Commit 103a2f32 authored by Itay Iellin's avatar Itay Iellin Committed by Luiz Augusto von Dentz

Bluetooth: Fix the creation of hdev->name

Set a size limit of 8 bytes of the written buffer to "hdev->name"
including the terminating null byte, as the size of "hdev->name" is 8
bytes. If an id value which is greater than 9999 is allocated,
then the "snprintf(hdev->name, sizeof(hdev->name), "hci%d", id)"
function call would lead to a truncation of the id value in decimal
notation.

Set an explicit maximum id parameter in the id allocation function call.
The id allocation function defines the maximum allocated id value as the
maximum id parameter value minus one. Therefore, HCI_MAX_ID is defined
as 10000.
Signed-off-by: default avatarItay Iellin <ieitayie@gmail.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 3f95a747
...@@ -36,6 +36,9 @@ ...@@ -36,6 +36,9 @@
/* HCI priority */ /* HCI priority */
#define HCI_PRIO_MAX 7 #define HCI_PRIO_MAX 7
/* HCI maximum id value */
#define HCI_MAX_ID 10000
/* HCI Core structures */ /* HCI Core structures */
struct inquiry_data { struct inquiry_data {
bdaddr_t bdaddr; bdaddr_t bdaddr;
......
...@@ -2555,10 +2555,10 @@ int hci_register_dev(struct hci_dev *hdev) ...@@ -2555,10 +2555,10 @@ int hci_register_dev(struct hci_dev *hdev)
*/ */
switch (hdev->dev_type) { switch (hdev->dev_type) {
case HCI_PRIMARY: case HCI_PRIMARY:
id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL); id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
break; break;
case HCI_AMP: case HCI_AMP:
id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL); id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
break; break;
default: default:
return -EINVAL; return -EINVAL;
...@@ -2567,7 +2567,7 @@ int hci_register_dev(struct hci_dev *hdev) ...@@ -2567,7 +2567,7 @@ int hci_register_dev(struct hci_dev *hdev)
if (id < 0) if (id < 0)
return id; return id;
sprintf(hdev->name, "hci%d", id); snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
hdev->id = id; hdev->id = id;
BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment