Hi Luiz,
> This uses skb_pull to check the Inquiry Result events received have
> the minimum required length.
>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
> ---
> include/net/bluetooth/hci.h | 5 +++++
> net/bluetooth/hci_event.c | 19 ++++++++++++++-----
> 2 files changed, 19 insertions(+), 5 deletions(-)
>
> diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
> index 9251ae3a2ce0..b65205b4d830 100644
> --- a/include/net/bluetooth/hci.h
> +++ b/include/net/bluetooth/hci.h
> @@ -1910,6 +1910,11 @@ struct inquiry_info {
> __le16 clock_offset;
> } __packed;
>
> +struct hci_ev_inquiry_result {
> + __u8 num;
> + struct inquiry_info info[];
> +};
> +
> #define HCI_EV_CONN_COMPLETE 0x03
> struct hci_ev_conn_complete {
> __u8 status;
> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> index c353dfafb04c..6516538fe238 100644
> --- a/net/bluetooth/hci_event.c
> +++ b/net/bluetooth/hci_event.c
> @@ -2990,13 +2990,21 @@ static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
>
> static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
> {
> + struct hci_ev_inquiry_result *ev;
> struct inquiry_data data;
> - struct inquiry_info *info = (void *) (skb->data + 1);
> - int num_rsp = *((__u8 *) skb->data);
> + int i;
>
> - BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
> + ev = hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT, sizeof(*ev));
> + if (!ev)
> + return;
>
> - if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
> + if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT,
> + flex_array_size(ev, info, ev->num)))
> + return;
> +
> + BT_DBG("%s num %d", hdev->name, ev->num);
please switch to bt_dev_dbg() here.
Regards
Marcel
