Bluetooth: Fix having bogus entries in mgmt_read_index_list reply (476e44cb) · Commits · 戴 / test

The mgmt_read_index_list uses one loop to calculate the max needed size of its response with the help of an upper-bound of the controller count. The second loop is more strict as it checks for HCI_SETUP (which might have gotten set after the first loop) and could result in some indexes being skipped. Because of this the function needs to readjust the event length and index count after filling in the response array. Signed-off-by:

Johan Hedberg <johan.hedberg@intel.com> Cc: stable@vger.kernel.org Acked-by:

Marcel Holtmann <marcel@holtmann.org> Signed-off-by:

Gustavo Padovan <gustavo.padovan@collabora.co.uk>

net/bluetooth/mgmt.c

+6 −5

Original line number	Diff line number	Diff line
		@@ -326,7 +326,7 @@ static int read_index_list(struct sock sk, struct hci_dev hdev, void *data,
		struct hci_dev *d;
		size_t rp_len;
		u16 count;
		int i, err;
		int err;

		BT_DBG("sock %p", sk);

		@@ -347,9 +347,7 @@ static int read_index_list(struct sock sk, struct hci_dev hdev, void *data,
		return -ENOMEM;
		}

		rp->num_controllers = cpu_to_le16(count);

		i = 0;
		count = 0;
		list_for_each_entry(d, &hci_dev_list, list) {
		if (test_bit(HCI_SETUP, &d->dev_flags))
		continue;
		@@ -357,10 +355,13 @@ static int read_index_list(struct sock sk, struct hci_dev hdev, void *data,
		if (!mgmt_valid_hdev(d))
		continue;

		rp->index[i++] = cpu_to_le16(d->id);
		rp->index[count++] = cpu_to_le16(d->id);
		BT_DBG("Added hci%u", d->id);
		}

		rp->num_controllers = cpu_to_le16(count);
		rp_len = sizeof(rp) + (2 count);

		read_unlock(&hci_dev_list_lock);

		err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,

Admin message