Hi Gustavo,
On Tue, Dec 20, 2011 at 01:02:57PM -0800, Marcel Holtmann wrote:
> > > Remove unneeded skb_pull and correct packet length calculation
> > > removing magic number. Move BT_DBG after len check otherwise
> > > it could possibly access wrong memory.
> > >
> > > Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@xxxxxxxxx>
> > > ---
> > > net/bluetooth/hci_event.c | 9 ++++-----
> > > 1 files changed, 4 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> > > index 919e3c0..47e1476 100644
> > > --- a/net/bluetooth/hci_event.c
> > > +++ b/net/bluetooth/hci_event.c
> > > @@ -2266,20 +2266,19 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s
> > > struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
> > > int i;
> > >
> > > - skb_pull(skb, sizeof(*ev));
> > > -
> > > - BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
> > > -
> > > if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
> > > BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
> > > return;
> > > }
> > >
> > > - if (skb->len < ev->num_hndl * 4) {
> > > + if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
> > > + ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
> >
> > I think you can remove the first part of this check.
>
> you are accessing ev->num_handl, so you need to ensure that you have at
> least ev->num_handl size of data in your SKB. So this code is correct.
BTW: I resent the remaining patch from this series. Cannot add more to
Marcel's comment above.
Best regards
Andrei Emeltchenko
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
