1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2 From: Kiran K <kiran.k@intel.com>
3 Date: Wed, 13 Oct 2021 13:35:11 +0530
4 Subject: [PATCH] Bluetooth: btintel: Fix bdaddress comparison with garbage
7 Intel Read Verision(TLV) data is parsed into a local structure variable
8 and it contains a field for bd address. Bd address is returned only in
9 bootloader mode and hence bd address in TLV structure needs to be validated
10 only if controller is present in boot loader mode.
12 Signed-off-by: Kiran K <kiran.k@intel.com>
13 Reviewed-by: Tedd Ho-Jeong An <tedd.an@intel.com>
15 drivers/bluetooth/btintel.c | 22 ++++++++++++++--------
16 1 file changed, 14 insertions(+), 8 deletions(-)
18 diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
19 index d122cc973917..a828fcd05d83 100644
20 --- a/drivers/bluetooth/btintel.c
21 +++ b/drivers/bluetooth/btintel.c
22 @@ -2006,14 +2006,16 @@ static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
23 if (ver->img_type == 0x03) {
24 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
25 btintel_check_bdaddr(hdev);
28 - /* If the OTP has no valid Bluetooth device address, then there will
29 - * also be no valid address for the operational firmware.
31 - if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
32 - bt_dev_info(hdev, "No device address configured");
33 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
36 + * Check for valid bd address in boot loader mode. Device
37 + * will be marked as unconfigured if empty bd address is
40 + if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
41 + bt_dev_info(hdev, "No device address configured");
42 + set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
46 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
47 @@ -2309,6 +2311,10 @@ static int btintel_setup_combined(struct hci_dev *hdev)
51 + /* memset ver_tlv to start with clean state as few fields are exclusive
52 + * to bootloader mode and are not populated in operational mode
54 + memset(&ver_tlv, 0, sizeof(ver_tlv));
55 /* For TLV type device, parse the tlv data */
56 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);