Skip to contentSkip to conversation

Bluetooth: change min_t() cast in hci_reassembly()

PATCH Applied Dan Carpenter 3 participants 3 messages Feb 28, 2012 – Mar 1, 2012

Subsystems (3)
Bluetooth drivers Kernel janitors Bluetooth
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 Bluetooth: change min_t() cast in hci_reassembly()

"count" is type int so the cast to __u16 truncates the high bits away and triggers a Smatch static checker warning. It looks like a high value of count could cause a forever loop, but I didn't follow it through to see if count is capped somewhere.

Signed-off-by Dan Carpenter <[email protected]>
net/bluetooth/hci_core.c +1 -1
index e6cbb8a..db484a8 100644
@@ -1966,7 +1966,7 @@ static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
 
 	while (count) {
 		scb = (void *) skb->cb;
-		len = min_t(__u16, scb->expect, count);
+		len = min_t(uint, scb->expect, count);
 
 		memcpy(skb_put(skb, len), data, len);
maintainer Acked-by on v1 1/1
#1 lore raw

Hi Dan,

Quoted 12 lines

"count" is type int so the cast to __u16 truncates the high bits away and triggers a Smatch static checker warning. It looks like a high value of count could cause a forever loop, but I didn't follow it through to see if count is capped somewhere.

Signed-off-by Dan Carpenter <[email protected]>
net/bluetooth/hci_core.c +0 -0
index e6cbb8a..db484a8 100644

net/bluetooth/hci_core.c static int hci_reassembly(struct hci_dev *hdev, int type, void *data, · line 1969

Quoted 4 lines
net/bluetooth/hci_core.c +0 -1
@@ -1966,7 +1966,7 @@ static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
 
 	while (count) {
 		scb = (void *) skb->cb;
-		len = min_t(__u16, scb->expect, count);

this is a good idea since essentially packets are max u16.

Acked-by Marcel Holtmann <[email protected]>

Regards

Marcel

Applied
#2 lore raw
In reply to Dan Carpenter

Hi Dan,

Quoted 12 lines · Dan Carpenter

"count" is type int so the cast to __u16 truncates the high bits away and triggers a Smatch static checker warning. It looks like a high value of count could cause a forever loop, but I didn't follow it through to see if count is capped somewhere.

Signed-off-by Dan Carpenter <[email protected]>
net/bluetooth/hci_core.c +0 -0
index e6cbb8a..db484a8 100644

net/bluetooth/hci_core.c static int hci_reassembly(struct hci_dev *hdev, int type, void *data, · line 1971

Quoted 7 lines
net/bluetooth/hci_core.c +1 -1
@@ -1966,7 +1966,7 @@ static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
 
 	while (count) {
 		scb = (void *) skb->cb;
-		len = min_t(__u16, scb->expect, count);
+		len = min_t(uint, scb->expect, count);
 
 		memcpy(skb_put(skb, len), data, len);

Applied to my bluetooth-next tree. Thanks.

Johan