Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   =?UTF-8?q?Micha=C5=82=20Lowas-Rzechonek?= 
        <michal.lowas-rzechonek@silvair.com>
To:     linux-bluetooth@vger.kernel.org
Subject: [PATCH BlueZ] mesh: Fix application key binding lookup
Date:   Tue, 11 Aug 2020 15:39:07 +0200
Message-Id: <20200811133907.8249-1-michal.lowas-rzechonek@silvair.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Because l_queue_find can't distinguish between entry->data equal to zero
and missing entry, has_binding() fails when we bind app key with index
0, via L_UINT_TO_PTR.

Bug has been introduced in commit 1a2a6debd
---
 mesh/model.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/mesh/model.c b/mesh/model.c
index 4eaad31be..7d7f1551a 100644
--- a/mesh/model.c
+++ b/mesh/model.c
@@ -140,7 +140,15 @@ static bool simple_match(const void *a, const void *b)
 
 static bool has_binding(struct l_queue *bindings, uint16_t idx)
 {
-	return l_queue_find(bindings, simple_match, L_UINT_TO_PTR(idx)) != NULL;
+	/* don't use l_queue_find, it can't distinguish between missing entry
+	 * and entry with data equal to NULL */
+	const struct l_queue_entry *entry;
+
+	for (entry = l_queue_get_entries(bindings); entry; entry = entry->next)
+		if (L_PTR_TO_INT(entry->data) == idx)
+			return true;
+
+	return false;
 }
 
 static bool find_virt_by_label(const void *a, const void *b)
-- 
2.20.1