summaryrefslogtreecommitdiff
path: root/net/bluetooth
diff options
context:
space:
mode:
authorZijun Hu <quic_zijuhu@quicinc.com>2023-04-17 12:39:59 +0300
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>2023-04-24 08:05:53 +0300
commit0ab905c3be8c2be368821dd2bd1f8d126064d993 (patch)
treebe11e1f3013cd3c4ef2c046fa09416e013ece0a6 /net/bluetooth
parent25c150ac103a4ebeed0319994c742a90634ddf18 (diff)
downloadlinux-0ab905c3be8c2be368821dd2bd1f8d126064d993.tar.xz
Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue
API hci_devcd_init() stores its u32 type parameter @dump_size into skb, but it does not specify which byte order is used to store the integer, let us take little endian to store and parse the integer. Fixes: f5cc609d09d4 ("Bluetooth: Add support for hci devcoredump") Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'net/bluetooth')
-rw-r--r--net/bluetooth/coredump.c13
1 files changed, 7 insertions, 6 deletions
diff --git a/net/bluetooth/coredump.c b/net/bluetooth/coredump.c
index 08fa98505454..d2d2624ec708 100644
--- a/net/bluetooth/coredump.c
+++ b/net/bluetooth/coredump.c
@@ -5,6 +5,7 @@
#include <linux/devcoredump.h>
+#include <asm/unaligned.h>
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
@@ -180,25 +181,25 @@ hdr_free:
static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb)
{
- u32 *dump_size;
+ u32 dump_size;
if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) {
DBG_UNEXPECTED_STATE();
return;
}
- if (skb->len != sizeof(*dump_size)) {
+ if (skb->len != sizeof(dump_size)) {
bt_dev_dbg(hdev, "Invalid dump init pkt");
return;
}
- dump_size = skb_pull_data(skb, sizeof(*dump_size));
- if (!*dump_size) {
+ dump_size = get_unaligned_le32(skb_pull_data(skb, 4));
+ if (!dump_size) {
bt_dev_err(hdev, "Zero size dump init pkt");
return;
}
- if (hci_devcd_prepare(hdev, *dump_size)) {
+ if (hci_devcd_prepare(hdev, dump_size)) {
bt_dev_err(hdev, "Failed to prepare for dump");
return;
}
@@ -441,7 +442,7 @@ int hci_devcd_init(struct hci_dev *hdev, u32 dump_size)
return -ENOMEM;
hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT;
- skb_put_data(skb, &dump_size, sizeof(dump_size));
+ put_unaligned_le32(dump_size, skb_put(skb, 4));
skb_queue_tail(&hdev->dump.dump_q, skb);
queue_work(hdev->workqueue, &hdev->dump.dump_rx);