| From 1d87b88ba26eabd4745e158ecfd87c93a9b51dc2 Mon Sep 17 00:00:00 2001 |
| From: Szymon Janc <szymon.janc@codecoup.pl> |
| Date: Wed, 19 Jun 2019 00:47:47 +0200 |
| Subject: Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug |
| |
| From: Szymon Janc <szymon.janc@codecoup.pl> |
| |
| commit 1d87b88ba26eabd4745e158ecfd87c93a9b51dc2 upstream. |
| |
| Microsoft Surface Precision Mouse provides bogus identity address when |
| pairing. It connects with Static Random address but provides Public |
| Address in SMP Identity Address Information PDU. Address has same |
| value but type is different. Workaround this by dropping IRK if ID |
| address discrepancy is detected. |
| |
| > HCI Event: LE Meta Event (0x3e) plen 19 |
| LE Connection Complete (0x01) |
| Status: Success (0x00) |
| Handle: 75 |
| Role: Master (0x00) |
| Peer address type: Random (0x01) |
| Peer address: E0:52:33:93:3B:21 (Static) |
| Connection interval: 50.00 msec (0x0028) |
| Connection latency: 0 (0x0000) |
| Supervision timeout: 420 msec (0x002a) |
| Master clock accuracy: 0x00 |
| |
| .... |
| |
| > ACL Data RX: Handle 75 flags 0x02 dlen 12 |
| SMP: Identity Address Information (0x09) len 7 |
| Address type: Public (0x00) |
| Address: E0:52:33:93:3B:21 |
| |
| Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl> |
| Tested-by: Maarten Fonville <maarten.fonville@gmail.com> |
| Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199461 |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Marcel Holtmann <marcel@holtmann.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/bluetooth/smp.c | 13 +++++++++++++ |
| 1 file changed, 13 insertions(+) |
| |
| --- a/net/bluetooth/smp.c |
| +++ b/net/bluetooth/smp.c |
| @@ -2514,6 +2514,19 @@ static int smp_cmd_ident_addr_info(struc |
| goto distribute; |
| } |
| |
| + /* Drop IRK if peer is using identity address during pairing but is |
| + * providing different address as identity information. |
| + * |
| + * Microsoft Surface Precision Mouse is known to have this bug. |
| + */ |
| + if (hci_is_identity_address(&hcon->dst, hcon->dst_type) && |
| + (bacmp(&info->bdaddr, &hcon->dst) || |
| + info->addr_type != hcon->dst_type)) { |
| + bt_dev_err(hcon->hdev, |
| + "ignoring IRK with invalid identity address"); |
| + goto distribute; |
| + } |
| + |
| bacpy(&smp->id_addr, &info->bdaddr); |
| smp->id_addr_type = info->addr_type; |
| |
