netdev - Re: [PATCH] RFC: Bluetooth: missed cpu_to_le16 conversion in hci_init4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Oct 2019 14:20:23 +0200
From:   Simon Horman <simon.horman@...ronome.com>
To:     "Ben Dooks (Codethink)" <ben.dooks@...ethink.co.uk>
Cc:     linux-kernel@...ts.codethink.co.uk,
        Marcel Holtmann <marcel@...tmann.org>,
        Johan Hedberg <johan.hedberg@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        linux-bluetooth@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] RFC: Bluetooth: missed cpu_to_le16 conversion in
 hci_init4_req

On Wed, Oct 16, 2019 at 12:39:43PM +0100, Ben Dooks (Codethink) wrote:
> It looks like in hci_init4_req() the request is being
> initialised from cpu-endian data but the packet is specified
> to be little-endian. This causes an warning from sparse due
> to __le16 to u16 conversion.
> 
> Fix this by using cpu_to_le16() on the two fields in the packet.
> 
> net/bluetooth/hci_core.c:845:27: warning: incorrect type in assignment (different base types)
> net/bluetooth/hci_core.c:845:27:    expected restricted __le16 [usertype] tx_len
> net/bluetooth/hci_core.c:845:27:    got unsigned short [usertype] le_max_tx_len
> net/bluetooth/hci_core.c:846:28: warning: incorrect type in assignment (different base types)
> net/bluetooth/hci_core.c:846:28:    expected restricted __le16 [usertype] tx_time
> net/bluetooth/hci_core.c:846:28:    got unsigned short [usertype] le_max_tx_time
> 
> Signed-off-by: Ben Dooks <ben.dooks@...ethink.co.uk>
> ---
> Cc: Marcel Holtmann <marcel@...tmann.org>
> Cc: Johan Hedberg <johan.hedberg@...il.com>
> Cc: "David S. Miller" <davem@...emloft.net>
> Cc: linux-bluetooth@...r.kernel.org
> Cc: netdev@...r.kernel.org
> Cc: linux-kernel@...r.kernel.org
> ---
>  net/bluetooth/hci_core.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index 04bc79359a17..b2559d4bed81 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -842,8 +842,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt)
>  	if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
>  		struct hci_cp_le_write_def_data_len cp;
>  
> -		cp.tx_len = hdev->le_max_tx_len;
> -		cp.tx_time = hdev->le_max_tx_time;
> +		cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
> +		cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);

I would suggest that the naming of the le_ fields of struct hci_dev
implies that the values stored in those fields should be little endian
(but those that are more than bone byte wide are not).

In any case, the question arises as to if this has ever worked on big
endian machines.

>  		hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
>  	}
>  
> -- 
> 2.23.0
>