linux-kernel - [PATCH] Bluetooth: Keep a copy of each HID device's report descriptor.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 04 Feb 2010 07:26:12 -0500
From:	Michael Poole <mdpoole@...ilus.org>
To:	Marcel Holtmann <marcel@...tmann.org>,
	Bastien Nocera <hadess@...ess.net>
Cc:	Jiri Kosina <jkosina@...e.cz>, "Gunn\, Brian" <bgunn@...ekai.com>,
	Ping <pinglinux@...il.com>, linux-kernel@...r.kernel.org,
	BlueZ development <linux-bluetooth@...r.kernel.org>
Subject: [PATCH] Bluetooth: Keep a copy of each HID device's report descriptor.

Bastien and Marcel,

This patch works for me.  Bastien, does it also fix it for you?

Michael Poole

>From f8aeb64ac2d42f5fae080c00a287fdbd8304ffa2 Mon Sep 17 00:00:00 2001
From: Michael Poole <mdpoole@...ilus.org>
Date: Wed, 3 Feb 2010 21:49:48 -0500
Subject: [PATCH] Bluetooth: Keep a copy of each HID device's report descriptor.

The report descriptor is read by user space (via the Service
Discovery Protocol), so it is only available during the ioctl
to connect.  However, the probe function that needs the
descriptor might not be called until a specific module is
loaded.  Keep a copy of the descriptor so it is available for
later use.

Signed-off-by: Michael Poole <mdpoole@...ilus.org>
---
 net/bluetooth/hidp/core.c |   42 +++++++++++++++++++-----------------------
 net/bluetooth/hidp/hidp.h |    4 +++-
 2 files changed, 22 insertions(+), 24 deletions(-)

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index dde4c60..af4a448 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -701,29 +701,9 @@ static void hidp_close(struct hid_device *hid)
 static int hidp_parse(struct hid_device *hid)
 {
 	struct hidp_session *session = hid->driver_data;
-	struct hidp_connadd_req *req = session->req;
-	unsigned char *buf;
-	int ret;
-
-	buf = kmalloc(req->rd_size, GFP_KERNEL);
-	if (!buf)
-		return -ENOMEM;
-
-	if (copy_from_user(buf, req->rd_data, req->rd_size)) {
-		kfree(buf);
-		return -EFAULT;
-	}
-
-	ret = hid_parse_report(session->hid, buf, req->rd_size);
-
-	kfree(buf);
-
-	if (ret)
-		return ret;
 
-	session->req = NULL;
-
-	return 0;
+	return hid_parse_report(session->hid, session->rd_data,
+			session->rd_size);
 }
 
 static int hidp_start(struct hid_device *hid)
@@ -798,7 +778,17 @@ static int hidp_setup_hid(struct hidp_session *session,
 		return PTR_ERR(hid);
 
 	session->hid = hid;
-	session->req = req;
+	session->rd_size = req->rd_size;
+	session->rd_data = kzalloc(session->rd_size, GFP_KERNEL);
+	if (!session->rd_data) {
+		err = -ENOMEM;
+		goto failed;
+	}
+	if (copy_from_user(session->rd_data, req->rd_data, session->rd_size)) {
+		err = -EFAULT;
+		goto failed;
+	}
+
 	hid->driver_data = session;
 
 	baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
@@ -829,6 +819,9 @@ failed:
 	hid_destroy_device(hid);
 	session->hid = NULL;
 
+	kfree(session->rd_data);
+	session->rd_data = NULL;
+
 	return err;
 }
 
@@ -923,6 +916,9 @@ unlink:
 		session->hid = NULL;
 	}
 
+	kfree(session->rd_data);
+	session->rd_data = NULL;
+
 purge:
 	skb_queue_purge(&session->ctrl_transmit);
 	skb_queue_purge(&session->intr_transmit);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index faf3d74..a4e215d 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -154,7 +154,9 @@ struct hidp_session {
 	struct sk_buff_head ctrl_transmit;
 	struct sk_buff_head intr_transmit;
 
-	struct hidp_connadd_req *req;
+	/* Report descriptor */
+	__u8 *rd_data;
+	uint rd_size;
 };
 
 static inline void hidp_schedule(struct hidp_session *session)
-- 
1.6.5.6
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/