Skip to contentSkip to conversation

Patch "Bluetooth: Fix missing encryption refresh on Security Request" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Apr 3, 2018

Subsystems (2)
Stable branch Bluetooth
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

Bluetooth: Fix missing encryption refresh on Security Request

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
bluetooth-fix-missing-encryption-refresh-on-security-request.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 64e759f58f128730b97a3c3a26d283c075ad7c86 Mon Sep 17 00:00:00 2001

From: Szymon Janc <[email protected]>
Date: Mon, 26 Feb 2018 15:41:53 +0100
Subject: Bluetooth: Fix missing encryption refresh on Security Request

From: Szymon Janc <[email protected]>

commit 64e759f58f128730b97a3c3a26d283c075ad7c86 upstream.

If Security Request is received on connection that is already encrypted with sufficient security master should perform encryption key refresh procedure instead of just ignoring Slave Security Request (Core Spec 5.0 Vol 3 Part H 2.4.6).

Quoted 1 line

ACL Data RX: Handle 3585 flags 0x02 dlen 6

      SMP: Security Request (0x0b) len 1
        Authentication requirement: Bonding, No MITM, SC, No Keypresses (0x09)
< HCI Command: LE Start Encryption (0x08|0x0019) plen 28
        Handle: 3585
        Random number: 0x0000000000000000
        Encrypted diversifier: 0x0000
        Long term key: 44264272a5c426a9e868f034cf0e69f3
Quoted 1 line

HCI Event: Command Status (0x0f) plen 4

      LE Start Encryption (0x08|0x0019) ncmd 1
        Status: Success (0x00)
Quoted 1 line

HCI Event: Encryption Key Refresh Complete (0x30) plen 3

        Status: Success (0x00)
        Handle: 3585
Signed-off-by Szymon Janc <[email protected]>
Signed-off-by Marcel Holtmann <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 net/bluetooth/smp.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
net/bluetooth/smp.c +7 -1
@@ -2233,8 +2233,14 @@ static u8 smp_cmd_security_req(struct l2
 	else
 		sec_level = authreq_to_seclevel(auth);
 
-	if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
+	if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) {
+		/* If link is already encrypted with sufficient security we
+		 * still need refresh encryption as per Core Spec 5.0 Vol 3,
+		 * Part H 2.4.6
+		 */
+		smp_ltk_encrypt(conn, hcon->sec_level);
 		return 0;
+	}
 
 	if (sec_level > hcon->pending_sec_level)
 		hcon->pending_sec_level = sec_level;

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/bluetooth-fix-missing-encryption-refresh-on-security-request.patch