Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bluetooth: Add a validation for le_conn_update_complete() and bt_hci_le_subrate_change_event() #79584

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

swkim101
Copy link
Contributor

@swkim101 swkim101 commented Oct 9, 2024

Like 2ca179c, check and warn if incoming HCI event parameters exceed the specification to help debugging.
Although this does not strictly comply with the specification, I don't see any misuse (like div-by-zero).
So, adding warnings seems enough at this point.

subsys/bluetooth/host/hci_core.c Outdated Show resolved Hide resolved
@rugeGerritsen
Copy link
Collaborator

Should this code be behind some Kconfig symbol to avoid increasing binary size? A controller should never give values that are out of spec

@Thalley
Copy link
Collaborator

Thalley commented Oct 9, 2024

Should this code be behind some Kconfig symbol to avoid increasing binary size? A controller should never give values that are out of spec

It's a good question.

We have many (hopefully most) where we have some checks against what we receive from the controller.
Question is what the host should do if we receive invalid data from a controller, if anything.

Should we trust everything from the controller?
Should we distrust everything from the controller?

It's arguably weird that we only check a subset of data from the controller

Like 2ca179c, check and warn if incoming HCI event parameters exceed
the specification. This helps debugging controllers by detecting the
out-of-spec value that shouldn't appear.

Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
LOG_WRN("peripheral_latency exceeds the valid range 0x%04x",
conn->le.latency);
}
if (BT_HCI_LE_CONTINUATION_NUM_MAX < conn->le.subrate.continuation_number) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this not

Suggested change
if (BT_HCI_LE_CONTINUATION_NUM_MAX < conn->le.subrate.continuation_number) {
if (conn->le.subrate.continuation_number > BT_HCI_LE_CONTINUATION_NUM_MAX) {

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants