Commit 0ab905c3 authored by Zijun Hu's avatar Zijun Hu Committed by Luiz Augusto von Dentz

Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue

API hci_devcd_init() stores its u32 type parameter @dump_size into
skb, but it does not specify which byte order is used to store the
integer, let us take little endian to store and parse the integer.

Fixes: f5cc609d09d4 ("Bluetooth: Add support for hci devcoredump")
Signed-off-by: default avatarZijun Hu <quic_zijuhu@quicinc.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 25c150ac
...@@ -5,6 +5,7 @@ ...@@ -5,6 +5,7 @@
#include <linux/devcoredump.h> #include <linux/devcoredump.h>
#include <asm/unaligned.h>
#include <net/bluetooth/bluetooth.h> #include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h> #include <net/bluetooth/hci_core.h>
...@@ -180,25 +181,25 @@ static int hci_devcd_prepare(struct hci_dev *hdev, u32 dump_size) ...@@ -180,25 +181,25 @@ static int hci_devcd_prepare(struct hci_dev *hdev, u32 dump_size)
static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb) static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb)
{ {
u32 *dump_size; u32 dump_size;
if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) { if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) {
DBG_UNEXPECTED_STATE(); DBG_UNEXPECTED_STATE();
return; return;
} }
if (skb->len != sizeof(*dump_size)) { if (skb->len != sizeof(dump_size)) {
bt_dev_dbg(hdev, "Invalid dump init pkt"); bt_dev_dbg(hdev, "Invalid dump init pkt");
return; return;
} }
dump_size = skb_pull_data(skb, sizeof(*dump_size)); dump_size = get_unaligned_le32(skb_pull_data(skb, 4));
if (!*dump_size) { if (!dump_size) {
bt_dev_err(hdev, "Zero size dump init pkt"); bt_dev_err(hdev, "Zero size dump init pkt");
return; return;
} }
if (hci_devcd_prepare(hdev, *dump_size)) { if (hci_devcd_prepare(hdev, dump_size)) {
bt_dev_err(hdev, "Failed to prepare for dump"); bt_dev_err(hdev, "Failed to prepare for dump");
return; return;
} }
...@@ -441,7 +442,7 @@ int hci_devcd_init(struct hci_dev *hdev, u32 dump_size) ...@@ -441,7 +442,7 @@ int hci_devcd_init(struct hci_dev *hdev, u32 dump_size)
return -ENOMEM; return -ENOMEM;
hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT; hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT;
skb_put_data(skb, &dump_size, sizeof(dump_size)); put_unaligned_le32(dump_size, skb_put(skb, 4));
skb_queue_tail(&hdev->dump.dump_q, skb); skb_queue_tail(&hdev->dump.dump_q, skb);
queue_work(hdev->workqueue, &hdev->dump.dump_rx); queue_work(hdev->workqueue, &hdev->dump.dump_rx);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment