https://bugzilla.kernel.org/show_bug.cgi?id=218199 Bug ID: 218199 Summary: Bluetooth: HCI_EV_REMOTE_EXT_FEATURES loss prevents connection abort Product: Drivers Version: 2.5 Hardware: Intel OS: Linux Status: NEW Severity: normal Priority: P3 Component: Bluetooth Assignee: linux-bluetooth@xxxxxxxxxxxxxxx Reporter: sy2239101@xxxxxxxxxxx Regression: No Our fuzzing tool finds a possible semantic bug in the Bluetooth system in Linux 6.7-rc2: When establishing a connection, the loss of HCI_EV_CONN_COMPLETE results in a connection failure, and the controller sends HCI_EV_DISCONN_COMPLETE to abort the connection. Even if HCI_EV_DISCONN_COMPLETE is lost, functions such as hci_conn_timeout (/net/bluetooth/hci_conn.c: 612), hci_abort_conn (/net/bluetooth/hci_conn.c: 2960), and hci_abort_conn_sync (/net/bluetooth/hci_sync.c: 5379) ensure that the connection is aborted. However, in our testing, when both HCI_EV_REMOTE_EXT_FEATURES and HCI_EV_DISCONN_COMPLETE are lost, it seems that hci_conn_timeout, hci_abort_conn, and hci_abort_conn_sync are not invoked, leading to the connection remaining un-aborted. We are not sure whether this is a semantic bug or an implementation feature in the Linux kernel. Any feedback would be appreciated, thanks! -- You may reply to this email to add a comment. You are receiving this mail because: You are the assignee for the bug.
