2012-07-19 07:26:09

by Malovany, Ram

Subject: [PATCH v2 1/3] Bluetooth: Fix using NULL inquiry entry .

From: Ram Malovany <[email protected]>

If entry wasn't found in the hci_inquiry_cache_lookup_resolve do not
resolve the name.This will fix a kernel crash when trying to use NULL
pointer.

Signed-off-by: Ram Malovany <[email protected]>
---
net/bluetooth/hci_event.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 41ff978..2de521f 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1365,6 +1365,9 @@ static bool hci_resolve_next_name(struct hci_dev *hdev)
return false;

e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
+ if (!e)
+ return false;
+
if (hci_resolve_name(hdev, e) == 0) {
e->name_state = NAME_PENDING;
return true;
--
1.7.4.1

2012-07-23 07:38:59

by Malovany, Ram

Subject: RE: [PATCH v2 3/3] Bluetooth: Set name_state to unknown when entry name is empty

HI Gustavo,

> -----Original Message-----
> From: Gustavo Padovan [mailto:[email protected]]
> Sent: Thursday, July 19, 2012 5:28 PM
> To: Malovany, Ram; [email protected]
> Subject: Re: [PATCH v2 3/3] Bluetooth: Set name_state to unknown when entry
> name is empty
>
> * Gustavo Padovan <[email protected]> [2012-07-19 11:12:05 -0300]:
>
> > Hi Ram,
> >
> > * [email protected] <[email protected]> [2012-07-19 10:26:11 +0300]:
> >
> > > From: Ram Malovany <[email protected]>
> > >
> > > When the name of the given entry is empty , the state needs to be
> > > updated accordingly.
> > >
> > > Signed-off-by: Ram Malovany <[email protected]>
> > > ---
> > > net/bluetooth/hci_event.c | 2 ++
> > > 1 files changed, 2 insertions(+), 0 deletions(-)
> >
> > All 3 patches have been applied to bluetooth.git. But please keep in mind
> that
> > we put periods at the end of the summary lines, I fixed that for you this
>
> Sorry. We *don't* put periods at the end of summary lines.
>
> Gustavo

Thanks , I will update accordingly next time.

Regards,
Ram

2012-07-19 14:27:36

by Gustavo Padovan

Subject: Re: [PATCH v2 3/3] Bluetooth: Set name_state to unknown when entry name is empty

* Gustavo Padovan <[email protected]> [2012-07-19 11:12:05 -0300]:

> Hi Ram,
>
> * [email protected] <[email protected]> [2012-07-19 10:26:11 +0300]:
>
> > From: Ram Malovany <[email protected]>
> >
> > When the name of the given entry is empty , the state needs to be
> > updated accordingly.
> >
> > Signed-off-by: Ram Malovany <[email protected]>
> > ---
> > net/bluetooth/hci_event.c | 2 ++
> > 1 files changed, 2 insertions(+), 0 deletions(-)
>
> All 3 patches have been applied to bluetooth.git. But please keep in mind that
> we put periods at the end of the summary lines, I fixed that for you this

Sorry. We *don't* put periods at the end of summary lines.

Gustavo

2012-07-19 14:12:05

by Gustavo Padovan

Subject: Re: [PATCH v2 3/3] Bluetooth: Set name_state to unknown when entry name is empty

Hi Ram,

* [email protected] <[email protected]> [2012-07-19 10:26:11 +0300]:

> From: Ram Malovany <[email protected]>
>
> When the name of the given entry is empty , the state needs to be
> updated accordingly.
>
> Signed-off-by: Ram Malovany <[email protected]>
> ---
> net/bluetooth/hci_event.c | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)

All 3 patches have been applied to bluetooth.git. But please keep in mind that
we put periods at the end of the summary lines, I fixed that for you this
time.

Gustavo

2012-07-19 07:26:11

by Malovany, Ram

Subject: [PATCH v2 3/3] Bluetooth: Set name_state to unknown when entry name is empty

From: Ram Malovany <[email protected]>

When the name of the given entry is empty , the state needs to be
updated accordingly.

Signed-off-by: Ram Malovany <[email protected]>
---
net/bluetooth/hci_event.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 3224dcc..f799b46 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1408,6 +1408,8 @@ static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
e->name_state = NAME_KNOWN;
mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
e->data.rssi, name, name_len);
+ } else {
+ e->name_state = NAME_NOT_KNOWN;
}

if (hci_resolve_next_name(hdev))
--
1.7.4.1

2012-07-19 07:26:10

by Malovany, Ram

Subject: [PATCH v2 2/3] Bluetooth: Fix using a NULL inquiry cache entry.

From: Ram Malovany <[email protected]>

If the device was not found in a list of found devices names of which
are pending.This may happen in a case when HCI Remote Name Request
was sent as a part of incoming connection establishment procedure.
Hence there is no need to continue resolving a next name as it will
be done upon receiving another Remote Name Request Complete Event.
This will fix a kernel crash when trying to use this entry to resolve
the next name.

Signed-off-by: Ram Malovany <[email protected]>
---
net/bluetooth/hci_event.c | 16 +++++++++++-----
1 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 2de521f..3224dcc 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1396,12 +1396,18 @@ static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
return;

e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
- if (e) {
+ /* If the device was not found in a list of found devices names of which
+ * are pending. there is no need to continue resolving a next name as it
+ * will be done upon receiving another Remote Name Request Complete
+ * Event */
+ if (!e)
+ return;
+
+ list_del(&e->list);
+ if (name) {
e->name_state = NAME_KNOWN;
- list_del(&e->list);
- if (name)
- mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
- e->data.rssi, name, name_len);
+ mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
+ e->data.rssi, name, name_len);
}

if (hci_resolve_next_name(hdev))
--
1.7.4.1