* [PATCH] Bluetooth: Fix skb allocation in mgmt_remote_name()
@ 2022-01-13 15:08 Radoslaw Biernacki
2022-01-13 16:17 ` Luiz Augusto von Dentz
0 siblings, 1 reply; 6+ messages in thread
From: Radoslaw Biernacki @ 2022-01-13 15:08 UTC (permalink / raw)
To: linux-bluetooth, Luiz Augusto von Dentz, Marcel Holtmann
Cc: CrosBT Upstreaming, Archie Pusaka, Miao-chen Chou,
Jakub Kicinski, Johan Hedberg, linux-kernel, netdev, upstream,
Radoslaw Biernacki, Angela Czubak, Marek Maslanka
From: Radoslaw Biernacki <rad@semihalf.com>
This patch fixes skb allocation, as lack of space for ev might push skb
tail beyond its end.
Also introduce eir_precalc_len() that can be used instead of magic
numbers for similar eir operations on skb.
Fixes: cf1bce1de7eeb ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND")
Signed-off-by: Angela Czubak <acz@semihalf.com>
Signed-off-by: Marek Maslanka <mm@semihalf.com>
Signed-off-by: Radoslaw Biernacki <rad@semihalf.com>
---
net/bluetooth/eir.h | 5 +++++
net/bluetooth/mgmt.c | 12 ++++--------
2 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/net/bluetooth/eir.h b/net/bluetooth/eir.h
index 05e2e917fc25..e5876751f07e 100644
--- a/net/bluetooth/eir.h
+++ b/net/bluetooth/eir.h
@@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr);
u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len);
u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len);
+static inline u16 eir_precalc_len(u8 data_len)
+{
+ return sizeof(u8) * 2 + data_len;
+}
+
static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type,
u8 *data, u8 data_len)
{
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 37087cf7dc5a..d517fd847730 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -9680,13 +9680,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
{
struct sk_buff *skb;
struct mgmt_ev_device_found *ev;
- u16 eir_len;
- u32 flags;
+ u16 eir_len = 0;
+ u32 flags = 0;
- if (name_len)
- skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len);
- else
- skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0);
+ skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
+ sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
ev = skb_put(skb, sizeof(*ev));
bacpy(&ev->addr.bdaddr, bdaddr);
@@ -9696,10 +9694,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
if (name) {
eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
name_len);
- flags = 0;
skb_put(skb, eir_len);
} else {
- eir_len = 0;
flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
}
--
2.34.1.703.g22d0c6ccf7-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] Bluetooth: Fix skb allocation in mgmt_remote_name() 2022-01-13 15:08 [PATCH] Bluetooth: Fix skb allocation in mgmt_remote_name() Radoslaw Biernacki @ 2022-01-13 16:17 ` Luiz Augusto von Dentz 2022-01-13 22:07 ` Radosław Biernacki 0 siblings, 1 reply; 6+ messages in thread From: Luiz Augusto von Dentz @ 2022-01-13 16:17 UTC (permalink / raw) To: Radoslaw Biernacki Cc: linux-bluetooth, Marcel Holtmann, CrosBT Upstreaming, Archie Pusaka, Miao-chen Chou, Jakub Kicinski, Johan Hedberg, Linux Kernel Mailing List, open list:NETWORKING [GENERAL], upstream, Angela Czubak, Marek Maslanka Hi Radoslaw, On Thu, Jan 13, 2022 at 7:09 AM Radoslaw Biernacki <rad@semihalf.com> wrote: > > From: Radoslaw Biernacki <rad@semihalf.com> > > This patch fixes skb allocation, as lack of space for ev might push skb > tail beyond its end. > Also introduce eir_precalc_len() that can be used instead of magic > numbers for similar eir operations on skb. > > Fixes: cf1bce1de7eeb ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND") > Signed-off-by: Angela Czubak <acz@semihalf.com> > Signed-off-by: Marek Maslanka <mm@semihalf.com> > Signed-off-by: Radoslaw Biernacki <rad@semihalf.com> > --- > net/bluetooth/eir.h | 5 +++++ > net/bluetooth/mgmt.c | 12 ++++-------- > 2 files changed, 9 insertions(+), 8 deletions(-) > > diff --git a/net/bluetooth/eir.h b/net/bluetooth/eir.h > index 05e2e917fc25..e5876751f07e 100644 > --- a/net/bluetooth/eir.h > +++ b/net/bluetooth/eir.h > @@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr); > u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len); > u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len); > > +static inline u16 eir_precalc_len(u8 data_len) > +{ > + return sizeof(u8) * 2 + data_len; > +} > + > static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, > u8 *data, u8 data_len) > { > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c > index 37087cf7dc5a..d517fd847730 100644 > --- a/net/bluetooth/mgmt.c > +++ b/net/bluetooth/mgmt.c > @@ -9680,13 +9680,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > { > struct sk_buff *skb; > struct mgmt_ev_device_found *ev; > - u16 eir_len; > - u32 flags; > + u16 eir_len = 0; > + u32 flags = 0; > > - if (name_len) > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len); > - else > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0); > + skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, > + sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); Looks like mgmt_device_connected also has a similar problem. > ev = skb_put(skb, sizeof(*ev)); > bacpy(&ev->addr.bdaddr, bdaddr); > @@ -9696,10 +9694,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > if (name) { > eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, > name_len); > - flags = 0; > skb_put(skb, eir_len); > } else { > - eir_len = 0; > flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; > } These changes would leave flags and eir_len uninitialized. > -- > 2.34.1.703.g22d0c6ccf7-goog > -- Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Bluetooth: Fix skb allocation in mgmt_remote_name() 2022-01-13 16:17 ` Luiz Augusto von Dentz @ 2022-01-13 22:07 ` Radosław Biernacki 2022-01-13 22:23 ` Luiz Augusto von Dentz 0 siblings, 1 reply; 6+ messages in thread From: Radosław Biernacki @ 2022-01-13 22:07 UTC (permalink / raw) To: Luiz Augusto von Dentz Cc: linux-bluetooth, Marcel Holtmann, CrosBT Upstreaming, Archie Pusaka, Miao-chen Chou, Jakub Kicinski, Johan Hedberg, Linux Kernel Mailing List, open list:NETWORKING [GENERAL], upstream, Angela Czubak, Marek Maslanka Hi Luiz, czw., 13 sty 2022 o 17:17 Luiz Augusto von Dentz <luiz.dentz@gmail.com> napisał(a): > > Hi Radoslaw, > > On Thu, Jan 13, 2022 at 7:09 AM Radoslaw Biernacki <rad@semihalf.com> wrote: > > > > From: Radoslaw Biernacki <rad@semihalf.com> > > > > This patch fixes skb allocation, as lack of space for ev might push skb > > tail beyond its end. > > Also introduce eir_precalc_len() that can be used instead of magic > > numbers for similar eir operations on skb. > > > > Fixes: cf1bce1de7eeb ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND") > > Signed-off-by: Angela Czubak <acz@semihalf.com> > > Signed-off-by: Marek Maslanka <mm@semihalf.com> > > Signed-off-by: Radoslaw Biernacki <rad@semihalf.com> > > --- > > net/bluetooth/eir.h | 5 +++++ > > net/bluetooth/mgmt.c | 12 ++++-------- > > 2 files changed, 9 insertions(+), 8 deletions(-) > > > > diff --git a/net/bluetooth/eir.h b/net/bluetooth/eir.h > > index 05e2e917fc25..e5876751f07e 100644 > > --- a/net/bluetooth/eir.h > > +++ b/net/bluetooth/eir.h > > @@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr); > > u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len); > > u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len); > > > > +static inline u16 eir_precalc_len(u8 data_len) > > +{ > > + return sizeof(u8) * 2 + data_len; > > +} > > + > > static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, > > u8 *data, u8 data_len) > > { > > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c > > index 37087cf7dc5a..d517fd847730 100644 > > --- a/net/bluetooth/mgmt.c > > +++ b/net/bluetooth/mgmt.c > > @@ -9680,13 +9680,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > > { > > struct sk_buff *skb; > > struct mgmt_ev_device_found *ev; > > - u16 eir_len; > > - u32 flags; > > + u16 eir_len = 0; > > + u32 flags = 0; > > > > - if (name_len) > > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len); > > - else > > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0); > > + skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, > > + sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); > > Looks like mgmt_device_connected also has a similar problem. Yes, I was planning to send a patch to this one though it will not be as slick. It would be nice to have a helper which will call skb_put() and add eir data at once. Basically skb operation in pair to, what eir_append_data() does with help of eir_len but without awkwardness when passing return value to skb_put() (as it returns offset not size). I will send V2 with two patches. I hope they will align with your original goal of eliminating the necessity of intermediary buffers at some point in future. > > > ev = skb_put(skb, sizeof(*ev)); > > bacpy(&ev->addr.bdaddr, bdaddr); > > @@ -9696,10 +9694,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > > if (name) { > > eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, > > name_len); > > - flags = 0; > > skb_put(skb, eir_len); > > } else { > > - eir_len = 0; > > flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; > > } > > These changes would leave flags and eir_len uninitialized. Both are initialized to 0 by this patch. > > > -- > > 2.34.1.703.g22d0c6ccf7-goog > > > > > -- > Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Bluetooth: Fix skb allocation in mgmt_remote_name() 2022-01-13 22:07 ` Radosław Biernacki @ 2022-01-13 22:23 ` Luiz Augusto von Dentz 2022-01-31 18:47 ` Luiz Augusto von Dentz 0 siblings, 1 reply; 6+ messages in thread From: Luiz Augusto von Dentz @ 2022-01-13 22:23 UTC (permalink / raw) To: Radosław Biernacki Cc: linux-bluetooth, Marcel Holtmann, CrosBT Upstreaming, Archie Pusaka, Miao-chen Chou, Jakub Kicinski, Johan Hedberg, Linux Kernel Mailing List, open list:NETWORKING [GENERAL], upstream, Angela Czubak, Marek Maslanka Hi Radosław, On Thu, Jan 13, 2022 at 2:07 PM Radosław Biernacki <rad@semihalf.com> wrote: > > Hi Luiz, > > czw., 13 sty 2022 o 17:17 Luiz Augusto von Dentz > <luiz.dentz@gmail.com> napisał(a): > > > > Hi Radoslaw, > > > > On Thu, Jan 13, 2022 at 7:09 AM Radoslaw Biernacki <rad@semihalf.com> wrote: > > > > > > From: Radoslaw Biernacki <rad@semihalf.com> > > > > > > This patch fixes skb allocation, as lack of space for ev might push skb > > > tail beyond its end. > > > Also introduce eir_precalc_len() that can be used instead of magic > > > numbers for similar eir operations on skb. > > > > > > Fixes: cf1bce1de7eeb ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND") > > > Signed-off-by: Angela Czubak <acz@semihalf.com> > > > Signed-off-by: Marek Maslanka <mm@semihalf.com> > > > Signed-off-by: Radoslaw Biernacki <rad@semihalf.com> > > > --- > > > net/bluetooth/eir.h | 5 +++++ > > > net/bluetooth/mgmt.c | 12 ++++-------- > > > 2 files changed, 9 insertions(+), 8 deletions(-) > > > > > > diff --git a/net/bluetooth/eir.h b/net/bluetooth/eir.h > > > index 05e2e917fc25..e5876751f07e 100644 > > > --- a/net/bluetooth/eir.h > > > +++ b/net/bluetooth/eir.h > > > @@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr); > > > u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len); > > > u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len); > > > > > > +static inline u16 eir_precalc_len(u8 data_len) > > > +{ > > > + return sizeof(u8) * 2 + data_len; > > > +} > > > + > > > static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, > > > u8 *data, u8 data_len) > > > { > > > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c > > > index 37087cf7dc5a..d517fd847730 100644 > > > --- a/net/bluetooth/mgmt.c > > > +++ b/net/bluetooth/mgmt.c > > > @@ -9680,13 +9680,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > > > { > > > struct sk_buff *skb; > > > struct mgmt_ev_device_found *ev; > > > - u16 eir_len; > > > - u32 flags; > > > + u16 eir_len = 0; > > > + u32 flags = 0; > > > > > > - if (name_len) > > > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len); > > > - else > > > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0); > > > + skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, > > > + sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); > > > > Looks like mgmt_device_connected also has a similar problem. > > Yes, I was planning to send a patch to this one though it will not be as slick. > It would be nice to have a helper which will call skb_put() and add > eir data at once. > Basically skb operation in pair to, what eir_append_data() does with > help of eir_len but without awkwardness when passing return value to > skb_put() (as it returns offset not size). Hmm, that might be a good idea indeed something like eir_append_skb, if only we could grow the skb with skb_put directly that would eliminate the problem with having to reserve enough space for the worse case. > I will send V2 with two patches. I hope they will align with your > original goal of eliminating the necessity of intermediary buffers at > some point in future. > > > > > > ev = skb_put(skb, sizeof(*ev)); > > > bacpy(&ev->addr.bdaddr, bdaddr); > > > @@ -9696,10 +9694,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > > > if (name) { > > > eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, > > > name_len); > > > - flags = 0; > > > skb_put(skb, eir_len); > > > } else { > > > - eir_len = 0; > > > flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; > > > } > > > > These changes would leave flags and eir_len uninitialized. > > Both are initialized to 0 by this patch. Sorry, I must be blind that I didn't see you had changed that to be initialized in their declaration. > > > > > -- > > > 2.34.1.703.g22d0c6ccf7-goog > > > > > > > > > -- > > Luiz Augusto von Dentz -- Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Bluetooth: Fix skb allocation in mgmt_remote_name() 2022-01-13 22:23 ` Luiz Augusto von Dentz @ 2022-01-31 18:47 ` Luiz Augusto von Dentz 2022-02-01 18:36 ` Radosław Biernacki 0 siblings, 1 reply; 6+ messages in thread From: Luiz Augusto von Dentz @ 2022-01-31 18:47 UTC (permalink / raw) To: Radosław Biernacki Cc: linux-bluetooth, Marcel Holtmann, CrosBT Upstreaming, Archie Pusaka, Miao-chen Chou, Jakub Kicinski, Johan Hedberg, Linux Kernel Mailing List, open list:NETWORKING [GENERAL], upstream, Angela Czubak, Marek Maslanka Hi Radosław, On Thu, Jan 13, 2022 at 2:23 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote: > > Hi Radosław, > > On Thu, Jan 13, 2022 at 2:07 PM Radosław Biernacki <rad@semihalf.com> wrote: > > > > Hi Luiz, > > > > czw., 13 sty 2022 o 17:17 Luiz Augusto von Dentz > > <luiz.dentz@gmail.com> napisał(a): > > > > > > Hi Radoslaw, > > > > > > On Thu, Jan 13, 2022 at 7:09 AM Radoslaw Biernacki <rad@semihalf.com> wrote: > > > > > > > > From: Radoslaw Biernacki <rad@semihalf.com> > > > > > > > > This patch fixes skb allocation, as lack of space for ev might push skb > > > > tail beyond its end. > > > > Also introduce eir_precalc_len() that can be used instead of magic > > > > numbers for similar eir operations on skb. > > > > > > > > Fixes: cf1bce1de7eeb ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND") > > > > Signed-off-by: Angela Czubak <acz@semihalf.com> > > > > Signed-off-by: Marek Maslanka <mm@semihalf.com> > > > > Signed-off-by: Radoslaw Biernacki <rad@semihalf.com> > > > > --- > > > > net/bluetooth/eir.h | 5 +++++ > > > > net/bluetooth/mgmt.c | 12 ++++-------- > > > > 2 files changed, 9 insertions(+), 8 deletions(-) > > > > > > > > diff --git a/net/bluetooth/eir.h b/net/bluetooth/eir.h > > > > index 05e2e917fc25..e5876751f07e 100644 > > > > --- a/net/bluetooth/eir.h > > > > +++ b/net/bluetooth/eir.h > > > > @@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr); > > > > u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len); > > > > u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len); > > > > > > > > +static inline u16 eir_precalc_len(u8 data_len) > > > > +{ > > > > + return sizeof(u8) * 2 + data_len; > > > > +} > > > > + > > > > static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, > > > > u8 *data, u8 data_len) > > > > { > > > > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c > > > > index 37087cf7dc5a..d517fd847730 100644 > > > > --- a/net/bluetooth/mgmt.c > > > > +++ b/net/bluetooth/mgmt.c > > > > @@ -9680,13 +9680,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > > > > { > > > > struct sk_buff *skb; > > > > struct mgmt_ev_device_found *ev; > > > > - u16 eir_len; > > > > - u32 flags; > > > > + u16 eir_len = 0; > > > > + u32 flags = 0; > > > > > > > > - if (name_len) > > > > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len); > > > > - else > > > > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0); > > > > + skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, > > > > + sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); > > > > > > Looks like mgmt_device_connected also has a similar problem. > > > > Yes, I was planning to send a patch to this one though it will not be as slick. > > It would be nice to have a helper which will call skb_put() and add > > eir data at once. > > Basically skb operation in pair to, what eir_append_data() does with > > help of eir_len but without awkwardness when passing return value to > > skb_put() (as it returns offset not size). > > Hmm, that might be a good idea indeed something like eir_append_skb, > if only we could grow the skb with skb_put directly that would > eliminate the problem with having to reserve enough space for the > worse case. > > > I will send V2 with two patches. I hope they will align with your > > original goal of eliminating the necessity of intermediary buffers at > > some point in future. Are you still planning to send the v2? > > > > > > > ev = skb_put(skb, sizeof(*ev)); > > > > bacpy(&ev->addr.bdaddr, bdaddr); > > > > @@ -9696,10 +9694,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > > > > if (name) { > > > > eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, > > > > name_len); > > > > - flags = 0; > > > > skb_put(skb, eir_len); > > > > } else { > > > > - eir_len = 0; > > > > flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; > > > > } > > > > > > These changes would leave flags and eir_len uninitialized. > > > > Both are initialized to 0 by this patch. > > Sorry, I must be blind that I didn't see you had changed that to be > initialized in their declaration. > > > > > > > > -- > > > > 2.34.1.703.g22d0c6ccf7-goog > > > > > > > > > > > > > -- > > > Luiz Augusto von Dentz > > > > -- > Luiz Augusto von Dentz -- Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Bluetooth: Fix skb allocation in mgmt_remote_name() 2022-01-31 18:47 ` Luiz Augusto von Dentz @ 2022-02-01 18:36 ` Radosław Biernacki 0 siblings, 0 replies; 6+ messages in thread From: Radosław Biernacki @ 2022-02-01 18:36 UTC (permalink / raw) To: Luiz Augusto von Dentz Cc: linux-bluetooth, Marcel Holtmann, CrosBT Upstreaming, Archie Pusaka, Miao-chen Chou, Jakub Kicinski, Johan Hedberg, Linux Kernel Mailing List, open list:NETWORKING [GENERAL], upstream, Angela Czubak, Marek Maslanka Hey Luiz. Sorry for keeping you waiting. I will send it today. pon., 31 sty 2022 o 19:47 Luiz Augusto von Dentz <luiz.dentz@gmail.com> napisał(a): > > Hi Radosław, > > On Thu, Jan 13, 2022 at 2:23 PM Luiz Augusto von Dentz > <luiz.dentz@gmail.com> wrote: > > > > Hi Radosław, > > > > On Thu, Jan 13, 2022 at 2:07 PM Radosław Biernacki <rad@semihalf.com> wrote: > > > > > > Hi Luiz, > > > > > > czw., 13 sty 2022 o 17:17 Luiz Augusto von Dentz > > > <luiz.dentz@gmail.com> napisał(a): > > > > > > > > Hi Radoslaw, > > > > > > > > On Thu, Jan 13, 2022 at 7:09 AM Radoslaw Biernacki <rad@semihalf.com> wrote: > > > > > > > > > > From: Radoslaw Biernacki <rad@semihalf.com> > > > > > > > > > > This patch fixes skb allocation, as lack of space for ev might push skb > > > > > tail beyond its end. > > > > > Also introduce eir_precalc_len() that can be used instead of magic > > > > > numbers for similar eir operations on skb. > > > > > > > > > > Fixes: cf1bce1de7eeb ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_FOUND") > > > > > Signed-off-by: Angela Czubak <acz@semihalf.com> > > > > > Signed-off-by: