Linux-Bluetooth Archive on lore.kernel.org
 help / color / Atom feed
From: "Gix, Brian" <brian.gix@intel.com>
To: "jakub.witowski@silvair.com" <jakub.witowski@silvair.com>,
	"linux-bluetooth@vger.kernel.org"
	<linux-bluetooth@vger.kernel.org>
Cc: "Stotland, Inga" <inga.stotland@intel.com>
Subject: Re: [PATCH BlueZ v3] mesh: Fix segmentation fault after adding second netkey via NET_KEY_ADD opcode
Date: Tue, 11 Jun 2019 22:33:21 +0000
Message-ID: <1560292395.27321.1.camel@intel.com> (raw)
In-Reply-To: <20190610084605.11411-1-jakub.witowski@silvair.com>


Patch Applied, Thanks.

On Mon, 2019-06-10 at 10:46 +0200, Jakub Witowski wrote:
> Segmentation fault was caused by passing subnet pointer to the
> start_network_beacon() which was NULL
> ---
>  mesh/net.c | 25 ++++++++++++-------------
>  1 file changed, 12 insertions(+), 13 deletions(-)
> 
> diff --git a/mesh/net.c b/mesh/net.c
> index c7aff9ab4..fdd38e7ce 100644
> --- a/mesh/net.c
> +++ b/mesh/net.c
> @@ -977,27 +977,28 @@ int mesh_net_del_key(struct mesh_net *net, uint16_t idx)
>  	return MESH_STATUS_SUCCESS;
>  }
>  
> -static int add_key(struct mesh_net *net, uint16_t idx, const uint8_t *value)
> +static struct mesh_subnet *add_key(struct mesh_net *net, uint16_t idx,
> +							const uint8_t *value)
>  {
>  	struct mesh_subnet *subnet;
>  
>  	subnet = subnet_new(net, idx);
>  	if (!subnet)
> -		return MESH_STATUS_INSUFF_RESOURCES;
> +		return NULL;
>  
>  	subnet->net_key_tx = subnet->net_key_cur = net_key_add(value);
>  	if (!subnet->net_key_cur) {
>  		l_free(subnet);
> -		return MESH_STATUS_INSUFF_RESOURCES;
> +		return NULL;
>  	}
>  
>  	if (!create_secure_beacon(net, subnet, subnet->snb.beacon + 1) ||
>  				!l_queue_push_tail(net->subnets, subnet)) {
>  		subnet_free(subnet);
> -		return MESH_STATUS_INSUFF_RESOURCES;
> +		return NULL;
>  	}
>  
> -	return MESH_STATUS_SUCCESS;
> +	return subnet;
>  }
>  
>  /*
> @@ -1007,7 +1008,6 @@ static int add_key(struct mesh_net *net, uint16_t idx, const uint8_t *value)
>  int mesh_net_add_key(struct mesh_net *net, uint16_t idx, const uint8_t *value)
>  {
>  	struct mesh_subnet *subnet;
> -	int status;
>  
>  	subnet = l_queue_find(net->subnets, match_key_index,
>  							L_UINT_TO_PTR(idx));
> @@ -1019,9 +1019,9 @@ int mesh_net_add_key(struct mesh_net *net, uint16_t idx, const uint8_t *value)
>  			return MESH_STATUS_IDX_ALREADY_STORED;
>  	}
>  
> -	status = add_key(net, idx, value);
> -	if (status != MESH_STATUS_SUCCESS)
> -		return status;
> +	subnet = add_key(net, idx, value);
> +	if (!subnet)
> +		return MESH_STATUS_INSUFF_RESOURCES;
>  
>  	if (!storage_net_key_add(net, idx, value, false)) {
>  		l_queue_remove(net->subnets, subnet);
> @@ -2490,7 +2490,7 @@ static void net_rx(void *net_ptr, void *user_data)
>  	int8_t rssi = 0;
>  
>  	key_id = net_key_decrypt(net->iv_index, data->data, data->len,
> -								&out, &out_size);
> +							&out, &out_size);
>  
>  	if (!key_id)
>  		return;
> @@ -3017,7 +3017,6 @@ bool mesh_net_set_key(struct mesh_net *net, uint16_t idx, const uint8_t *key,
>  					const uint8_t *new_key, uint8_t phase)
>  {
>  	struct mesh_subnet *subnet;
> -	int status;
>  
>  	subnet = l_queue_find(net->subnets, match_key_index,
>  							L_UINT_TO_PTR(idx));
> @@ -3032,8 +3031,8 @@ bool mesh_net_set_key(struct mesh_net *net, uint16_t idx, const uint8_t *key,
>  	if (phase != KEY_REFRESH_PHASE_NONE && !new_key)
>  		return false;
>  
> -	status = add_key(net, idx, key);
> -	if (status != MESH_STATUS_SUCCESS)
> +	subnet = add_key(net, idx, key);
> +	if (!subnet)
>  		return false;
>  
>  	subnet = l_queue_find(net->subnets, match_key_index,

      reply index

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-06-10  8:46 Jakub Witowski
2019-06-11 22:33 ` Gix, Brian [this message]

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1560292395.27321.1.camel@intel.com \
    --to=brian.gix@intel.com \
    --cc=inga.stotland@intel.com \
    --cc=jakub.witowski@silvair.com \
    --cc=linux-bluetooth@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Bluetooth Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-bluetooth/0 linux-bluetooth/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-bluetooth linux-bluetooth/ https://lore.kernel.org/linux-bluetooth \
		linux-bluetooth@vger.kernel.org linux-bluetooth@archiver.kernel.org
	public-inbox-index linux-bluetooth


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-bluetooth


AGPL code for this site: git clone https://public-inbox.org/ public-inbox