Skip to content

Commit b48b833

Browse files
Vudentzholtmann
authored andcommitted
Bluetooth: HCI: Use skb_pull_data to parse LE Ext Advertising Report event
This uses skb_pull_data to check the LE Extended Advertising Report events received have the minimum required length. Signed-off-by: Luiz Augusto von Dentz <[email protected]> Signed-off-by: Marcel Holtmann <[email protected]>
1 parent 47afe93 commit b48b833

File tree

2 files changed

+36
-17
lines changed

2 files changed

+36
-17
lines changed

include/net/bluetooth/hci.h

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2517,20 +2517,25 @@ struct hci_ev_le_phy_update_complete {
25172517
} __packed;
25182518

25192519
#define HCI_EV_LE_EXT_ADV_REPORT 0x0d
2520-
struct hci_ev_le_ext_adv_report {
2521-
__le16 evt_type;
2520+
struct hci_ev_le_ext_adv_info {
2521+
__le16 type;
25222522
__u8 bdaddr_type;
25232523
bdaddr_t bdaddr;
25242524
__u8 primary_phy;
25252525
__u8 secondary_phy;
25262526
__u8 sid;
25272527
__u8 tx_power;
25282528
__s8 rssi;
2529-
__le16 interval;
2530-
__u8 direct_addr_type;
2529+
__le16 interval;
2530+
__u8 direct_addr_type;
25312531
bdaddr_t direct_addr;
2532-
__u8 length;
2533-
__u8 data[];
2532+
__u8 length;
2533+
__u8 data[];
2534+
} __packed;
2535+
2536+
struct hci_ev_le_ext_adv_report {
2537+
__u8 num;
2538+
struct hci_ev_le_ext_adv_info info[];
25342539
} __packed;
25352540

25362541
#define HCI_EV_LE_ENHANCED_CONN_COMPLETE 0x0a

net/bluetooth/hci_event.c

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6649,26 +6649,40 @@ static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
66496649

66506650
static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
66516651
{
6652-
u8 num_reports = skb->data[0];
6653-
void *ptr = &skb->data[1];
6652+
struct hci_ev_le_ext_adv_report *ev;
6653+
6654+
ev = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6655+
sizeof(*ev));
6656+
if (!ev)
6657+
return;
6658+
6659+
if (!ev->num)
6660+
return;
66546661

66556662
hci_dev_lock(hdev);
66566663

6657-
while (num_reports--) {
6658-
struct hci_ev_le_ext_adv_report *ev = ptr;
6664+
while (ev->num--) {
6665+
struct hci_ev_le_ext_adv_info *info;
66596666
u8 legacy_evt_type;
66606667
u16 evt_type;
66616668

6662-
evt_type = __le16_to_cpu(ev->evt_type);
6669+
info = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6670+
sizeof(*info));
6671+
if (!info)
6672+
break;
6673+
6674+
if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6675+
info->length))
6676+
break;
6677+
6678+
evt_type = __le16_to_cpu(info->type);
66636679
legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
66646680
if (legacy_evt_type != LE_ADV_INVALID) {
6665-
process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
6666-
ev->bdaddr_type, NULL, 0, ev->rssi,
6667-
ev->data, ev->length,
6681+
process_adv_report(hdev, legacy_evt_type, &info->bdaddr,
6682+
info->bdaddr_type, NULL, 0,
6683+
info->rssi, info->data, info->length,
66686684
!(evt_type & LE_EXT_ADV_LEGACY_PDU));
66696685
}
6670-
6671-
ptr += sizeof(*ev) + ev->length;
66726686
}
66736687

66746688
hci_dev_unlock(hdev);
@@ -7019,7 +7033,7 @@ static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
70197033
{
70207034
struct hci_ev_le_advertising_info *adv;
70217035
struct hci_ev_le_direct_adv_info *direct_adv;
7022-
struct hci_ev_le_ext_adv_report *ext_adv;
7036+
struct hci_ev_le_ext_adv_info *ext_adv;
70237037
const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
70247038
const struct hci_ev_conn_request *conn_request = (void *)skb->data;
70257039

0 commit comments

Comments
 (0)