Bluetooth: hci_event: Mask data status from LE ext adv reports
Subsystems (2)
PATCH v2 1/1 Bluetooth: hci_event: Mask data status from LE ext adv reports
The Event_Type field in an LE Extended Advertising Report uses bits 5 and 6 for data status (e.g. truncation or fragmentation), not the PDU type itself.
The ext_evt_type_to_legacy() function fails to mask these status bits before evaluation. This causes valid advertisements with status bits set (e.g. a truncated non-connectable advertisement, which ends up showing as PDU type 0x40) to be misclassified as unknown and subsequently dropped. This is okay for most checks which use bitwise AND on the relevant event type bits, but it doesn't work for non-connectable types, which are checked with '== LE_EXT_ADV_NON_CONN_IND' (that is, zero).
In terms of behaviour, first the device sends a truncated report:
Quoted 1 line
HCI Event: LE Meta Event (
0x3e) plen 26
LE Extended Advertising Report (0x0d)
Entry 0
Event type: 0x0040
Data status: Incomplete, data truncated, no more to come
Address type: Random (0x01)
Address: 1D:12:46:FA:F8:6E (Non-Resolvable)
SID: 0x03
RSSI: -98 dBm (0x9e)
Data length: 0x00Then, a few seconds later, it sends the subsequent complete report:
Quoted 1 line
HCI Event: LE Meta Event (
0x3e) plen 122
LE Extended Advertising Report (0x0d)
Entry 0
Event type: 0x0000
Data status: Complete
Address type: Random (0x01)
Address: 1D:12:46:FA:F8:6E (Non-Resolvable)
SID: 0x03
RSSI: -97 dBm (0x9f)
Data length: 0x60
Service Data: Google (0xfef3)
Data[92]: ...These devices often send multiple truncated reports per second.
This patch introduces a PDU type mask to ensure only the relevant bits are evaluated, allowing for the correct translation of all valid extended advertising packets.
--- include/net/bluetooth/hci.h | 1 + net/bluetooth/hci_event.c | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-)
include/net/bluetooth/hci.h +1 -0
@@ -2630,6 +2630,7 @@ struct hci_ev_le_conn_complete {#define LE_EXT_ADV_DIRECT_IND 0x0004#define LE_EXT_ADV_SCAN_RSP 0x0008#define LE_EXT_ADV_LEGACY_PDU 0x0010 +#define LE_EXT_ADV_DATA_STATUS_MASK 0x0060#define LE_EXT_ADV_EVT_TYPE_MASK 0x007f#define ADDR_LE_DEV_PUBLIC 0x00
net/bluetooth/hci_event.c +5 -2
@@ -6264,6 +6264,10 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,static u8 ext_evt_type_to_legacy (struct hci_dev *hdev,u16 evt_type) { +u16 pdu_type = evt_type & ~LE_EXT_ADV_DATA_STATUS_MASK ; +if (!pdu_type) +return LE_ADV_NONCONN_IND ; +if (evt_type &LE_EXT_ADV_LEGACY_PDU ) {switch (evt_type) {case LE_LEGACY_ADV_IND :
@@ -6295,8 +6299,7 @@ static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)if (evt_type &LE_EXT_ADV_SCAN_IND )return LE_ADV_SCAN_IND ; -if (evt_type ==LE_EXT_ADV_NON_CONN_IND || - evt_type &LE_EXT_ADV_DIRECT_IND ) +if (evt_type &LE_EXT_ADV_DIRECT_IND )return LE_ADV_NONCONN_IND ; invalid:
Signature · 1 line
2.50.0
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=984368
---Test result---
Test Summary:
CheckPatch PENDING 0.32 seconds GitLint PENDING 0.23 seconds SubjectPrefix PASS 0.10 seconds BuildKernel PASS 23.81 seconds CheckAllWarning PASS 26.08 seconds CheckSparse WARNING 29.57 seconds BuildKernel32 PASS 23.97 seconds TestRunnerSetup PASS 481.61 seconds TestRunner_l2cap-tester PASS 25.59 seconds TestRunner_iso-tester PASS 44.57 seconds TestRunner_bnep-tester PASS 5.89 seconds TestRunner_mgmt-tester FAIL 131.04 seconds TestRunner_rfcomm-tester PASS 9.33 seconds TestRunner_sco-tester PASS 14.75 seconds TestRunner_ioctl-tester PASS 10.01 seconds TestRunner_mesh-tester FAIL 11.40 seconds TestRunner_smp-tester PASS 8.55 seconds TestRunner_userchan-tester PASS 6.19 seconds IncrementalBuild PENDING 0.66 seconds
Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script Output:
##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 490, Passed: 484 (98.8%), Failed: 2, Not Run: 4
Failed Test Cases
LL Privacy - Add Device 3 (AL is full) Failed 0.212 seconds LL Privacy - Set Flags 3 (2 Devices to RL) Failed 0.201 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 2.204 seconds Mesh - Send cancel - 2 Timed out 1.998 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series Output:
---
Regards,
Linux Bluetooth