Bluetooth: Fix skb allocation in mgmt_remote_name() & mgmt_device_connected()
[ Upstream commitba17bb62ce
] This patch fixes skb allocation, as lack of space for ev might push skb tail beyond its end. Also introduce eir_precalc_len() that can be used instead of magic numbers for similar eir operations on skb. Fixes:cf1bce1de7
("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND") Fixes:e96741437e
("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_CONNECTED") Signed-off-by: Angela Czubak <acz@semihalf.com> Signed-off-by: Marek Maslanka <mm@semihalf.com> Signed-off-by: Radoslaw Biernacki <rad@semihalf.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
21ef1c8dbb
commit
0f526a6d3e
|
@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr);
|
||||||
u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len);
|
u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len);
|
||||||
u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len);
|
u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len);
|
||||||
|
|
||||||
|
static inline u16 eir_precalc_len(u8 data_len)
|
||||||
|
{
|
||||||
|
return sizeof(u8) * 2 + data_len;
|
||||||
|
}
|
||||||
|
|
||||||
static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type,
|
static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type,
|
||||||
u8 *data, u8 data_len)
|
u8 *data, u8 data_len)
|
||||||
{
|
{
|
||||||
|
|
|
@ -9086,12 +9086,14 @@ void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
|
||||||
u16 eir_len = 0;
|
u16 eir_len = 0;
|
||||||
u32 flags = 0;
|
u32 flags = 0;
|
||||||
|
|
||||||
|
/* allocate buff for LE or BR/EDR adv */
|
||||||
if (conn->le_adv_data_len > 0)
|
if (conn->le_adv_data_len > 0)
|
||||||
skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
|
skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
|
||||||
conn->le_adv_data_len);
|
sizeof(*ev) + conn->le_adv_data_len);
|
||||||
else
|
else
|
||||||
skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
|
skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
|
||||||
2 + name_len + 5);
|
sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
|
||||||
|
eir_precalc_len(sizeof(conn->dev_class)));
|
||||||
|
|
||||||
ev = skb_put(skb, sizeof(*ev));
|
ev = skb_put(skb, sizeof(*ev));
|
||||||
bacpy(&ev->addr.bdaddr, &conn->dst);
|
bacpy(&ev->addr.bdaddr, &conn->dst);
|
||||||
|
@ -9707,13 +9709,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
|
||||||
{
|
{
|
||||||
struct sk_buff *skb;
|
struct sk_buff *skb;
|
||||||
struct mgmt_ev_device_found *ev;
|
struct mgmt_ev_device_found *ev;
|
||||||
u16 eir_len;
|
u16 eir_len = 0;
|
||||||
u32 flags;
|
u32 flags = 0;
|
||||||
|
|
||||||
if (name_len)
|
skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
|
||||||
skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len);
|
sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
|
||||||
else
|
|
||||||
skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0);
|
|
||||||
|
|
||||||
ev = skb_put(skb, sizeof(*ev));
|
ev = skb_put(skb, sizeof(*ev));
|
||||||
bacpy(&ev->addr.bdaddr, bdaddr);
|
bacpy(&ev->addr.bdaddr, bdaddr);
|
||||||
|
@ -9723,10 +9723,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
|
||||||
if (name) {
|
if (name) {
|
||||||
eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
|
eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
|
||||||
name_len);
|
name_len);
|
||||||
flags = 0;
|
|
||||||
skb_put(skb, eir_len);
|
skb_put(skb, eir_len);
|
||||||
} else {
|
} else {
|
||||||
eir_len = 0;
|
|
||||||
flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
|
flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue