diff options
| author | Maarten Lankhorst <dev@lankhorst.se> | 2025-07-08 16:49:07 +0200 |
|---|---|---|
| committer | Maarten Lankhorst <dev@lankhorst.se> | 2025-07-08 16:49:07 +0200 |
| commit | e21354aea4b4420b53c44e36828607a7c94a994c (patch) | |
| tree | 003636d3a15eaebe9b948f9f8db6ad9e52a7e12c /net/bluetooth/eir.c | |
| parent | drm/tegra: Use dma_buf from GEM object instance (diff) | |
| parent | Merge tag 'drm-msm-next-2025-07-05' of https://gitlab.freedesktop.org/drm/msm... (diff) | |
| download | linux-e21354aea4b4420b53c44e36828607a7c94a994c.tar.gz linux-e21354aea4b4420b53c44e36828607a7c94a994c.zip | |
Merge remote-tracking branch 'drm/drm-next' into drm-misc-next
Pull in drm-intel-next for the updates to drm panic handling.
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Diffstat (limited to 'net/bluetooth/eir.c')
| -rw-r--r-- | net/bluetooth/eir.c | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/net/bluetooth/eir.c b/net/bluetooth/eir.c index 1bc51e2b05a3..3f72111ba651 100644 --- a/net/bluetooth/eir.c +++ b/net/bluetooth/eir.c @@ -242,7 +242,7 @@ u8 eir_create_per_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) return ad_len; } -u8 eir_create_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) +u8 eir_create_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr, u8 size) { struct adv_info *adv = NULL; u8 ad_len = 0, flags = 0; @@ -286,7 +286,7 @@ u8 eir_create_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) /* If flags would still be empty, then there is no need to * include the "Flags" AD field". */ - if (flags) { + if (flags && (ad_len + eir_precalc_len(1) <= size)) { ptr[0] = 0x02; ptr[1] = EIR_FLAGS; ptr[2] = flags; @@ -316,7 +316,8 @@ skip_flags: } /* Provide Tx Power only if we can provide a valid value for it */ - if (adv_tx_power != HCI_TX_POWER_INVALID) { + if (adv_tx_power != HCI_TX_POWER_INVALID && + (ad_len + eir_precalc_len(1) <= size)) { ptr[0] = 0x02; ptr[1] = EIR_TX_POWER; ptr[2] = (u8)adv_tx_power; @@ -366,17 +367,19 @@ u8 eir_create_scan_rsp(struct hci_dev *hdev, u8 instance, u8 *ptr) void *eir_get_service_data(u8 *eir, size_t eir_len, u16 uuid, size_t *len) { - while ((eir = eir_get_data(eir, eir_len, EIR_SERVICE_DATA, len))) { + size_t dlen; + + while ((eir = eir_get_data(eir, eir_len, EIR_SERVICE_DATA, &dlen))) { u16 value = get_unaligned_le16(eir); if (uuid == value) { if (len) - *len -= 2; + *len = dlen - 2; return &eir[2]; } - eir += *len; - eir_len -= *len; + eir += dlen; + eir_len -= dlen; } return NULL; |