[PATCH 1/2] Bluetooth: SMP: ignore an all-zero IRK

[Brandon Williams]

An all-zero Identity Resolving Key "indicates that a device does not
have a valid resolvable private address" (Core Specification, Vol 3,
Part H, 3.6.4), and a controller given an all-zero peer IRK in its
resolving list accepts only the peer's identity address (Vol 6, Part B,
4.7).

smp_cmd_ident_addr_info() stores such a key like any other, and
hci_find_irk_by_rpa() then resolves addresses against it in the host.
As the key is known to everyone, any device can generate resolvable
private addresses that the host reports as the bonded peer.

Treat an all-zero IRK as if no identity key had been distributed: do
not store it, and keep the peer's other keys under its connection
address.

Assisted-by: LLM
Signed-off-by: Brandon Williams <turbine.bmw@xxxxxxxxx>
---
 net/bluetooth/smp.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 984b2d0b5e3e..fc75cf568471 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2624,6 +2624,16 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
 		goto distribute;
 	}
 
+	/* An all-zero IRK means the peer has no resolvable private address
+	 * (Core Specification, Vol 3, Part H, 3.6.4). The key is known to
+	 * everyone, so storing it would let any device pose as this peer
+	 * with resolvable private addresses generated from it.
+	 */
+	if (!memchr_inv(smp->irk, 0, sizeof(smp->irk))) {
+		bt_dev_dbg(hcon->hdev, "ignoring all-zero IRK");
+		goto distribute;
+	}
+
 	bacpy(&smp->id_addr, &info->bdaddr);
 	smp->id_addr_type = info->addr_type;
 
-- 
2.56.0