[v2] Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue

Commit Message

quic_zijuhu April 17, 2023, 9:39 a.m. UTC

API hci_devcd_init() stores its u32 type parameter @dump_size into
skb, but it does not specify which byte order is used to store the
integer, let us take little endian to store and parse the integer.

Fixes: f5cc609d09d4 ("Bluetooth: Add support for hci devcoredump")
Signed-off-by: Zijun Hu <[e-mail]>
---
 net/bluetooth/coredump.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

Comments

[e-mail] April 17, 2023, 10:34 a.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=740420

---Test result---

Test Summary:
CheckPatch                    PASS      0.71 seconds
GitLint                       PASS      0.34 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      31.81 seconds
CheckAllWarning               PASS      34.90 seconds
CheckSparse                   PASS      40.02 seconds
CheckSmatch                   PASS      109.25 seconds
BuildKernel32                 PASS      31.11 seconds
TestRunnerSetup               PASS      440.77 seconds
TestRunner_l2cap-tester       PASS      16.90 seconds
TestRunner_iso-tester         PASS      20.85 seconds
TestRunner_bnep-tester        PASS      5.56 seconds
TestRunner_mgmt-tester        PASS      114.94 seconds
TestRunner_rfcomm-tester      PASS      8.84 seconds
TestRunner_sco-tester         PASS      8.21 seconds
TestRunner_ioctl-tester       PASS      9.58 seconds
TestRunner_mesh-tester        PASS      6.94 seconds
TestRunner_smp-tester         PASS      8.07 seconds
TestRunner_userchan-tester    PASS      5.81 seconds
IncrementalBuild              PASS      29.67 seconds



---
Regards,
Linux Bluetooth

[e-mail] April 17, 2023, 6:30 p.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Mon, 17 Apr 2023 17:39:59 +0800 you wrote:
> API hci_devcd_init() stores its u32 type parameter @dump_size into
> skb, but it does not specify which byte order is used to store the
> integer, let us take little endian to store and parse the integer.
> 
> Fixes: f5cc609d09d4 ("Bluetooth: Add support for hci devcoredump")
> Signed-off-by: Zijun Hu <[e-mail]>
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue
    https://git.kernel.org/bluetooth/bluetooth-next/c/61cad9af36db

You are awesome, thank you!

Patch

diff --git a/net/bluetooth/coredump.c b/net/bluetooth/coredump.c
index 08fa98505454..d2d2624ec708 100644
--- a/net/bluetooth/coredump.c
+++ b/net/bluetooth/coredump.c
@@ -5,6 +5,7 @@ 
 
 #include <linux/devcoredump.h>
 
+#include <asm/unaligned.h>
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
@@ -180,25 +181,25 @@  static int hci_devcd_prepare(struct hci_dev *hdev, u32 dump_size)
 
 static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb)
 {
-	u32 *dump_size;
+	u32 dump_size;
 
 	if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) {
 		DBG_UNEXPECTED_STATE();
 		return;
 	}
 
-	if (skb->len != sizeof(*dump_size)) {
+	if (skb->len != sizeof(dump_size)) {
 		bt_dev_dbg(hdev, "Invalid dump init pkt");
 		return;
 	}
 
-	dump_size = skb_pull_data(skb, sizeof(*dump_size));
-	if (!*dump_size) {
+	dump_size = get_unaligned_le32(skb_pull_data(skb, 4));
+	if (!dump_size) {
 		bt_dev_err(hdev, "Zero size dump init pkt");
 		return;
 	}
 
-	if (hci_devcd_prepare(hdev, *dump_size)) {
+	if (hci_devcd_prepare(hdev, dump_size)) {
 		bt_dev_err(hdev, "Failed to prepare for dump");
 		return;
 	}
@@ -441,7 +442,7 @@  int hci_devcd_init(struct hci_dev *hdev, u32 dump_size)
 		return -ENOMEM;
 
 	hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT;
-	skb_put_data(skb, &dump_size, sizeof(dump_size));
+	put_unaligned_le32(dump_size, skb_put(skb, 4));
 
 	skb_queue_tail(&hdev->dump.dump_q, skb);
 	queue_work(hdev->workqueue, &hdev->dump.dump_rx);