Bluetooth: Ensure full A2MP msg is pulled from skb
Ensure the full A2MP Get Info Response message is pulled from the
skb when the status is not SUCCESS. Also fix similiar scenario in
Get AMP Assoc and remove unneeded check for mismatched id's.
Change-Id: Ia676d89238113e24f06aaa5d9e955afcc4de0307
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
index 4918caa..0a3b91d 100644
--- a/net/bluetooth/amp.c
+++ b/net/bluetooth/amp.c
@@ -1158,6 +1158,7 @@
if (skb->len < sizeof(*grsp))
goto cpl_finished;
grsp = (struct a2mp_getinfo_rsp *) skb_pull(skb, sizeof(*hdr));
+ skb_pull(skb, sizeof(*grsp));
if (grsp->status)
goto cpl_finished;
if (grsp->id != ctx->d.cpl.remote_id)
@@ -1171,7 +1172,6 @@
ctrl->min_latency = le32_to_cpu(grsp->min_latency);
ctrl->pal_cap = le16_to_cpu(grsp->pal_cap);
ctrl->max_assoc_size = le16_to_cpu(grsp->assoc_size);
- skb_pull(skb, sizeof(*grsp));
ctx->d.cpl.max_len = ctrl->max_assoc_size;
@@ -1191,8 +1191,6 @@
goto cpl_finished;
hdr = (void *) skb->data;
arsp = (void *) skb_pull(skb, sizeof(*hdr));
- if (arsp->id != ctx->d.cpl.remote_id)
- goto cpl_finished;
if (arsp->status != 0)
goto cpl_finished;
@@ -1200,12 +1198,12 @@
assoc = (u8 *) skb_pull(skb, sizeof(*arsp));
ctx->d.cpl.len_so_far = 0;
ctx->d.cpl.rem_len = hdr->len - sizeof(*arsp);
+ skb_pull(skb, ctx->d.cpl.rem_len);
rassoc = kmalloc(ctx->d.cpl.rem_len, GFP_ATOMIC);
if (!rassoc)
goto cpl_finished;
memcpy(rassoc, assoc, ctx->d.cpl.rem_len);
ctx->d.cpl.remote_assoc = rassoc;
- skb_pull(skb, ctx->d.cpl.rem_len);
/* set up CPL command */
ctx->d.cpl.phy_handle = physlink_handle(ctx->hdev);