Page MenuHomeFreeBSD
Files F163258395

D25690.id74531.diff
No OneTemporary
Actions

D25690.id74531.diff
View Options

Index: sys/netgraph/bluetooth/hci/ng_hci_main.c
===================================================================
--- sys/netgraph/bluetooth/hci/ng_hci_main.c
+++ sys/netgraph/bluetooth/hci/ng_hci_main.c
@@ -781,6 +781,43 @@
return (error);
} /* ng_hci_drv_rcvdata */
+static int
+ng_hci_validate_acl_data(ng_hci_unit_p unit, struct mbuf *m, u_int16_t *con_handle)
+{
+ int size;
+ NG_HCI_BUFF_ACL_SIZE(unit->buffer, size);
+
+ if (m->m_pkthdr.len < sizeof(ng_hci_acldata_pkt_t) ||
+ m->m_pkthdr.len > sizeof(ng_hci_acldata_pkt_t) + size) {
+ NG_HCI_ALERT(
+"%s: %s - invalid HCI ACL data packet, len=%d, mtu=%d\n",
+ __func__, NG_NODE_NAME(unit->node),
+ m->m_pkthdr.len, size);
+
+ return (EMSGSIZE);
+ }
+
+ NG_HCI_M_PULLUP(m, sizeof(ng_hci_acldata_pkt_t));
+ if (m == NULL) {
+ return (ENOBUFS);
+ }
+
+ *con_handle = NG_HCI_CON_HANDLE(le16toh(
+ mtod(m, ng_hci_acldata_pkt_t *)->con_handle));
+ size = le16toh(mtod(m, ng_hci_acldata_pkt_t *)->length);
+
+ if (m->m_pkthdr.len != sizeof(ng_hci_acldata_pkt_t) + size) {
+ NG_HCI_ALERT(
+"%s: %s - invalid HCI ACL data packet size, len=%d, length=%d\n",
+ __func__, NG_NODE_NAME(unit->node),
+ m->m_pkthdr.len, size);
+
+ return (EMSGSIZE);
+ }
+
+ return (0);
+} /* ng_hci_validate_acl_data */
+
/*
* Process data packet from ACL upstream hook.
* We expect valid HCI ACL data packets.
@@ -793,9 +830,8 @@
struct mbuf *m = NULL;
ng_hci_unit_con_p con = NULL;
u_int16_t con_handle;
- int size, error = 0;
+ int error = 0;
- NG_HCI_BUFF_ACL_SIZE(unit->buffer, size);
/* Check packet */
NGI_GET_M(item, m);
@@ -808,34 +844,9 @@
error = EINVAL;
goto drop;
}
- if (m->m_pkthdr.len < sizeof(ng_hci_acldata_pkt_t) ||
- m->m_pkthdr.len > sizeof(ng_hci_acldata_pkt_t) + size) {
- NG_HCI_ALERT(
-"%s: %s - invalid HCI ACL data packet, len=%d, mtu=%d\n",
- __func__, NG_NODE_NAME(unit->node),
- m->m_pkthdr.len, size);
- error = EMSGSIZE;
- goto drop;
- }
-
- NG_HCI_M_PULLUP(m, sizeof(ng_hci_acldata_pkt_t));
- if (m == NULL) {
- error = ENOBUFS;
- goto drop;
- }
-
- con_handle = NG_HCI_CON_HANDLE(le16toh(
- mtod(m, ng_hci_acldata_pkt_t *)->con_handle));
- size = le16toh(mtod(m, ng_hci_acldata_pkt_t *)->length);
-
- if (m->m_pkthdr.len != sizeof(ng_hci_acldata_pkt_t) + size) {
- NG_HCI_ALERT(
-"%s: %s - invalid HCI ACL data packet size, len=%d, length=%d\n",
- __func__, NG_NODE_NAME(unit->node),
- m->m_pkthdr.len, size);
-
- error = EMSGSIZE;
+ error = ng_hci_validate_acl_data(unit, m, &con_handle);
+ if (error != 0) {
goto drop;
}
@@ -903,6 +914,43 @@
* We expect valid HCI SCO data packets
*/
+static int
+ng_hci_validate_sco_data(ng_hci_unit_p unit, struct mbuf *m, u_int16_t *con_handle)
+{
+ int size;
+ NG_HCI_BUFF_SCO_SIZE(unit->buffer, size);
+
+ if (m->m_pkthdr.len < sizeof(ng_hci_scodata_pkt_t) ||
+ m->m_pkthdr.len > sizeof(ng_hci_scodata_pkt_t) + size) {
+ NG_HCI_ALERT(
