Bluetooth: Fix the creation of hdev->name
authorItay Iellin <ieitayie@gmail.com>
Sat, 7 May 2022 12:32:48 +0000 (08:32 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 15 May 2022 18:18:52 +0000 (20:18 +0200)
commitb063e8cbec3cfc44d292cc1e684cba9a17c3afab
tree86cbfe9617de350caa593a9c0e5b43aa851a5803
parent01986c7dbf9d62aa182169659d9c24575a2b82e9
Bluetooth: Fix the creation of hdev->name

commit 103a2f3255a95991252f8f13375c3a96a75011cd upstream.

Set a size limit of 8 bytes of the written buffer to "hdev->name"
including the terminating null byte, as the size of "hdev->name" is 8
bytes. If an id value which is greater than 9999 is allocated,
then the "snprintf(hdev->name, sizeof(hdev->name), "hci%d", id)"
function call would lead to a truncation of the id value in decimal
notation.

Set an explicit maximum id parameter in the id allocation function call.
The id allocation function defines the maximum allocated id value as the
maximum id parameter value minus one. Therefore, HCI_MAX_ID is defined
as 10000.

Signed-off-by: Itay Iellin <ieitayie@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/net/bluetooth/hci_core.h
net/bluetooth/hci_core.c