| Message ID | 1636546159-8339-1-git-send-email-zijuhu@codeaurora.org (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v1] Bluetooth: hci_h4: Fix padding calculation error within h4_recv_buf() | expand |
could you please code review for this patch? On 11/10/2021 8:09 PM, Zijun Hu wrote: > From: Zijun Hu <quic_zijuhu@quicinc.com> > > it is erroneous to calculate padding by subtracting length of type > indication from skb->len, it will cause data analysis error for > alignment which is greater than 1, so fixed by adding length of type > indication with skb->len. > > Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com> > --- > drivers/bluetooth/hci_h4.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c > index 4b3b14a34794..1d0cdf023243 100644 > --- a/drivers/bluetooth/hci_h4.c > +++ b/drivers/bluetooth/hci_h4.c > @@ -252,7 +252,7 @@ struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb, > } > > if (!dlen) { > - hu->padding = (skb->len - 1) % alignment; > + hu->padding = (skb->len + 1) % alignment; > hu->padding = (alignment - hu->padding) % alignment; > > /* No more data, complete frame */ > @@ -260,7 +260,7 @@ struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb, > skb = NULL; > } > } else { > - hu->padding = (skb->len - 1) % alignment; > + hu->padding = (skb->len + 1) % alignment; > hu->padding = (alignment - hu->padding) % alignment; > > /* Complete frame */ >
diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c index 4b3b14a34794..1d0cdf023243 100644 --- a/drivers/bluetooth/hci_h4.c +++ b/drivers/bluetooth/hci_h4.c @@ -252,7 +252,7 @@ struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb, } if (!dlen) { - hu->padding = (skb->len - 1) % alignment; + hu->padding = (skb->len + 1) % alignment; hu->padding = (alignment - hu->padding) % alignment; /* No more data, complete frame */ @@ -260,7 +260,7 @@ struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb, skb = NULL; } } else { - hu->padding = (skb->len - 1) % alignment; + hu->padding = (skb->len + 1) % alignment; hu->padding = (alignment - hu->padding) % alignment; /* Complete frame */