Page MenuHomeFreeBSD

Fix iterating over BT LE responses
ClosedPublic

Authored by kibab on Nov 1 2019, 9:45 PM.
Tags
None
Referenced Files
Unknown Object (File)
Dec 20 2023, 1:47 AM
Unknown Object (File)
Nov 2 2023, 9:54 PM
Unknown Object (File)
Apr 7 2023, 10:33 PM
Unknown Object (File)
Mar 4 2023, 10:42 AM
Unknown Object (File)
Feb 17 2023, 9:43 PM
Unknown Object (File)
Feb 7 2023, 8:57 PM
Unknown Object (File)
Jan 4 2023, 4:31 PM

Details

Reviewers
imp
takawata
Summary

ep->num_responses is a member in a packed structure, and arithmetic manipulations on it don't work well at least on aarch64.
So if ep->num_responses == 1, ep->num_responses -1 will be 251 :-( and this breaks all iterator code that follows.

Test Plan

Apply patch, then run:

  1. hccontrol le_enable enable
  2. hccontrol le_set_scan_enable enable

Without the patch the second command results in kernel panic (on Pine64 which is 64-bit ARM). With the patch it completes OK and I can later use "hccontrol read_neighbor_cache" to see the list of LE devices.

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 27314

Event Timeline

sys/netgraph/bluetooth/hci/ng_hci_evnt.c
395–396

This original loop modifies the record field "num_reports" directly inside the netgraph data.
After this modification, only a temporary variable is modified, but the result is not stored back.
So the modification is not semantically equivalent.

Please explain, why this change in functionality is allowed in this context.

400

The error message is very generic and not helpful for the end user.
It looks more like a programming issue (i.e. erroneous code path)
Is it possible to log something more specific about the reason for the error?
Something like "low on memory" or "packet too short" (or whatever is more likely).

This change is already done in CURRENT.

This revision is now accepted and ready to land.Apr 8 2020, 10:16 AM