From: Johan Hedberg <johan.hedberg@xxxxxxxxx> Sent: Tuesday, January 19, 2016 9:04 PM
> To: b38611@xxxxxxxxxxxxx
> Cc: gustavo@xxxxxxxxxxx; marcel@xxxxxxxxxxxx; linux-
> bluetooth@xxxxxxxxxxxxxxx
> Subject: Re: [PATCH] Bluetooth: add hdev check to avoid passing null pointer
>
> Hi Fuang,
>
> On Tue, Jan 19, 2016, Fugang Duan wrote:
> > Function hci_mgmt_cmd() may pass hdev with null pointer to
> > hci_mgmt_handler->func() like below code:
> > err = handler->func(sk, hdev, cp, len);
> >
> > Add hdev check to avoid passing null pointer.
> >
> > Signed-off-by: Fugang Duan <B38611@xxxxxxxxxxxxx>
> > ---
> > net/bluetooth/hci_sock.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index
> > 1298d72..7fdfc80 100644
> > --- a/net/bluetooth/hci_sock.c
> > +++ b/net/bluetooth/hci_sock.c
> > @@ -1186,6 +1186,8 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan
> > *chan, struct sock *sk,
> >
> > if (hdev && chan->hdev_init)
> > chan->hdev_init(sk, hdev);
> > + else if (!hdev)
> > + goto done;
> >
> > cp = buf + sizeof(*hdr);
>
> Nack. There are handlers which are not hci-dev specific, such as reading version
> number, supported commands, or the index list. There's a special flag
> HCI_MGMT_NO_HDEV that handlers can set to say that they expect to be
> called without a hdev. The code in hci_mgmt_cmd() already makes sure that
> any handler that doesn't set it will not be called with NULL hdev.
>
> Johan
Thanks for your comments, the below piece of code can guarantee that any handler doesn't set HCI_MGMT_NO_HDEV will not be called with NULL hdev.
no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
if (no_hdev != !hdev) {
err = mgmt_cmd_status(sk, index, opcode,
MGMT_STATUS_INVALID_INDEX);
goto done;
}
Regards,
Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
