github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 20:54:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: hci_event: Use 255 as max event payload length in hci_ev_table[]

Browse Source 
hci_event_func() validates skb->len against ev->max_len from the
entry in hci_ev_table[]. By then, the header has already been
stripped by skb_pull(). So the max event payload is 255, but
hci_ev_table[] still uses HCI_MAX_EVENT_SIZE (260) for it, which is
imprecise.

Fix by introducing HCI_MAX_EVENT_PLEN (255) and using it instead.

Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Zijun Hu 2026-08-01 23:31:42 -07:00 committed by Luiz Augusto von Dentz
parent 0bd606b31d
commit 9a4fa3cddc
2 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/net/bluetooth/hci.h
View File

@ -3382,6 +3382,7 @@ struct hci_ev_si_security {
/* ---- HCI Packet structures ---- */
#define HCI_COMMAND_HDR_SIZE 3
#define HCI_EVENT_HDR_SIZE 2
#define HCI_MAX_EVENT_PLEN 255
#define HCI_ACL_HDR_SIZE 4
#define HCI_SCO_HDR_SIZE 3
#define HCI_ISO_HDR_SIZE 4

14
net/bluetooth/hci_event.c
View File

@ -7728,7 +7728,7 @@ static const struct hci_ev {
HCI_EV_STATUS(HCI_EV_INQUIRY_COMPLETE, hci_inquiry_complete_evt),
/* [0x02 = HCI_EV_INQUIRY_RESULT] */
HCI_EV_VL(HCI_EV_INQUIRY_RESULT, hci_inquiry_result_evt,
sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_SIZE),
sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_PLEN),
/* [0x03 = HCI_EV_CONN_COMPLETE] */
HCI_EV(HCI_EV_CONN_COMPLETE, hci_conn_complete_evt,
sizeof(struct hci_ev_conn_complete)),
@ -7756,7 +7756,7 @@ static const struct hci_ev {
sizeof(struct hci_ev_remote_features)),
/* [0x0e = HCI_EV_CMD_COMPLETE] */
HCI_EV_REQ_VL(HCI_EV_CMD_COMPLETE, hci_cmd_complete_evt,
sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_SIZE),
sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_PLEN),
/* [0x0f = HCI_EV_CMD_STATUS] */
HCI_EV_REQ(HCI_EV_CMD_STATUS, hci_cmd_status_evt,
sizeof(struct hci_ev_cmd_status)),
@ -7768,7 +7768,7 @@ static const struct hci_ev {
sizeof(struct hci_ev_role_change)),
/* [0x13 = HCI_EV_NUM_COMP_PKTS] */
HCI_EV_VL(HCI_EV_NUM_COMP_PKTS, hci_num_comp_pkts_evt,
sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_SIZE),
sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_PLEN),
/* [0x14 = HCI_EV_MODE_CHANGE] */
HCI_EV(HCI_EV_MODE_CHANGE, hci_mode_change_evt,
sizeof(struct hci_ev_mode_change)),
@ -7794,7 +7794,7 @@ static const struct hci_ev {
HCI_EV_VL(HCI_EV_INQUIRY_RESULT_WITH_RSSI,
hci_inquiry_result_with_rssi_evt,
sizeof(struct hci_ev_inquiry_result_rssi),
HCI_MAX_EVENT_SIZE),
HCI_MAX_EVENT_PLEN),
/* [0x23 = HCI_EV_REMOTE_EXT_FEATURES] */
HCI_EV(HCI_EV_REMOTE_EXT_FEATURES, hci_remote_ext_features_evt,
sizeof(struct hci_ev_remote_ext_features)),
@ -7804,7 +7804,7 @@ static const struct hci_ev {
/* [0x2f = HCI_EV_EXTENDED_INQUIRY_RESULT] */
HCI_EV_VL(HCI_EV_EXTENDED_INQUIRY_RESULT,
hci_extended_inquiry_result_evt,
sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_SIZE),
sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_PLEN),
/* [0x30 = HCI_EV_KEY_REFRESH_COMPLETE] */
HCI_EV(HCI_EV_KEY_REFRESH_COMPLETE, hci_key_refresh_complete_evt,
sizeof(struct hci_ev_key_refresh_complete)),
@ -7837,9 +7837,9 @@ static const struct hci_ev {
sizeof(struct hci_ev_remote_host_features)),
/* [0x3e = HCI_EV_LE_META] */
HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE),
sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_PLEN),
/* [0xff = HCI_EV_VENDOR] */
HCI_EV_VL(HCI_EV_VENDOR, hci_vendor_evt, 0, HCI_MAX_EVENT_SIZE),
HCI_EV_VL(HCI_EV_VENDOR, hci_vendor_evt, 0, HCI_MAX_EVENT_PLEN),
};
static void hci_event_func(struct hci_dev *hdev, u8 event, struct sk_buff *skb,