[PATCH] Bluetooth: btnxpuart: Keep FW dump header in coredump chunks

[Neeraj Kale]

Hi Ali,

Thank you for the quick fix.

Reviewed-by: Neeraj Kale neeraj.sanjaykale@xxxxxxx

Thanks,
Neeraj


>
> Commit 1fcf216462ec ("Bluetooth: btnxpuart: Validate the FW dump header
> length") changed nxp_process_fw_dump() to use skb_pull_data() when
> validating the FW dump header.
>
> This also removes the header from skb->data. Since the skb is cloned for
> hci_devcd_append() afterwards, the FW dump header is missing from the
> coredump chunk.
>
> The NXP FW dump analyzer expects nxp_fw_dump_hdr at the beginning of
> each chunk, so this results in invalid coredumps.
>
> Check the header length without pulling it from the skb instead. This keeps
> skb->data pointing to the FW dump header when the skb is cloned.
>
> Fixes: 1fcf216462ec ("Bluetooth: btnxpuart: Validate the FW dump header
> length")
> Reported-by: Neeraj Kale <neeraj.sanjaykale@xxxxxxx>
> Link:
> https://lore.ke/
> rnel.org%2Flinux-
> bluetooth%2FAS4PR04MB9692EC13E3176B6D7525D097E7A72%40AS4PR04M
> B9692.eurprd04.prod.outlook.com%2F&data=05%7C02%7Cneeraj.sanjaykale
> %40nxp.com%7Ce5c09f2752bc463e224608defcfee41a%7C686ea1d3bc2b4c6f
> a92cd99c5c301635%7C0%7C0%7C639226368879983123%7CUnknown%7CTW
> FpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW
> 4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=mEFZvI
> Xr7Buf8x4p9NDDl3B1mJJR93pBKXZuARuRmX0%3D&reserved=0
> Signed-off-by: Ali Ahmet Memis <ali@xxxxxxxxxxxxxx>
> ---
> Sorry for the late follow-up. I missed your reply on the v2 thread and only
> noticed it after the change had landed. This patch restores the approach from
> v2, as you suggested.
>
>  drivers/bluetooth/btnxpuart.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> index f2bbe6e462aa..16d0f709d4b7 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -1359,14 +1359,14 @@ static int nxp_process_fw_dump(struct hci_dev
> *hdev, struct sk_buff *skb)  {
>         struct hci_acl_hdr *acl_hdr = (struct hci_acl_hdr *)skb_pull_data(skb,
>                                                                           sizeof(*acl_hdr));
> -       struct nxp_fw_dump_hdr *fw_dump_hdr;
> +       struct nxp_fw_dump_hdr *fw_dump_hdr = (struct nxp_fw_dump_hdr
> + *)skb->data;
>         struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
>         __u16 seq_num;
>         __u16 buf_len;
>         int err;
>
> -       fw_dump_hdr = skb_pull_data(skb, sizeof(*fw_dump_hdr));
> -       if (!fw_dump_hdr) {
> +       /* The ACL payload must be long enough to hold the FW dump header
> */
> +       if (skb->len < sizeof(*fw_dump_hdr)) {
>                 bt_dev_warn(hdev, "FW dump: invalid or corrupt fw dump chunk");
>                 goto free_skb;
>         }
> --
> 2.55.0


NXP Confidential