* [PATCH] Bluetooth: add hdev check to avoid passing null pointer
@ 2016-01-19 10:34 Fugang Duan
2016-01-19 13:04 ` Johan Hedberg
0 siblings, 1 reply; 6+ messages in thread
From: Fugang Duan @ 2016-01-19 10:34 UTC (permalink / raw)
To: gustavo, marcel; +Cc: linux-bluetooth, johan.hedberg, b38611
Function hci_mgmt_cmd() may pass hdev with null pointer to hci_mgmt_handler->func()
like below code:
err = handler->func(sk, hdev, cp, len);
Add hdev check to avoid passing null pointer.
Signed-off-by: Fugang Duan <B38611@freescale.com>
---
net/bluetooth/hci_sock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 1298d72..7fdfc80 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1186,6 +1186,8 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
if (hdev && chan->hdev_init)
chan->hdev_init(sk, hdev);
+ else if (!hdev)
+ goto done;
cp = buf + sizeof(*hdr);
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] Bluetooth: add hdev check to avoid passing null pointer
2016-01-19 10:34 [PATCH] Bluetooth: add hdev check to avoid passing null pointer Fugang Duan
@ 2016-01-19 13:04 ` Johan Hedberg
2016-01-21 9:23 ` Fugang Duan
0 siblings, 1 reply; 6+ messages in thread
From: Johan Hedberg @ 2016-01-19 13:04 UTC (permalink / raw)
To: Fugang Duan; +Cc: gustavo, marcel, linux-bluetooth
Hi Fuang,
On Tue, Jan 19, 2016, Fugang Duan wrote:
> Function hci_mgmt_cmd() may pass hdev with null pointer to hci_mgmt_handler->func()
> like below code:
> err = handler->func(sk, hdev, cp, len);
>
> Add hdev check to avoid passing null pointer.
>
> Signed-off-by: Fugang Duan <B38611@freescale.com>
> ---
> net/bluetooth/hci_sock.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
> index 1298d72..7fdfc80 100644
> --- a/net/bluetooth/hci_sock.c
> +++ b/net/bluetooth/hci_sock.c
> @@ -1186,6 +1186,8 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
>
> if (hdev && chan->hdev_init)
> chan->hdev_init(sk, hdev);
> + else if (!hdev)
> + goto done;
>
> cp = buf + sizeof(*hdr);
Nack. There are handlers which are not hci-dev specific, such as reading
version number, supported commands, or the index list. There's a special
flag HCI_MGMT_NO_HDEV that handlers can set to say that they expect to
be called without a hdev. The code in hci_mgmt_cmd() already makes sure
that any handler that doesn't set it will not be called with NULL hdev.
Johan
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [PATCH] Bluetooth: add hdev check to avoid passing null pointer
2016-01-19 13:04 ` Johan Hedberg
@ 2016-01-21 9:23 ` Fugang Duan
0 siblings, 0 replies; 6+ messages in thread
From: Fugang Duan @ 2016-01-21 9:23 UTC (permalink / raw)
To: Johan Hedberg, b38611; +Cc: gustavo, marcel, linux-bluetooth
From: Johan Hedberg <johan.hedberg@gmail.com> Sent: Tuesday, January 19, 20=
16 9:04 PM
> To: b38611@freescale.com
> Cc: gustavo@padovan.org; marcel@holtmann.org; linux-
> bluetooth@vger.kernel.org
> Subject: Re: [PATCH] Bluetooth: add hdev check to avoid passing null poin=
ter
>=20
> Hi Fuang,
>=20
> On Tue, Jan 19, 2016, Fugang Duan wrote:
> > Function hci_mgmt_cmd() may pass hdev with null pointer to
> > hci_mgmt_handler->func() like below code:
> > err =3D handler->func(sk, hdev, cp, len);
> >
> > Add hdev check to avoid passing null pointer.
> >
> > Signed-off-by: Fugang Duan <B38611@freescale.com>
> > ---
> > net/bluetooth/hci_sock.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index
> > 1298d72..7fdfc80 100644
> > --- a/net/bluetooth/hci_sock.c
> > +++ b/net/bluetooth/hci_sock.c
> > @@ -1186,6 +1186,8 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan
> > *chan, struct sock *sk,
> >
> > if (hdev && chan->hdev_init)
> > chan->hdev_init(sk, hdev);
> > + else if (!hdev)
> > + goto done;
> >
> > cp =3D buf + sizeof(*hdr);
>=20
> Nack. There are handlers which are not hci-dev specific, such as reading =
version
> number, supported commands, or the index list. There's a special flag
> HCI_MGMT_NO_HDEV that handlers can set to say that they expect to be
> called without a hdev. The code in hci_mgmt_cmd() already makes sure that
> any handler that doesn't set it will not be called with NULL hdev.
