commit 405b5c900b3ccb41feca80119dbb979b5255a503
author Sharvil Nanavati <sharvil@google.com> Fri Jun 17 14:15:46 2016 -0700
committer Dirk Vogt <dirk@fairphone.com> Wed Jul 27 17:19:55 2016 +0200
tree 9d875382db4fb2529d730bac255fa9d82586c2c7
parent 9487a25f29c046371725541fde903fa8a19808ad

FPII-2183: DO NOT MERGE Fix potential DoS caused by delivering signal to BT process

DO NOT MERGE Fix potential DoS caused by delivering signal to BT process

Bug: 28885210
Change-Id: I42fe6830d2f03ea12c4016a11c2eb5cea2903020

hci/src/userial_mct.c

diff --git a/hci/src/userial_mct.c b/hci/src/userial_mct.c
index 2a56ae9..6e15233 100644
--- a/hci/src/userial_mct.c
+++ b/hci/src/userial_mct.c
@@ -126,12 +126,12 @@
 }
 static inline int send_wakeup_signal(char sig_cmd)
 {
-    return send(signal_fds[1], &sig_cmd, sizeof(sig_cmd), 0);
+    return TEMP_FAILURE_RETRY(send(signal_fds[1], &sig_cmd, sizeof(sig_cmd), 0));
 }
 static inline char reset_signal()
 {
     char sig_recv = -1;
-    recv(signal_fds[0], &sig_recv, sizeof(sig_recv), MSG_WAITALL);
+    TEMP_FAILURE_RETRY(recv(signal_fds[0], &sig_recv, sizeof(sig_recv), MSG_WAITALL));
     return sig_recv;
 }
 static inline int is_signaled(fd_set* set)
@@ -176,7 +176,7 @@
 
         /* Do the select */
         n = 0;
-        n = select(fd_max+1, &input, NULL, NULL, NULL);
+        n = TEMP_FAILURE_RETRY(select(fd_max+1, &input, NULL, NULL, NULL));
         if(is_signaled(&input))
         {
             reason = reset_signal();
@@ -366,7 +366,7 @@
     int ret = -1;
     int ch_idx = (msg_id == MSG_HC_TO_STACK_HCI_EVT) ? CH_EVT : CH_ACL_IN;
 
-    ret = read(userial_cb.fd[ch_idx], p_buffer, (size_t)len);
+    ret = TEMP_FAILURE_RETRY(read(userial_cb.fd[ch_idx], p_buffer, (size_t)len));
     if (ret <= 0)
         ALOGW( "userial_read: read() returned %d!", ret);
 
@@ -390,7 +390,7 @@
 
     while(len != 0)
     {
-        ret = write(userial_cb.fd[ch_idx], p_data+total, len);
+        ret = TEMP_FAILURE_RETRY(write(userial_cb.fd[ch_idx], p_data+total, len));
         total += ret;
         len -= ret;
     }