Commit ba17bb62 authored by Radoslaw Biernacki's avatar Radoslaw Biernacki Committed by Marcel Holtmann
Browse files

Bluetooth: Fix skb allocation in mgmt_remote_name() & mgmt_device_connected() 



This patch fixes skb allocation, as lack of space for ev might push skb
tail beyond its end.
Also introduce eir_precalc_len() that can be used instead of magic
numbers for similar eir operations on skb.

Fixes: cf1bce1d ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND")
Fixes: e9674143 ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_CONNECTED")
Signed-off-by: default avatarAngela Czubak <acz@semihalf.com>
Signed-off-by: default avatarMarek Maslanka <mm@semihalf.com>
Signed-off-by: default avatarRadoslaw Biernacki <rad@semihalf.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent a6fbb2bf

net/bluetooth/eir.h

+5 −0
Original line number Diff line number Diff line
@@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr); 
u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len);

u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len);



static inline u16 eir_precalc_len(u8 data_len)

{

	return sizeof(u8) * 2 + data_len;

}



static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type,

				  u8 *data, u8 data_len)

{

net/bluetooth/mgmt.c

+8 −10
Original line number Diff line number Diff line
@@ -9085,12 +9085,14 @@ void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 
	u16 eir_len = 0;

	u32 flags = 0;



	/* allocate buff for LE or BR/EDR adv */

	if (conn->le_adv_data_len > 0)

		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,

				     conn->le_adv_data_len);

				     sizeof(*ev) + conn->le_adv_data_len);

	else

		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,

				     2 + name_len + 5);

				     sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +

				     eir_precalc_len(sizeof(conn->dev_class)));



	ev = skb_put(skb, sizeof(*ev));

	bacpy(&ev->addr.bdaddr, &conn->dst);
@@ -9809,13 +9811,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 
{

	struct sk_buff *skb;

	struct mgmt_ev_device_found *ev;

	u16 eir_len;

	u32 flags;

	u16 eir_len = 0;

	u32 flags = 0;



	if (name_len)

		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len);

	else

		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0);

	skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,

			     sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));



	ev = skb_put(skb, sizeof(*ev));

	bacpy(&ev->addr.bdaddr, bdaddr);
@@ -9825,10 +9825,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 
	if (name) {

		eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,

					  name_len);

		flags = 0;

		skb_put(skb, eir_len);

	} else {

		eir_len = 0;

		flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;

	}