>=20
> Johan
Thanks for your comments, the below piece of code can guarantee that any ha=
ndler doesn't set HCI_MGMT_NO_HDEV will not be called with NULL hdev.
no_hdev =3D (handler->flags & HCI_MGMT_NO_HDEV);
if (no_hdev !=3D !hdev) {
err =3D mgmt_cmd_status(sk, index, opcode,
MGMT_STATUS_INVALID_INDEX);
goto done;
}
Regards,
Andy
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [PATCH] Bluetooth: add hdev check to avoid passing null pointer
2016-01-21 8:43 ` Johan Hedberg
@ 2016-01-21 9:06 ` Fugang Duan
0 siblings, 0 replies; 6+ messages in thread
From: Fugang Duan @ 2016-01-21 9:06 UTC (permalink / raw)
To: Johan Hedberg, b38611; +Cc: marcel, johannes.berg, jslaby, linux-bluetooth
From: Johan Hedberg <johan.hedberg@gmail.com> Sent: Thursday, January 21, 2=
016 4:43 PM
> To: b38611@freescale.com
> Cc: marcel@holtmann.org; johannes.berg@intel.com; jslaby@suse.cz; linux-
> bluetooth@vger.kernel.org; Fugang Duan <fugang.duan@nxp.com>
> Subject: Re: [PATCH] Bluetooth: add hdev check to avoid passing null poin=
ter
>=20
> Hi Fuang,
>=20
> On Thu, Jan 21, 2016, Fugang Duan wrote:
> > Function hci_mgmt_cmd() may pass hdev with null pointer to
> > hci_mgmt_handler->func() like below code:
> > err =3D handler->func(sk, hdev, cp, len);
> >
> > Add hdev check to avoid passing null pointer.
> >
> > Signed-off-by: Fugang Duan <B38611@freescale.com>
> > ---
> > net/bluetooth/hci_sock.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index
> > 1298d72..7fdfc80 100644
> > --- a/net/bluetooth/hci_sock.c
> > +++ b/net/bluetooth/hci_sock.c
> > @@ -1186,6 +1186,8 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan
> > *chan, struct sock *sk,
> >
> > if (hdev && chan->hdev_init)
> > chan->hdev_init(sk, hdev);
> > + else if (!hdev)
> > + goto done;
>=20
> Why are you resending this? Did you see my response to your earlier
> submission?
>=20
> Johan
Sorry, maybe I missed some mail and guessed I didn't send the previous mai=
l successfully. =20
Let's check my mailbox=20
Regards,
Andy
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Bluetooth: add hdev check to avoid passing null pointer
2016-01-21 4:45 Fugang Duan
@ 2016-01-21 8:43 ` Johan Hedberg
2016-01-21 9:06 ` Fugang Duan
0 siblings, 1 reply; 6+ messages in thread
From: Johan Hedberg @ 2016-01-21 8:43 UTC (permalink / raw)
To: Fugang Duan; +Cc: marcel, johannes.berg, jslaby, linux-bluetooth, fugang.duan
Hi Fuang,
On Thu, Jan 21, 2016, Fugang Duan wrote:
> Function hci_mgmt_cmd() may pass hdev with null pointer to hci_mgmt_handler->func()
> like below code:
> err = handler->func(sk, hdev, cp, len);
>
> Add hdev check to avoid passing null pointer.
>
> Signed-off-by: Fugang Duan <B38611@freescale.com>
> ---
> net/bluetooth/hci_sock.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
> index 1298d72..7fdfc80 100644
> --- a/net/bluetooth/hci_sock.c
> +++ b/net/bluetooth/hci_sock.c
> @@ -1186,6 +1186,8 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
>
> if (hdev && chan->hdev_init)
> chan->hdev_init(sk, hdev);
> + else if (!hdev)
> + goto done;
Why are you resending this? Did you see my response to your earlier
submission?
Johan
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] Bluetooth: add hdev check to avoid passing null pointer
@ 2016-01-21 4:45 Fugang Duan
2016-01-21 8:43 ` Johan Hedberg
0 siblings, 1 reply; 6+ messages in thread
From: Fugang Duan @ 2016-01-21 4:45 UTC (permalink / raw)
To: marcel; +Cc: johannes.berg, jslaby, linux-bluetooth, fugang.duan
Function hci_mgmt_cmd() may pass hdev with null pointer to hci_mgmt_handler->func()
like below code:
err = handler->func(sk, hdev, cp, len);
Add hdev check to avoid passing null pointer.
Signed-off-by: Fugang Duan <B38611@freescale.com>
---
net/bluetooth/hci_sock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 1298d72..7fdfc80 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1186,6 +1186,8 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
if (hdev && chan->hdev_init)
chan->hdev_init(sk, hdev);
+ else if (!hdev)
+ goto done;
cp = buf + sizeof(*hdr);
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-01-21 9:23 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-01-19 10:34 [PATCH] Bluetooth: add hdev check to avoid passing null pointer Fugang Duan
2016-01-19 13:04 ` Johan Hedberg
2016-01-21 9:23 ` Fugang Duan
2016-01-21 4:45 Fugang Duan
2016-01-21 8:43 ` Johan Hedberg
2016-01-21 9:06 ` Fugang Duan
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.