linux-kernel - Re: [PATCH] Bluetooth: Keep a copy of each HID device's report descriptor.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 04 Feb 2010 06:23:10 -0800
From:	Marcel Holtmann <marcel@...tmann.org>
To:	Michael Poole <mdpoole@...ilus.org>
Cc:	Bastien Nocera <hadess@...ess.net>, Jiri Kosina <jkosina@...e.cz>,
	"Gunn, Brian" <bgunn@...ekai.com>, Ping <pinglinux@...il.com>,
	linux-kernel@...r.kernel.org,
	BlueZ development <linux-bluetooth@...r.kernel.org>
Subject: Re: [PATCH] Bluetooth: Keep a copy of each HID device's report
 descriptor.

Hi Michael,

> This patch works for me.  Bastien, does it also fix it for you?
> 
> Michael Poole
> 
> From f8aeb64ac2d42f5fae080c00a287fdbd8304ffa2 Mon Sep 17 00:00:00 2001
> From: Michael Poole <mdpoole@...ilus.org>
> Date: Wed, 3 Feb 2010 21:49:48 -0500
> Subject: [PATCH] Bluetooth: Keep a copy of each HID device's report descriptor.
> 
> The report descriptor is read by user space (via the Service
> Discovery Protocol), so it is only available during the ioctl
> to connect.  However, the probe function that needs the
> descriptor might not be called until a specific module is
> loaded.  Keep a copy of the descriptor so it is available for
> later use.

looks good to me. I just prefer that you do the allocation of the report
descriptor before the HID object:

@@ -770,12 +770,24 @@ static int hidp_setup_hid(struct hidp_session *session,
        bdaddr_t src, dst;
        int err;
 
+       session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
+       if (!session->rd_data)
+               return -ENOMEM;
+
+       if (copy_from_user(session->rd_data, req->rd_data, req->rd_size)) {
+               err = -EFAULT;
+               goto fault;
+       }
+
+       session->rd_size = req->rd_size;
+
        hid = hid_allocate_device();
-       if (IS_ERR(hid))
-               return PTR_ERR(hid);
+       if (IS_ERR(hid)) {
+               err = PTR_ERR(hid);
+               goto fault;
+       }
 
        session->hid = hid;
-       session->req = req;
        hid->driver_data = session;
 
        baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
@@ -806,6 +818,10 @@ failed:
        hid_destroy_device(hid);
        session->hid = NULL;
 
+fault:
+       kfree(session->rd_data);
+       session->rd_data = NULL;
+
        return err;

Regards

Marcel


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/