[v1] Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address

Commit Message

Luiz Augusto von Dentz April 1, 2025, 5:10 p.m. UTC

From: Luiz Augusto von Dentz <[e-mail]>

This fixes sending MGMT_EV_DEVICE_FOUND for invalid address
(00:00:00:00:00:00) which is a regression introduced by
a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report")
since in the attempt to skip storing data for extended advertisement it
actually made the code to skip the entire if statement supposed to send
MGMT_EV_DEVICE_FOUND without attempting to use the last_addr_adv which
is garanteed to be invalid for extended advertisement since we never
store anything on it.

Link: https://github.com/bluez/bluez/issues/1157
Link: https://github.com/bluez/bluez/issues/1149#issuecomment-2767215658
Fixes: a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report")
Signed-off-by: Luiz Augusto von Dentz <[e-mail]>
---
 net/bluetooth/hci_event.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

[e-mail] April 1, 2025, 5:32 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=949043

---Test result---

Test Summary:
CheckPatch                    PENDING   0.29 seconds
GitLint                       PENDING   0.20 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      24.76 seconds
CheckAllWarning               PASS      27.30 seconds
CheckSparse                   WARNING   31.23 seconds
BuildKernel32                 PASS      24.66 seconds
TestRunnerSetup               PASS      437.15 seconds
TestRunner_l2cap-tester       PASS      21.70 seconds
TestRunner_iso-tester         PASS      35.11 seconds
TestRunner_bnep-tester        PASS      4.87 seconds
TestRunner_mgmt-tester        FAIL      121.19 seconds
TestRunner_rfcomm-tester      PASS      8.05 seconds
TestRunner_sco-tester         PASS      12.83 seconds
TestRunner_ioctl-tester       PASS      8.55 seconds
TestRunner_mesh-tester        PASS      6.24 seconds
TestRunner_smp-tester         PASS      7.49 seconds
TestRunner_userchan-tester    PASS      5.13 seconds
IncrementalBuild              PENDING   0.94 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 490, Passed: 484 (98.8%), Failed: 2, Not Run: 4

Failed Test Cases
LL Privacy - Add Device 3 (AL is full)               Failed       0.202 seconds
LL Privacy - Set Flags 3 (2 Devices to RL)           Failed       0.176 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

[e-mail] April 2, 2025, 9:10 p.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Tue,  1 Apr 2025 13:10:13 -0400 you wrote:
> From: Luiz Augusto von Dentz <[e-mail]>
> 
> This fixes sending MGMT_EV_DEVICE_FOUND for invalid address
> (00:00:00:00:00:00) which is a regression introduced by
> a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report")
> since in the attempt to skip storing data for extended advertisement it
> actually made the code to skip the entire if statement supposed to send
> MGMT_EV_DEVICE_FOUND without attempting to use the last_addr_adv which
> is garanteed to be invalid for extended advertisement since we never
> store anything on it.
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
    https://git.kernel.org/bluetooth/bluetooth-next/c/32b70317f41c

You are awesome, thank you!

Patch

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 1d8616f2e740..5f808f0b0e9a 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6160,11 +6160,12 @@  static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 	 * event or send an immediate device found event if the data
 	 * should not be stored for later.
 	 */
-	if (!ext_adv &&	!has_pending_adv_report(hdev)) {
+	if (!has_pending_adv_report(hdev)) {
 		/* If the report will trigger a SCAN_REQ store it for
 		 * later merging.
 		 */
-		if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
+		if (!ext_adv && (type == LE_ADV_IND ||
+				 type == LE_ADV_SCAN_IND)) {
 			store_pending_adv_report(hdev, bdaddr, bdaddr_type,
 						 rssi, flags, data, len);
 			return;