netdev - Re: [PATCH] RFC: Bluetooth: missed cpu_to_le16 conversion in hci_init4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Oct 2019 20:42:48 +0200
From:   Marcel Holtmann <marcel@...tmann.org>
To:     Simon Horman <simon.horman@...ronome.com>
Cc:     "Ben Dooks (Codethink)" <ben.dooks@...ethink.co.uk>,
        linux-kernel@...ts.codethink.co.uk,
        Johan Hedberg <johan.hedberg@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        linux-bluetooth@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] RFC: Bluetooth: missed cpu_to_le16 conversion in
 hci_init4_req

Hi Simon,

>> It looks like in hci_init4_req() the request is being
>> initialised from cpu-endian data but the packet is specified
>> to be little-endian. This causes an warning from sparse due
>> to __le16 to u16 conversion.
>> 
>> Fix this by using cpu_to_le16() on the two fields in the packet.
>> 
>> net/bluetooth/hci_core.c:845:27: warning: incorrect type in assignment (different base types)
>> net/bluetooth/hci_core.c:845:27:    expected restricted __le16 [usertype] tx_len
>> net/bluetooth/hci_core.c:845:27:    got unsigned short [usertype] le_max_tx_len
>> net/bluetooth/hci_core.c:846:28: warning: incorrect type in assignment (different base types)
>> net/bluetooth/hci_core.c:846:28:    expected restricted __le16 [usertype] tx_time
>> net/bluetooth/hci_core.c:846:28:    got unsigned short [usertype] le_max_tx_time
>> 
>> Signed-off-by: Ben Dooks <ben.dooks@...ethink.co.uk>
>> ---
>> Cc: Marcel Holtmann <marcel@...tmann.org>
>> Cc: Johan Hedberg <johan.hedberg@...il.com>
>> Cc: "David S. Miller" <davem@...emloft.net>
>> Cc: linux-bluetooth@...r.kernel.org
>> Cc: netdev@...r.kernel.org
>> Cc: linux-kernel@...r.kernel.org
>> ---
>> net/bluetooth/hci_core.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>> 
>> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
>> index 04bc79359a17..b2559d4bed81 100644
>> --- a/net/bluetooth/hci_core.c
>> +++ b/net/bluetooth/hci_core.c
>> @@ -842,8 +842,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt)
>> 	if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
>> 		struct hci_cp_le_write_def_data_len cp;
>> 
>> -		cp.tx_len = hdev->le_max_tx_len;
>> -		cp.tx_time = hdev->le_max_tx_time;
>> +		cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
>> +		cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
> 
> I would suggest that the naming of the le_ fields of struct hci_dev
> implies that the values stored in those fields should be little endian
> (but those that are more than bone byte wide are not).

the le_ stands for Low Energy and not for Little Endian.

Regards

Marcel