From 0ab905c3be8c2be368821dd2bd1f8d126064d993 Mon Sep 17 00:00:00 2001 From: Zijun Hu Date: Mon, 17 Apr 2023 17:39:59 +0800 Subject: [PATCH] Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue API hci_devcd_init() stores its u32 type parameter @dump_size into skb, but it does not specify which byte order is used to store the integer, let us take little endian to store and parse the integer. Fixes: f5cc609d09d4 ("Bluetooth: Add support for hci devcoredump") Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz --- net/bluetooth/coredump.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/net/bluetooth/coredump.c b/net/bluetooth/coredump.c index 08fa9850..d2d2624 100644 --- a/net/bluetooth/coredump.c +++ b/net/bluetooth/coredump.c @@ -5,6 +5,7 @@ #include +#include #include #include @@ -180,25 +181,25 @@ hdr_free: static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb) { - u32 *dump_size; + u32 dump_size; if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) { DBG_UNEXPECTED_STATE(); return; } - if (skb->len != sizeof(*dump_size)) { + if (skb->len != sizeof(dump_size)) { bt_dev_dbg(hdev, "Invalid dump init pkt"); return; } - dump_size = skb_pull_data(skb, sizeof(*dump_size)); - if (!*dump_size) { + dump_size = get_unaligned_le32(skb_pull_data(skb, 4)); + if (!dump_size) { bt_dev_err(hdev, "Zero size dump init pkt"); return; } - if (hci_devcd_prepare(hdev, *dump_size)) { + if (hci_devcd_prepare(hdev, dump_size)) { bt_dev_err(hdev, "Failed to prepare for dump"); return; } @@ -441,7 +442,7 @@ int hci_devcd_init(struct hci_dev *hdev, u32 dump_size) return -ENOMEM; hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT; - skb_put_data(skb, &dump_size, sizeof(dump_size)); + put_unaligned_le32(dump_size, skb_put(skb, 4)); skb_queue_tail(&hdev->dump.dump_q, skb); queue_work(hdev->workqueue, &hdev->dump.dump_rx); -- 2.7.4