@@ -1321,8 +1321,8 @@ struct hci_rp_read_local_oob_ext_data {
struct hci_op_configure_data_path {
__u8 direction;
__u8 data_path_id;
- __u8 vnd_len;
- __u8 vnd_data[];
+ DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(__u8, vnd_len);
+ DECLARE_FLEX_ARRAY_ELEMENTS(__u8, vnd_data);
} __packed;
#define HCI_OP_READ_LOCAL_VERSION 0x1001
@@ -2435,19 +2435,14 @@ int hci_req_configure_datapath(struct hci_dev *hdev, struct bt_codec *codec)
if (err < 0)
goto error;
- cmd = kzalloc(sizeof(*cmd) + vnd_len, GFP_KERNEL);
- if (!cmd) {
- err = -ENOMEM;
+ err = mem_to_flex_dup(&cmd, vnd_data, vnd_len, GFP_KERNEL);
+ if (err < 0)
goto error;
- }
err = hdev->get_data_path_id(hdev, &cmd->data_path_id);
if (err < 0)
goto error;
- cmd->vnd_len = vnd_len;
- memcpy(cmd->vnd_data, vnd_data, vnd_len);
-
cmd->direction = 0x00;
hci_req_add(&req, HCI_CONFIGURE_DATA_PATH, sizeof(*cmd) + vnd_len, cmd);
As part of the work to perform bounds checking on all memcpy() uses, replace the open-coded a deserialization of bytes out of memory into a trailing flexible array by using a flex_array.h helper to perform the allocation, bounds checking, and copying. Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Cc: Luiz Augusto von Dentz <luiz.dentz@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-bluetooth@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- include/net/bluetooth/hci.h | 4 ++-- net/bluetooth/hci_request.c | 9 ++------- 2 files changed, 4 insertions(+), 9 deletions(-)