Bluetooth: HCI: Use skb_pull_data to parse Inquiry Result with RSSI event

This uses skb_pull_data to check the Inquiry Result with RSSI events
received have the minimum required length.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 55466bfb972a0db5a8d9655171949455e9e37687..d25afd92a46e0974ebcc08d50fe2d50d756d7ab0 100644 (file)
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -2194,7 +2194,7 @@ struct hci_ev_pscan_rep_mode {
 } __packed;
 
 #define HCI_EV_INQUIRY_RESULT_WITH_RSSI        0x22
-struct inquiry_info_with_rssi {
+struct inquiry_info_rssi {
        bdaddr_t bdaddr;
        __u8     pscan_rep_mode;
        __u8     pscan_period_mode;
@@ -2202,7 +2202,7 @@ struct inquiry_info_with_rssi {
        __le16   clock_offset;
        __s8     rssi;
 } __packed;
-struct inquiry_info_with_rssi_and_pscan_mode {
+struct inquiry_info_rssi_pscan {
        bdaddr_t bdaddr;
        __u8     pscan_rep_mode;
        __u8     pscan_period_mode;
@@ -2211,6 +2211,14 @@ struct inquiry_info_with_rssi_and_pscan_mode {
        __le16   clock_offset;
        __s8     rssi;
 } __packed;
+struct hci_ev_inquiry_result_rssi {
+       __u8     num;
+       struct inquiry_info_rssi info[];
+} __packed;
+struct hci_ev_inquiry_result_rssi_pscan {
+       __u8     num;
+       struct inquiry_info_rssi_pscan info[];
+} __packed;
 
 #define HCI_EV_REMOTE_EXT_FEATURES     0x23
 struct hci_ev_remote_ext_features {

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 0bf062f6f26292fb946764820a0c93744d9d9e6a..6560dca8c5ce5e7b93eec6b7eddbc89bd7268637 100644 (file)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4921,12 +4921,21 @@ static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
                                             struct sk_buff *skb)
 {
+       union {
+               struct hci_ev_inquiry_result_rssi *res1;
+               struct hci_ev_inquiry_result_rssi_pscan *res2;
+       } *ev;
        struct inquiry_data data;
-       int num_rsp = *((__u8 *) skb->data);
+       int i;
 
-       BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+       ev = hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT_WITH_RSSI,
+                            sizeof(*ev));
+       if (!ev)
+               return;
+
+       BT_DBG("%s num_rsp %d", hdev->name, ev->res1->num);
 
-       if (!num_rsp)
+       if (!ev->res1->num)
                return;
 
        if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
@@ -4934,16 +4943,13 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
 
        hci_dev_lock(hdev);
 
-       if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
-               struct inquiry_info_with_rssi_and_pscan_mode *info;
-               info = (void *) (skb->data + 1);
+       if (skb->len == flex_array_size(ev, res2->info, ev->res2->num)) {
+               struct inquiry_info_rssi_pscan *info;
 
-               if (skb->len < num_rsp * sizeof(*info) + 1)
-                       goto unlock;
-
-               for (; num_rsp; num_rsp--, info++) {
+               for (i = 0; i < ev->res2->num; i++) {
                        u32 flags;
 
+                       info = &ev->res2->info[i];
                        bacpy(&data.bdaddr, &info->bdaddr);
                        data.pscan_rep_mode     = info->pscan_rep_mode;
                        data.pscan_period_mode  = info->pscan_period_mode;
@@ -4959,15 +4965,13 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
                                          info->dev_class, info->rssi,
                                          flags, NULL, 0, NULL, 0);
                }
-       } else {
-               struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
+       } else if (skb->len == flex_array_size(ev, res1->info, ev->res1->num)) {
+               struct inquiry_info_rssi *info;
 
-               if (skb->len < num_rsp * sizeof(*info) + 1)
-                       goto unlock;
-
-               for (; num_rsp; num_rsp--, info++) {
+               for (i = 0; i < ev->res1->num; i++) {
                        u32 flags;
 
+                       info = &ev->res1->info[i];
                        bacpy(&data.bdaddr, &info->bdaddr);
                        data.pscan_rep_mode     = info->pscan_rep_mode;
                        data.pscan_period_mode  = info->pscan_period_mode;
@@ -4983,9 +4987,11 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
                                          info->dev_class, info->rssi,
                                          flags, NULL, 0, NULL, 0);
                }
+       } else {
+               bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
+                          HCI_EV_INQUIRY_RESULT_WITH_RSSI);
        }
 
-unlock:
        hci_dev_unlock(hdev);
 }