linux-kernel - [PATCH] Bluetooth: btrtl: Correct the length of the HCI command for drop fw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230530083420.6876-1-max.chou@realtek.com>
Date:   Tue, 30 May 2023 16:34:20 +0800
From:   <max.chou@...ltek.com>
To:     <marcel@...tmann.org>, <johan.hedberg@...il.com>,
        <luiz.dentz@...il.com>
CC:     <linux-bluetooth@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <alex_lu@...lsil.com.cn>, <hildawu@...ltek.com>,
        <max.chou@...ltek.com>
Subject: [PATCH] Bluetooth: btrtl: Correct the length of the HCI command for drop fw

From: Max Chou <max.chou@...ltek.com>

The original code did not determine the length value of the HCI command
for drop fw even there's no parameter needed. In this commit, use struct
hci_command_hdr to manage opcode and length. It would be more regular and
more readable.

Suggested-by: Alex Lu <alex_lu@...lsil.com.cn>
Signed-off-by: Max Chou <max.chou@...ltek.com>
---
 drivers/bluetooth/btrtl.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 9a6ae8a2adfc..04399b3c39a0 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1044,12 +1044,11 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
 	struct btrtl_device_info *btrtl_dev;
 	struct sk_buff *skb;
 	struct hci_rp_read_local_version *resp;
+	struct hci_command_hdr *cmd;
 	char cfg_name[40];
 	u16 hci_rev, lmp_subver;
 	u8 hci_ver, lmp_ver, chip_type = 0;
 	int ret;
-	u16 opcode;
-	u8 cmd[2];
 	u8 reg_val[2];
 
 	btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);
@@ -1118,15 +1117,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
 		btrtl_dev->drop_fw = false;
 
 	if (btrtl_dev->drop_fw) {
-		opcode = hci_opcode_pack(0x3f, 0x66);
-		cmd[0] = opcode & 0xff;
-		cmd[1] = opcode >> 8;
-
-		skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
+		skb = bt_skb_alloc(sizeof(*cmd), GFP_KERNEL);
 		if (!skb)
 			goto err_free;
 
-		skb_put_data(skb, cmd, sizeof(cmd));
+		cmd = skb_put(skb, HCI_COMMAND_HDR_SIZE);
+		cmd->opcode = cpu_to_le16(0xfc66);
+		cmd->plen = 0;
+
 		hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
 
 		ret = hdev->send(hdev, skb);
-- 
2.34.1