From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: linux-bluetooth@vger.kernel.org
Subject: [PATCH 08/10] Bluetooth: HCI: Use skb_pull to parse LE Advertising Report event
Date: Fri, 16 Apr 2021 14:18:21 -0700 [thread overview]
Message-ID: <20210416211823.3776677-9-luiz.dentz@gmail.com> (raw)
In-Reply-To: <20210416211823.3776677-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This uses skb_pull to check the LE Advertising Report events received
have the minimum required length.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
include/net/bluetooth/hci.h | 7 ++++++-
net/bluetooth/hci_event.c | 37 ++++++++++++++++++++++++++-----------
2 files changed, 32 insertions(+), 12 deletions(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index f416ad71fd2d..3ec8e07f1724 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -2327,13 +2327,18 @@ struct hci_ev_le_conn_complete {
#define HCI_EV_LE_ADVERTISING_REPORT 0x02
struct hci_ev_le_advertising_info {
- __u8 evt_type;
+ __u8 type;
__u8 bdaddr_type;
bdaddr_t bdaddr;
__u8 length;
__u8 data[];
} __packed;
+struct hci_ev_le_advertising_report {
+ __u8 num;
+ struct hci_ev_le_advertising_info info[];
+} __packed;
+
#define HCI_EV_LE_CONN_UPDATE_COMPLETE 0x03
struct hci_ev_le_conn_update_complete {
__u8 status;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 3b928d874f39..becc6319c8c5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6275,25 +6275,40 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
- u8 num_reports = skb->data[0];
- void *ptr = &skb->data[1];
+ struct hci_ev_le_advertising_report *ev;
+
+ ev = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT,
+ sizeof(*ev));
+ if (!ev)
+ return;
+
+ if (!ev->num)
+ return;
hci_dev_lock(hdev);
- while (num_reports--) {
- struct hci_ev_le_advertising_info *ev = ptr;
+ while (ev->num--) {
+ struct hci_ev_le_advertising_info *info;
s8 rssi;
- if (ev->length <= HCI_MAX_AD_LENGTH) {
- rssi = ev->data[ev->length];
- process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
- ev->bdaddr_type, NULL, 0, rssi,
- ev->data, ev->length, false);
+ info = hci_le_ev_skb_pull(hdev, skb,
+ HCI_EV_LE_ADVERTISING_REPORT,
+ sizeof(*info));
+ if (!info)
+ break;
+
+ if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT,
+ info->length + 1))
+ break;
+
+ if (info->length <= HCI_MAX_AD_LENGTH) {
+ rssi = info->data[info->length];
+ process_adv_report(hdev, info->type, &info->bdaddr,
+ info->bdaddr_type, NULL, 0, rssi,
+ info->data, info->length, false);
} else {
bt_dev_err(hdev, "Dropping invalid advertising data");
}
-
- ptr += sizeof(*ev) + ev->length + 1;
}
hci_dev_unlock(hdev);
--
2.30.2
next prev parent reply other threads:[~2021-04-16 21:21 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-16 21:18 [PATCH 00/10] Bluetooth: HCI: Use skb_pull to parse events Luiz Augusto von Dentz
2021-04-16 21:18 ` [PATCH 01/10] Bluetooth: HCI: Use skb_pull to parse BR/EDR events Luiz Augusto von Dentz
2021-04-16 22:08 ` Bluetooth: HCI: Use skb_pull to parse events bluez.test.bot
2021-04-16 21:18 ` [PATCH 02/10] Bluetooth: HCI: Use skb_pull to parse Command Complete event Luiz Augusto von Dentz
2021-04-16 21:18 ` [PATCH 03/10] Bluetooth: HCI: Use skb_pull to parse Number of Complete Packets event Luiz Augusto von Dentz
2021-04-16 21:18 ` [PATCH 04/10] Bluetooth: HCI: Use skb_pull to parse Inquiry Result event Luiz Augusto von Dentz
2021-04-16 21:18 ` [PATCH 05/10] Bluetooth: HCI: Use skb_pull to parse Inquiry Result with RSSI event Luiz Augusto von Dentz
2021-04-16 21:18 ` [PATCH 06/10] Bluetooth: HCI: Use skb_pull to parse Extended Inquiry Result event Luiz Augusto von Dentz
2021-04-16 21:18 ` [PATCH 07/10] Bluetooth: HCI: Use skb_pull to parse LE Metaevents Luiz Augusto von Dentz
2021-04-16 21:18 ` Luiz Augusto von Dentz [this message]
2021-04-16 21:18 ` [PATCH 09/10] Bluetooth: HCI: Use skb_pull to parse LE Extended Advertising Report event Luiz Augusto von Dentz
2021-04-16 21:18 ` [PATCH 10/10] Bluetooth: HCI: Use skb_pull to parse LE Direct " Luiz Augusto von Dentz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210416211823.3776677-9-luiz.dentz@gmail.com \
--to=luiz.dentz@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.