linux-kernel - Re: [PATCH v5] bluetooth: hci_qca: Fix QCA6390 memdump failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <DAC1E799-28F2-420F-987E-51BAAE96909A@holtmann.org>
Date:   Mon, 1 Jun 2020 08:08:45 +0200
From:   Marcel Holtmann <marcel@...tmann.org>
To:     Zijun Hu <zijuhu@...eaurora.org>
Cc:     Johan Hedberg <johan.hedberg@...il.com>,
        linux-kernel@...r.kernel.org, linux-bluetooth@...r.kernel.org,
        linux-arm-msm@...r.kernel.org, bgodavar@...eaurora.org,
        c-hbandi@...eaurora.org, hemantg@...eaurora.org, mka@...omium.org,
        rjliao@...eaurora.org
Subject: Re: [PATCH v5] bluetooth: hci_qca: Fix QCA6390 memdump failure

Hi Zijun,

> QCA6390 memdump VSE sometimes come to bluetooth driver
> with wrong sequence number as illustrated as follows:
> frame # in dec: frame data in hex
> 1396: ff fd 01 08 74 05 00 37 8f 14
> 1397: ff fd 01 08 75 05 00 ff bf 38
> 1414: ff fd 01 08 86 05 00 fb 5e 4b
> 1399: ff fd 01 08 77 05 00 f3 44 0a
> 1400: ff fd 01 08 78 05 00 ca f7 41
> it is mistook for controller missing packets, so results
> in page fault after overwriting memdump buffer allocated.
> 
> Fixed by ignoring QCA6390 sequence number check and
> checking buffer space before writing.
> 
> Signed-off-by: Zijun Hu <zijuhu@...eaurora.org>
> Tested-by: Zijun Hu <zijuhu@...eaurora.org>
> ---
> Changes in v5:
> - correct coding style of qca_controller_memdump()
> 
> Changes in v4:
> - add a piece of code comments
> 
> Changes in v3:
> - correct coding style
> 
> Changes in v2:
> - rename a local variable from @temp to @rx_size
> 
> drivers/bluetooth/hci_qca.c | 54 +++++++++++++++++++++++++++++++++++++--------
> 1 file changed, 45 insertions(+), 9 deletions(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel