Received-SPF: pass (google.com: best guess record for domain of linux-bluetooth-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Inga Stotland <inga.stotland@intel.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     brian.gix@intel.com, Inga Stotland <inga.stotland@intel.com>
Subject: [PATCH BlueZ] mesh: Fix unpacking NetKey/AppKey 3-octet index combo
Date:   Wed, 16 Oct 2019 20:06:07 -0700
Message-Id: <20191017030607.11112-1-inga.stotland@intel.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

This fixes how we unpack 3-octet combination of NetKey and AppKey
indices received in the payload of AppKeyAdd/Update/Delete messages.

For example, if the config client sends a message to add AppKey with
index 0x456 bound to NetKey with index 0x123, the received packed
3-octet will be: 0x56 0x34 0x12
The fix takes into account the correct byte ordering when unpacking
indices.
---
 mesh/cfgmod-server.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/mesh/cfgmod-server.c b/mesh/cfgmod-server.c
index 55cc8e9eb..79538037c 100644
--- a/mesh/cfgmod-server.c
+++ b/mesh/cfgmod-server.c
@@ -1022,8 +1022,8 @@ static bool cfg_srv_pkt(uint16_t src, uint32_t dst, uint16_t unicast,
 		if (size != 19)
 			return true;
 
-		n_idx = l_get_le16(pkt) & 0xfff;
-		a_idx = l_get_le16(pkt + 1) >> 4;
+		n_idx = l_get_le16(pkt + 1) >> 4;
+		a_idx = l_get_le16(pkt) & 0xfff;
 
 		if (opcode == OP_APPKEY_ADD)
 			b_res = appkey_key_add(net, n_idx, a_idx, pkt + 3);
@@ -1048,9 +1048,10 @@ static bool cfg_srv_pkt(uint16_t src, uint32_t dst, uint16_t unicast,
 		if (size != 3)
 			return true;
 
-		n_idx = l_get_le16(pkt) & 0xfff;
-		a_idx = l_get_le16(pkt + 1) >> 4;
+		n_idx = l_get_le16(pkt + 1) >> 4;
+		a_idx = l_get_le16(pkt) & 0xfff;
 		b_res = appkey_key_delete(net, n_idx, a_idx);
+
 		l_debug("Delete AppKey %s Net_Idx %3.3x to App_Idx %3.3x",
 			(b_res == MESH_STATUS_SUCCESS) ? "success" : "fail",
 							n_idx, a_idx);
-- 
2.21.0