github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: hci_event: Use 252 as max CC event payload length in hci_cc_table[]

Browse Source 
hci_cc_func() validates skb->len against cc->max_len from the entry in
hci_cc_table[], But By then, the HCI event and CC headers have already been
stripped by skb_pull(). So the max CC payload is 252, but hci_cc_table[]
still uses HCI_MAX_EVENT_SIZE (260) for it, which is imprecise.

Fix by defining HCI_MAX_CC_PLEN (252) and using it instead.

Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Zijun Hu 2026-09-13 20:42:59 -07:00 committed by Luiz Augusto von Dentz
parent 9822887f0d
commit 51589ddae3
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/bluetooth/hci_event.c
View File

@ -4099,6 +4099,9 @@ static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data,
#define HCI_CC_STATUS(_op, _func) \
HCI_CC(_op, _func, sizeof(struct hci_ev_status))
#define HCI_MAX_CC_PLEN \
(HCI_MAX_EVENT_PLEN - sizeof(struct hci_ev_cmd_complete))
static const struct hci_cc {
u16 op;
u8 (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
@ -4192,7 +4195,7 @@ static const struct hci_cc {
sizeof(struct hci_rp_le_read_local_features)),
HCI_CC_VL(HCI_OP_LE_READ_CONN_INTERVAL, hci_cc_le_read_conn_interval,
sizeof(struct hci_rp_le_read_conn_interval),
HCI_MAX_EVENT_SIZE),
HCI_MAX_CC_PLEN),
HCI_CC(HCI_OP_LE_READ_ADV_TX_POWER, hci_cc_le_read_adv_tx_power,
sizeof(struct hci_rp_le_read_adv_tx_power)),
HCI_CC(HCI_OP_USER_CONFIRM_REPLY, hci_cc_user_confirm_reply,
@ -4264,7 +4267,7 @@ static const struct hci_cc {
HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2,
sizeof(struct hci_rp_le_read_buffer_size_v2)),
HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params,
sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_EVENT_SIZE),
sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_CC_PLEN),
HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path,
sizeof(struct hci_rp_le_setup_iso_path)),
HCI_CC(HCI_OP_LE_READ_ALL_LOCAL_FEATURES,