fix(core): allow BLE pairing mode entry without setting device name
What the developer wrote
Authored by tychovrahe
fix(core): allow BLE pairing mode entry without setting device name
What changed, and why it matters
This commit fixes a bug in the Trezor hardware wallet's Bluetooth code. Previously, entering Bluetooth pairing mode required providing a device advertising name; if no name was supplied, the function immediately failed. The change now allows pairing mode to start without a name, only rejecting names that are too long. The changelog describes this as fixing 'ble-adv-start without args' in the production-test (factory/testing) project. This is a functional bug fix rather than a clear security vulnerability.
Treat as a routine functional fix. Review whether any callers relied on the previous rejection of empty names for security policy enforcement, and verify that downstream pairing flows still enforce naming or identity requirements where needed. No urgent security action is indicated by the diff alone.
Security signals we found
Behavioral change in Bluetooth pairing entry conditions
Input validation relaxed for NULL/empty name, tightened only for oversized name
No explicit security language in commit title, message, or changelog
Evidence from the diff
In core/embed/io/ble/stm32/ble.c, ble_enter_pairing_mode() no longer rejects NULL or zero-length name arguments. It now skips the advertising-name update when name is NULL/empty, copies the name only when it is within BLE_ADV_NAME_LEN, and returns false only when name_len exceeds the maximum. The prior early return prevented BLE pairing/advertising from starting when no name was configured. The added changelog fragment indicates the issue was encountered in prodtest as ‘ble-adv-start without args’.
Changed components
core/embed/io/ble/stm32/ble.cBLE pairing/advertising initialization on STM32 Trezor devicesprodtest (production test) Bluetooth advertising commandInspect captured patch +8 / −6
diff --git a/core/embed/io/ble/stm32/ble.c b/core/embed/io/ble/stm32/ble.c
index 38bad522d..55eddd27b 100644
--- a/core/embed/io/ble/stm32/ble.c
+++ b/core/embed/io/ble/stm32/ble.c
@@ -989,10 +989,6 @@ static void ble_event_flush(void) {
}
bool ble_enter_pairing_mode(const uint8_t *name, size_t name_len) {
- if (name == NULL || name_len == 0 || name_len > BLE_ADV_NAME_LEN) {
- return false;
- }
-
ble_driver_t *drv = &g_ble_driver;
if (!drv->initialized || !drv->enabled) {
@@ -1001,8 +997,13 @@ bool ble_enter_pairing_mode(const uint8_t *name, size_t name_len) {
irq_key_t key = irq_lock();
- memset(drv->adv_name, 0, sizeof(drv->adv_name));
- memcpy(drv->adv_name, name, name_len);
+ if (name != NULL && name_len > 0 && name_len <= BLE_ADV_NAME_LEN) {
+ memset(drv->adv_name, 0, sizeof(drv->adv_name));
+ memcpy(drv->adv_name, name, name_len);
+ } else if (name != NULL && name_len > BLE_ADV_NAME_LEN) {
+ return false;
+ }
+
drv->restart_adv_on_disconnect = true;
bool connected = drv->connected;
diff --git a/core/embed/projects/prodtest/.changelog.d/6010.fixed b/core/embed/projects/prodtest/.changelog.d/6010.fixed
new file mode 100644
index 000000000..e3303cc67
--- /dev/null
+++ b/core/embed/projects/prodtest/.changelog.d/6010.fixed
@@ -0,0 +1 @@
+Fix ble-adv-start without args.
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.