Public bug reported:
[ Impact ]
The Qualcomm IQ-X running resolute acting as a GATT server always fails
to start advertising. Registering an advertisement fails with
org.bluez.Error.Failed:
[bluetoothctl]> power on
Changing power on succeeded
[bluetoothctl]> advertise on
Failed to register advertisement: org.bluez.Error.Failed
This means BlueZ cannot advertise on controllers that use the extended
advertising commands, so any use case relying on advertising (GATT
server, peripheral role, BLE advertising) is broken.
Root cause: when extended advertising is used, add_adv_params_callback()
in the MGMT_OP_ADD_EXT_ADV_DATA path computes the parameter length
incorrectly. It uses:
param_len = sizeof(mgmt_cp_add_advertising) + adv_data_len + scan_rsp_len
= 11 + X + Y
but the kernel's add_ext_adv_data() expects:
expected = 3 + X + Y
Since 11 + X + Y ≠ 3 + X + Y, the kernel rejects the command with
MGMT_STATUS_INVALID_PARAMS and advertising never starts.
Upstream fix:
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=2a6968b40378dca5650e18e03ad0407738c47be5
[ Test Plan ]
On a machine with a controller that supports extended advertising, run:
1. bluetoothctl
2. power on
3. advertise on
Without the fix: registering the advertisement fails with:
Failed to register advertisement: org.bluez.Error.Failed
With the fix: advertising is registered successfully and the device
starts advertising.
[ Where problems could occur ]
The change touches the parameter length calculation in the extended
advertising (MGMT_OP_ADD_EXT_ADV_DATA) code path. If the fix were wrong,
it could show up as advertising still failing, or as malformed
advertising data being sent to the controller.
The change is confined to the extended advertising path, so any
regression would be limited to advertising on controllers that use
extended advertising commands, and would not affect legacy advertising
or other Bluetooth functionality.
[ Other Info ]
This is a small, targeted fix that corrects the parameter length so it
matches what the kernel expects for MGMT_OP_ADD_EXT_ADV_DATA.
The change is a direct backport of the upstream commit and does not
introduce any new behaviour beyond correcting the length calculation.
** Affects: bluez (Ubuntu)
Importance: Undecided
Status: New
** Tags: fixed-upstream
** Summary changed:
- [SRU][Resolute] Fix use-after-free caused by reentrant client teardown in
GATT Client
+ [SRU][Resolute] Fix sending extra bytes with MGMT_OP_ADD_EXT_ADV_DATA
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164626
Title:
[SRU][Resolute] Fix sending extra bytes with MGMT_OP_ADD_EXT_ADV_DATA
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/2164626/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
