| Message ID | 20210419171257.3865181-5-luiz.dentz@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Bluetooth: HCI: Use skb_pull to parse events | expand |
Hi Luiz, > This uses skb_pull to check the Inquiry Result events received have > the minimum required length. > > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > --- > include/net/bluetooth/hci.h | 5 +++++ > net/bluetooth/hci_event.c | 19 ++++++++++++++----- > 2 files changed, 19 insertions(+), 5 deletions(-) > > diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h > index 9251ae3a2ce0..b65205b4d830 100644 > --- a/include/net/bluetooth/hci.h > +++ b/include/net/bluetooth/hci.h > @@ -1910,6 +1910,11 @@ struct inquiry_info { > __le16 clock_offset; > } __packed; > > +struct hci_ev_inquiry_result { > + __u8 num; > + struct inquiry_info info[]; > +}; > + > #define HCI_EV_CONN_COMPLETE 0x03 > struct hci_ev_conn_complete { > __u8 status; > diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c > index c353dfafb04c..6516538fe238 100644 > --- a/net/bluetooth/hci_event.c > +++ b/net/bluetooth/hci_event.c > @@ -2990,13 +2990,21 @@ static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) > > static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb) > { > + struct hci_ev_inquiry_result *ev; > struct inquiry_data data; > - struct inquiry_info *info = (void *) (skb->data + 1); > - int num_rsp = *((__u8 *) skb->data); > + int i; > > - BT_DBG("%s num_rsp %d", hdev->name, num_rsp); > + ev = hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT, sizeof(*ev)); > + if (!ev) > + return; > > - if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1) > + if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT, > + flex_array_size(ev, info, ev->num))) > + return; > + > + BT_DBG("%s num %d", hdev->name, ev->num); please switch to bt_dev_dbg() here. Regards Marcel
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index 9251ae3a2ce0..b65205b4d830 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1910,6 +1910,11 @@ struct inquiry_info { __le16 clock_offset; } __packed; +struct hci_ev_inquiry_result { + __u8 num; + struct inquiry_info info[]; +}; + #define HCI_EV_CONN_COMPLETE 0x03 struct hci_ev_conn_complete { __u8 status; diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index c353dfafb04c..6516538fe238 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2990,13 +2990,21 @@ static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb) { + struct hci_ev_inquiry_result *ev; struct inquiry_data data; - struct inquiry_info *info = (void *) (skb->data + 1); - int num_rsp = *((__u8 *) skb->data); + int i; - BT_DBG("%s num_rsp %d", hdev->name, num_rsp); + ev = hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT, sizeof(*ev)); + if (!ev) + return; - if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1) + if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT, + flex_array_size(ev, info, ev->num))) + return; + + BT_DBG("%s num %d", hdev->name, ev->num); + + if (!ev->num) return; if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) @@ -3004,7 +3012,8 @@ static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb) hci_dev_lock(hdev); - for (; num_rsp; num_rsp--, info++) { + for (i = 0; i < ev->num; i++) { + struct inquiry_info *info = &ev->info[i]; u32 flags; bacpy(&data.bdaddr, &info->bdaddr);