Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bluetooth: controller: Add conn creation param checks #35527

Merged
merged 1 commit into from
May 21, 2021

Conversation

carlescufi
Copy link
Member

Coverity detected that a zero divisor can be passed to
ll_create_connection() without parameter sanitization. Conditionally
check the connection creation parameters according to spec.

Fixes #35343.

Signed-off-by: Carles Cufi carles.cufi@nordicsemi.no

@carlescufi carlescufi requested a review from joerchan May 21, 2021 09:45
@carlescufi carlescufi added the bug The issue is a bug, or the PR is fixing a bug label May 21, 2021
@carlescufi carlescufi added this to the v2.6.0 milestone May 21, 2021
conn_latency,
supervision_timeout);
if (status) {
goto exit;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Align with the other early returns in error handling. Confusing to combine two patterns for this.

Suggested change
goto exit;
*evt = cmd_status(status);
return;

(or goto exit in both places)

conn_latency,
supervision_timeout);
if (status) {
goto exit;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here as above.

* sto * 10 > (1 + lat) * ci * 2.5
* sto * 2 > (1 + lat) * ci * 0.5
*/
if ((supervision_timeout << 1) < (1 + conn_latency) * (conn_interval_max >> 1)) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't this introduce a rounding error on conn. interval?

Say: STO=10, LAT=5 and CI=7
100 > 6 * 7 * 2.5 = 105
vs
20 > 6 * 3 = 18

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of re-inventing, maybe just re-use the host expression?

((supervision_timeout  * 4U) <= ((1U + conn_latency) * conn_interval_max))

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, I can add a partial fix for that

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@thoh-ot I've added a compensation for the rounding error.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of re-inventing, maybe just re-use the host expression?

I missed this comment, sure that makes sense. Thanks @joerchan

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done now, thanks both!

@carlescufi carlescufi force-pushed the divisor-cov branch 2 times, most recently from 1596497 to e272f1e Compare May 21, 2021 13:46
Coverity detected that a zero divisor can be passed to
ll_create_connection() without parameter sanitization. Conditionally
check the connection creation parameters according to spec.

Fixes zephyrproject-rtos#35343.

Signed-off-by: Carles Cufi <carles.cufi@nordicsemi.no>
@carlescufi carlescufi merged commit 0e26836 into zephyrproject-rtos:main May 21, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: Bluetooth Controller area: Bluetooth bug The issue is a bug, or the PR is fixing a bug
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Coverity CID: 236079] Untrusted divisor in subsys/bluetooth/controller/hci/hci.c
4 participants