[PATCH] Bluetooth: btbcm: bound local name logging

[PATCH] Bluetooth: btbcm: bound local name logging

[Laxman Acharya Padhya]

The HCI Read Local Name response contains a fixed 248-byte name. A NUL
terminator is supplied only when the name is shorter than the maximum
length.

btbcm prints the returned name using %s, so a maximum-length controller
name lets the log formatting read past the HCI response buffer.

Use a precision of HCI_MAX_NAME_LENGTH when logging the name.

Fixes: 9bc63ca0904d ("Bluetooth: btbcm: Read the local name in setup stage")
Fixes: 2fcdd562b91b ("Bluetooth: btbcm: Make btbcm_initialize() print local-name on re-init too")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
---
 drivers/bluetooth/btbcm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
index 463d59890bef..499e12169ca3 100644
--- a/drivers/bluetooth/btbcm.c
+++ b/drivers/bluetooth/btbcm.c
@@ -479,7 +479,8 @@ static int btbcm_print_local_name(struct hci_dev *hdev)
 	if (IS_ERR(skb))
 		return PTR_ERR(skb);
 
-	bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
+	bt_dev_info(hdev, "%.*s", HCI_MAX_NAME_LENGTH,
+		    (char *)(skb->data + 1));
 	kfree_skb(skb);
 
 	return 0;
@@ -766,7 +767,8 @@ int btbcm_setup_apple(struct hci_dev *hdev)
 	/* Read Local Name */
 	skb = btbcm_read_local_name(hdev);
 	if (!IS_ERR(skb)) {
-		bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
+		bt_dev_info(hdev, "%.*s", HCI_MAX_NAME_LENGTH,
+			    (char *)(skb->data + 1));
 		kfree_skb(skb);
 	}
 
-- 
2.51.2

RE: Bluetooth: btbcm: bound local name logging

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1126651

---Test result---

Test Summary:
CheckPatch                    PASS      0.80 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       PASS      0.30 seconds
SubjectPrefix                 PASS      0.11 seconds
BuildKernel                   PASS      25.35 seconds
CheckAllWarning               PASS      27.88 seconds
CheckSparse                   PASS      26.61 seconds
BuildKernel32                 PASS      24.95 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      464.04 seconds
IncrementalBuild              PASS      23.34 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/431

---
Regards,
Linux Bluetooth