* [PATCH] Bluetooth: Fix the creation of hdev->name
@ 2022-05-07 12:32 Itay Iellin
2022-05-07 13:21 ` bluez.test.bot
2022-05-11 21:20 ` [PATCH] " patchwork-bot+bluetooth
0 siblings, 2 replies; 3+ messages in thread
From: Itay Iellin @ 2022-05-07 12:32 UTC (permalink / raw)
To: linux-bluetooth
Cc: marcel, johan.hedberg, luiz.dentz, davem, edumazet, kuba, pabeni
Set a size limit of 8 bytes of the written buffer to "hdev->name"
including the terminating null byte, as the size of "hdev->name" is 8
bytes. If an id value which is greater than 9999 is allocated,
then the "snprintf(hdev->name, sizeof(hdev->name), "hci%d", id)"
function call would lead to a truncation of the id value in decimal
notation.
Set an explicit maximum id parameter in the id allocation function call.
The id allocation function defines the maximum allocated id value as the
maximum id parameter value minus one. Therefore, HCI_MAX_ID is defined
as 10000.
Signed-off-by: Itay Iellin <ieitayie@gmail.com>
---
include/net/bluetooth/hci_core.h | 3 +++
net/bluetooth/hci_core.c | 6 +++---
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 64d3a63759a8..5a52a2018b56 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -36,6 +36,9 @@
/* HCI priority */
#define HCI_PRIO_MAX 7
+/* HCI maximum id value */
+#define HCI_MAX_ID 10000
+
/* HCI Core structures */
struct inquiry_data {
bdaddr_t bdaddr;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index ad4f4ab0afca..5abb2ca5b129 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2555,10 +2555,10 @@ int hci_register_dev(struct hci_dev *hdev)
*/
switch (hdev->dev_type) {
case HCI_PRIMARY:
- id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
+ id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
break;
case HCI_AMP:
- id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
+ id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
break;
default:
return -EINVAL;
@@ -2567,7 +2567,7 @@ int hci_register_dev(struct hci_dev *hdev)
if (id < 0)
return id;
- sprintf(hdev->name, "hci%d", id);
+ snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
hdev->id = id;
BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: Bluetooth: Fix the creation of hdev->name
2022-05-07 12:32 [PATCH] Bluetooth: Fix the creation of hdev->name Itay Iellin
@ 2022-05-07 13:21 ` bluez.test.bot
2022-05-11 21:20 ` [PATCH] " patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: bluez.test.bot @ 2022-05-07 13:21 UTC (permalink / raw)
To: linux-bluetooth, ieitayie
[-- Attachment #1: Type: text/plain, Size: 1097 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=639380
---Test result---
Test Summary:
CheckPatch PASS 1.79 seconds
GitLint PASS 0.98 seconds
SubjectPrefix PASS 0.90 seconds
BuildKernel PASS 32.10 seconds
BuildKernel32 PASS 28.15 seconds
Incremental Build with patchesPASS 37.92 seconds
TestRunner: Setup PASS 468.75 seconds
TestRunner: l2cap-tester PASS 17.43 seconds
TestRunner: bnep-tester PASS 6.13 seconds
TestRunner: mgmt-tester PASS 101.11 seconds
TestRunner: rfcomm-tester PASS 9.61 seconds
TestRunner: sco-tester PASS 9.35 seconds
TestRunner: smp-tester PASS 9.46 seconds
TestRunner: userchan-tester PASS 6.35 seconds
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] Bluetooth: Fix the creation of hdev->name
2022-05-07 12:32 [PATCH] Bluetooth: Fix the creation of hdev->name Itay Iellin
2022-05-07 13:21 ` bluez.test.bot
@ 2022-05-11 21:20 ` patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+bluetooth @ 2022-05-11 21:20 UTC (permalink / raw)
To: Itay Iellin
Cc: linux-bluetooth, marcel, johan.hedberg, luiz.dentz, davem,
edumazet, kuba, pabeni
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Sat, 7 May 2022 08:32:48 -0400 you wrote:
> Set a size limit of 8 bytes of the written buffer to "hdev->name"
> including the terminating null byte, as the size of "hdev->name" is 8
> bytes. If an id value which is greater than 9999 is allocated,
> then the "snprintf(hdev->name, sizeof(hdev->name), "hci%d", id)"
> function call would lead to a truncation of the id value in decimal
> notation.
>
> [...]
Here is the summary with links:
- Bluetooth: Fix the creation of hdev->name
https://git.kernel.org/bluetooth/bluetooth-next/c/29aff7408263
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-05-11 21:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-07 12:32 [PATCH] Bluetooth: Fix the creation of hdev->name Itay Iellin
2022-05-07 13:21 ` bluez.test.bot
2022-05-11 21:20 ` [PATCH] " patchwork-bot+bluetooth
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.