+"%s: %s - invalid HCI SCO data packet, len=%d, mtu=%d\n",
+ __func__, NG_NODE_NAME(unit->node),
+ m->m_pkthdr.len, size);
+
+ return (EMSGSIZE);
+ }
+
+ NG_HCI_M_PULLUP(m, sizeof(ng_hci_scodata_pkt_t));
+ if (m == NULL) {
+ return (ENOBUFS);
+ }
+
+ *con_handle = NG_HCI_CON_HANDLE(le16toh(
+ mtod(m, ng_hci_scodata_pkt_t *)->con_handle));
+ size = mtod(m, ng_hci_scodata_pkt_t *)->length;
+
+ if (m->m_pkthdr.len != sizeof(ng_hci_scodata_pkt_t) + size) {
+ NG_HCI_ALERT(
+"%s: %s - invalid HCI SCO data packet size, len=%d, length=%d\n",
+ __func__, NG_NODE_NAME(unit->node),
+ m->m_pkthdr.len, size);
+
+ return (EMSGSIZE);
+ }
+
+ return (0);
+} /* ng_hci_validate_sco_data */
+
static int
ng_hci_sco_rcvdata(hook_p hook, item_p item)
{
@@ -910,9 +958,7 @@
struct mbuf *m = NULL;
ng_hci_unit_con_p con = NULL;
u_int16_t con_handle;
- int size, error = 0;
-
- NG_HCI_BUFF_SCO_SIZE(unit->buffer, size);
+ int error = 0;
/* Check packet */
NGI_GET_M(item, m);
@@ -927,34 +973,8 @@
goto drop;
}
- if (m->m_pkthdr.len < sizeof(ng_hci_scodata_pkt_t) ||
- m->m_pkthdr.len > sizeof(ng_hci_scodata_pkt_t) + size) {
- NG_HCI_ALERT(
-"%s: %s - invalid HCI SCO data packet, len=%d, mtu=%d\n",
- __func__, NG_NODE_NAME(unit->node),
- m->m_pkthdr.len, size);
-
- error = EMSGSIZE;
- goto drop;
- }
-
- NG_HCI_M_PULLUP(m, sizeof(ng_hci_scodata_pkt_t));
- if (m == NULL) {
- error = ENOBUFS;
- goto drop;
- }
-
- con_handle = NG_HCI_CON_HANDLE(le16toh(
- mtod(m, ng_hci_scodata_pkt_t *)->con_handle));
- size = mtod(m, ng_hci_scodata_pkt_t *)->length;
-
- if (m->m_pkthdr.len != sizeof(ng_hci_scodata_pkt_t) + size) {
- NG_HCI_ALERT(
-"%s: %s - invalid HCI SCO data packet size, len=%d, length=%d\n",
- __func__, NG_NODE_NAME(unit->node),
- m->m_pkthdr.len, size);
-
- error = EMSGSIZE;
+ error = ng_hci_validate_sco_data(unit, m, &con_handle);
+ if (error != 0) {
goto drop;
}
@@ -1017,6 +1037,43 @@
return (error);
} /* ng_hci_sco_rcvdata */
+static int
+ng_hci_validate_command(ng_hci_unit_p unit, struct mbuf *m)
+{
+ if (m->m_pkthdr.len < sizeof(ng_hci_cmd_pkt_t)) {
+ NG_HCI_ALERT(
+"%s: %s - invalid HCI command packet len=%d\n",
+ __func__, NG_NODE_NAME(unit->node), m->m_pkthdr.len);
+
+ return (EMSGSIZE);
+ }
+
+ NG_HCI_M_PULLUP(m, sizeof(ng_hci_cmd_pkt_t));
+ if (m == NULL) {
+ return (ENOBUFS);
+ }
+
+ if (m->m_pkthdr.len !=
+ mtod(m, ng_hci_cmd_pkt_t *)->length + sizeof(ng_hci_cmd_pkt_t)) {
+ NG_HCI_ALERT(
+"%s: %s - invalid HCI command packet size, len=%d, length=%d\n",
+ __func__, NG_NODE_NAME(unit->node), m->m_pkthdr.len,
+ mtod(m, ng_hci_cmd_pkt_t *)->length);
+
+ return (EMSGSIZE);
+ }
+
+ if (mtod(m, ng_hci_cmd_pkt_t *)->opcode == 0) {
+ NG_HCI_ALERT(
+"%s: %s - invalid HCI command opcode\n",
+ __func__, NG_NODE_NAME(unit->node));
+
+ return (EINVAL);
+ }
+
+ return (0);
+} /* ng_hci_validate_command */
+
/*
* Process data packet from uptream RAW hook.
* We expect valid HCI command packets.
@@ -1028,59 +1085,40 @@
ng_hci_unit_p unit = (ng_hci_unit_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
