */
        if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
                result = L2CAP_CR_LE_INVALID_SCID;

@@ -5969,6 +5989,11 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
                goto unlock;
        }

+       if (!le_l2cap_key_size_sufficient(conn->hcon, pchan->sec_level)) {
+               result = L2CAP_CR_LE_BAD_KEY_SIZE;
+               goto unlock;
+       }
+
        result = L2CAP_CR_LE_SUCCESS;
        cmd_len -= sizeof(*req);
        num_scid = cmd_len / sizeof(u16);
--

2.25.1