Commit 8d08d324 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Marcel Holtmann
Browse files

Bluetooth: HCI: Use skb_pull_data to parse Inquiry Result with RSSI event 



This uses skb_pull_data to check the Inquiry Result with RSSI events
received have the minimum required length.

Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 27d9eb4b

include/net/bluetooth/hci.h

+10 −2
Original line number Diff line number Diff line
@@ -2194,7 +2194,7 @@ struct hci_ev_pscan_rep_mode { 
} __packed;



#define HCI_EV_INQUIRY_RESULT_WITH_RSSI	0x22

struct inquiry_info_with_rssi {

struct inquiry_info_rssi {

	bdaddr_t bdaddr;

	__u8     pscan_rep_mode;

	__u8     pscan_period_mode;
@@ -2202,7 +2202,7 @@ struct inquiry_info_with_rssi { 
	__le16   clock_offset;

	__s8     rssi;

} __packed;

struct inquiry_info_with_rssi_and_pscan_mode {

struct inquiry_info_rssi_pscan {

	bdaddr_t bdaddr;

	__u8     pscan_rep_mode;

	__u8     pscan_period_mode;
@@ -2211,6 +2211,14 @@ struct inquiry_info_with_rssi_and_pscan_mode { 
	__le16   clock_offset;

	__s8     rssi;

} __packed;

struct hci_ev_inquiry_result_rssi {

	__u8     num;

	struct inquiry_info_rssi info[];

} __packed;

struct hci_ev_inquiry_result_rssi_pscan {

	__u8     num;

	struct inquiry_info_rssi_pscan info[];

} __packed;



#define HCI_EV_REMOTE_EXT_FEATURES	0x23

struct hci_ev_remote_ext_features {

net/bluetooth/hci_event.c

+23 −17
Original line number Diff line number Diff line
@@ -4921,12 +4921,21 @@ static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb) 
static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,

					     struct sk_buff *skb)

{

	union {

		struct hci_ev_inquiry_result_rssi *res1;

		struct hci_ev_inquiry_result_rssi_pscan *res2;

	} *ev;

	struct inquiry_data data;

	int num_rsp = *((__u8 *) skb->data);

	int i;



	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);

	ev = hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT_WITH_RSSI,

			     sizeof(*ev));

	if (!ev)

		return;



	if (!num_rsp)

	BT_DBG("%s num_rsp %d", hdev->name, ev->res1->num);



	if (!ev->res1->num)

		return;



	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
@@ -4934,16 +4943,13 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, 


	hci_dev_lock(hdev);



	if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {

		struct inquiry_info_with_rssi_and_pscan_mode *info;

		info = (void *) (skb->data + 1);



		if (skb->len < num_rsp * sizeof(*info) + 1)

			goto unlock;

	if (skb->len == flex_array_size(ev, res2->info, ev->res2->num)) {

		struct inquiry_info_rssi_pscan *info;



		for (; num_rsp; num_rsp--, info++) {

		for (i = 0; i < ev->res2->num; i++) {

			u32 flags;



			info = &ev->res2->info[i];

			bacpy(&data.bdaddr, &info->bdaddr);

			data.pscan_rep_mode	= info->pscan_rep_mode;

			data.pscan_period_mode	= info->pscan_period_mode;
@@ -4959,15 +4965,13 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, 
					  info->dev_class, info->rssi,

					  flags, NULL, 0, NULL, 0);

		}

	} else {

		struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);



		if (skb->len < num_rsp * sizeof(*info) + 1)

			goto unlock;

	} else if (skb->len == flex_array_size(ev, res1->info, ev->res1->num)) {

		struct inquiry_info_rssi *info;



		for (; num_rsp; num_rsp--, info++) {

		for (i = 0; i < ev->res1->num; i++) {

			u32 flags;



			info = &ev->res1->info[i];

			bacpy(&data.bdaddr, &info->bdaddr);

			data.pscan_rep_mode	= info->pscan_rep_mode;

			data.pscan_period_mode	= info->pscan_period_mode;
@@ -4983,9 +4987,11 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, 
					  info->dev_class, info->rssi,

					  flags, NULL, 0, NULL, 0);

		}

	} else {

		bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",

			   HCI_EV_INQUIRY_RESULT_WITH_RSSI);

	}



unlock:

	hci_dev_unlock(hdev);

}