struct mbuf *m = NULL;
int error = 0;
+ u_int16_t con_handle;
NGI_GET_M(item, m);
NG_FREE_ITEM(item);
+
/* Check packet */
- if (*mtod(m, u_int8_t *) != NG_HCI_CMD_PKT) {
+ switch (*mtod(m, u_int8_t *)) {
+ case NG_HCI_CMD_PKT:
+ error = ng_hci_validate_command(unit, m);
+ break;
+ case NG_HCI_ACL_DATA_PKT:
+ error = ng_hci_validate_acl_data(unit, m, &con_handle);
+ break;
+ case NG_HCI_SCO_DATA_PKT:
+ error = ng_hci_validate_sco_data(unit, m, &con_handle);
+ break;
+ default:
NG_HCI_ALERT(
-"%s: %s - invalid HCI command packet type=%#x\n",
+"%s: %s - got unexpected HCI packet type=%#x\n",
__func__, NG_NODE_NAME(unit->node),
*mtod(m, u_int8_t *));
error = EINVAL;
- goto drop;
+ break;
}
- if (m->m_pkthdr.len < sizeof(ng_hci_cmd_pkt_t)) {
- NG_HCI_ALERT(
-"%s: %s - invalid HCI command packet len=%d\n",
- __func__, NG_NODE_NAME(unit->node), m->m_pkthdr.len);
-
- error = EMSGSIZE;
- goto drop;
- }
-
- NG_HCI_M_PULLUP(m, sizeof(ng_hci_cmd_pkt_t));
- if (m == NULL) {
- error = ENOBUFS;
- goto drop;
- }
-
- if (m->m_pkthdr.len !=
- mtod(m, ng_hci_cmd_pkt_t *)->length + sizeof(ng_hci_cmd_pkt_t)) {
- NG_HCI_ALERT(
-"%s: %s - invalid HCI command packet size, len=%d, length=%d\n",
- __func__, NG_NODE_NAME(unit->node), m->m_pkthdr.len,
- mtod(m, ng_hci_cmd_pkt_t *)->length);
-
- error = EMSGSIZE;
- goto drop;
- }
-
- if (mtod(m, ng_hci_cmd_pkt_t *)->opcode == 0) {
- NG_HCI_ALERT(
-"%s: %s - invalid HCI command opcode\n",
- __func__, NG_NODE_NAME(unit->node));
-
- error = EINVAL;
+ if (error != 0) {
goto drop;
}
if (NG_BT_MBUFQ_FULL(&unit->cmdq)) {
NG_HCI_ALERT(
-"%s: %s - dropping HCI command packet, len=%d, queue_len=%d\n",
+"%s: %s - dropping HCI packet, len=%d, queue_len=%d\n",
__func__, NG_NODE_NAME(unit->node), m->m_pkthdr.len,
NG_BT_MBUFQ_LEN(&unit->cmdq));
Index: sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c
===================================================================
--- sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c
+++ sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c
@@ -698,8 +698,7 @@
case NG_HCI_ACL_DATA_PKT:
case NG_HCI_SCO_DATA_PKT:
if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED) ||
- !bit_test(pcb->filter.packet_mask, type - 1) ||
- !d)
+ (!bit_test(pcb->filter.packet_mask, type - 1) && !d))
return (EPERM);
break;
@@ -1580,6 +1579,7 @@
ng_btsocket_hci_raw_pcb_p pcb = so2hci_raw_pcb(so);
struct mbuf *nam = NULL;
int error = 0;
+ u_int8_t pkt_typ = 0xff;
if (ng_btsocket_hci_raw_node == NULL) {
error = ENETDOWN;
@@ -1606,7 +1606,10 @@
goto drop;
}
}
- if (*mtod(m, u_int8_t *) != NG_HCI_CMD_PKT) {
+ pkt_typ = *mtod(m, u_int8_t *);
+ if (pkt_typ != NG_HCI_CMD_PKT &&
+ pkt_typ != NG_HCI_ACL_DATA_PKT &&
+ pkt_typ != NG_HCI_SCO_DATA_PKT) {
error = ENOTSUP;
goto drop;
}

File Metadata

Mime Type
text/plain
Expires
Wed, Jul 22, 12:26 PM (6 h, 37 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35364061
Default Alt Text
D25690.id74531.diff (8 KB)

Event Timeline