Marek Maslanka <mm@semihalf.com> > > > > > Signed-off-by: Radoslaw Biernacki <rad@semihalf.com> > > > > > --- > > > > > net/bluetooth/eir.h | 5 +++++ > > > > > net/bluetooth/mgmt.c | 12 ++++-------- > > > > > 2 files changed, 9 insertions(+), 8 deletions(-) > > > > > > > > > > diff --git a/net/bluetooth/eir.h b/net/bluetooth/eir.h > > > > > index 05e2e917fc25..e5876751f07e 100644 > > > > > --- a/net/bluetooth/eir.h > > > > > +++ b/net/bluetooth/eir.h > > > > > @@ -15,6 +15,11 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr); > > > > > u8 eir_append_local_name(struct hci_dev *hdev, u8 *eir, u8 ad_len); > > > > > u8 eir_append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len); > > > > > > > > > > +static inline u16 eir_precalc_len(u8 data_len) > > > > > +{ > > > > > + return sizeof(u8) * 2 + data_len; > > > > > +} > > > > > + > > > > > static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, > > > > > u8 *data, u8 data_len) > > > > > { > > > > > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c > > > > > index 37087cf7dc5a..d517fd847730 100644 > > > > > --- a/net/bluetooth/mgmt.c > > > > > +++ b/net/bluetooth/mgmt.c > > > > > @@ -9680,13 +9680,11 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > > > > > { > > > > > struct sk_buff *skb; > > > > > struct mgmt_ev_device_found *ev; > > > > > - u16 eir_len; > > > > > - u32 flags; > > > > > + u16 eir_len = 0; > > > > > + u32 flags = 0; > > > > > > > > > > - if (name_len) > > > > > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len); > > > > > - else > > > > > - skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0); > > > > > + skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, > > > > > + sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); > > > > > > > > Looks like mgmt_device_connected also has a similar problem. > > > > > > Yes, I was planning to send a patch to this one though it will not be as slick. > > > It would be nice to have a helper which will call skb_put() and add > > > eir data at once. > > > Basically skb operation in pair to, what eir_append_data() does with > > > help of eir_len but without awkwardness when passing return value to > > > skb_put() (as it returns offset not size). > > > > Hmm, that might be a good idea indeed something like eir_append_skb, > > if only we could grow the skb with skb_put directly that would > > eliminate the problem with having to reserve enough space for the > > worse case. > > > > > I will send V2 with two patches. I hope they will align with your > > > original goal of eliminating the necessity of intermediary buffers at > > > some point in future. > > Are you still planning to send the v2? > > > > > > > > > > ev = skb_put(skb, sizeof(*ev)); > > > > > bacpy(&ev->addr.bdaddr, bdaddr); > > > > > @@ -9696,10 +9694,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, > > > > > if (name) { > > > > > eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, > > > > > name_len); > > > > > - flags = 0; > > > > > skb_put(skb, eir_len); > > > > > } else { > > > > > - eir_len = 0; > > > > > flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; > > > > > } > > > > > > > > These changes would leave flags and eir_len uninitialized. > > > > > > Both are initialized to 0 by this patch. > > > > Sorry, I must be blind that I didn't see you had changed that to be > > initialized in their declaration. > > > > > > > > > > > -- > > > > > 2.34.1.703.g22d0c6ccf7-goog > > > > > > > > > > > > > > > > > -- > > > > Luiz Augusto von Dentz > > > > > > > > -- > > Luiz Augusto von Dentz > > > > -- > Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-02-01 18:37 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2022-01-13 15:08 [PATCH] Bluetooth: Fix skb allocation in mgmt_remote_name() Radoslaw Biernacki 2022-01-13 16:17 ` Luiz Augusto von Dentz 2022-01-13 22:07 ` Radosław Biernacki 2022-01-13 22:23 ` Luiz Augusto von Dentz 2022-01-31 18:47 ` Luiz Augusto von Dentz 2022-02-01 18:36 ` Radosław Biernacki
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).