Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug [Linux 4.9.187]

This Linux kernel change "Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug" is included in the Linux 4.9.187 release. This change is authored by Szymon Janc <szymon.janc [at] codecoup.pl> on Wed Jun 19 00:47:47 2019 +0200. The commit for this change in Linux stable tree is 8f3286c (patch) which is from upstream commit 1d87b88. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream 1d87b88.

Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug

commit 1d87b88ba26eabd4745e158ecfd87c93a9b51dc2 upstream.

Microsoft Surface Precision Mouse provides bogus identity address when
pairing. It connects with Static Random address but provides Public
Address in SMP Identity Address Information PDU. Address has same
value but type is different. Workaround this by dropping IRK if ID
address discrepancy is detected.

> HCI Event: LE Meta Event (0x3e) plen 19
      LE Connection Complete (0x01)
        Status: Success (0x00)
        Handle: 75
        Role: Master (0x00)
        Peer address type: Random (0x01)
        Peer address: E0:52:33:93:3B:21 (Static)
        Connection interval: 50.00 msec (0x0028)
        Connection latency: 0 (0x0000)
        Supervision timeout: 420 msec (0x002a)
        Master clock accuracy: 0x00

....

> ACL Data RX: Handle 75 flags 0x02 dlen 12
      SMP: Identity Address Information (0x09) len 7
        Address type: Public (0x00)
        Address: E0:52:33:93:3B:21

Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
Tested-by: Maarten Fonville <maarten.fonville@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199461
Cc: stable@vger.kernel.org
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There are 13 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 net/bluetooth/smp.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 1abfbcd8..6670b7f 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2514,6 +2514,19 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
        goto distribute;
    }

+   /* Drop IRK if peer is using identity address during pairing but is
+    * providing different address as identity information.
+    *
+    * Microsoft Surface Precision Mouse is known to have this bug.
+    */
+   if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
+       (bacmp(&info->bdaddr, &hcon->dst) ||
+        info->addr_type != hcon->dst_type)) {
+       bt_dev_err(hcon->hdev,
+              "ignoring IRK with invalid identity address");
+       goto distribute;
+   }
+
    bacpy(&smp->id_addr, &info->bdaddr);
    smp->id_addr_type = info->addr_type;

Leave a Reply

Your email address will not be published. Required fields are marked *