1 files changed, 43 insertions, 35 deletions

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 5e18d5a451f4..497928d2b257 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -435,11 +435,51 @@ static u32 get_current_settings(struct hci_dev *hdev)
 
 #define PNP_INFO_SVCLASS_ID             0x1200
 
+static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
+{
+        u8 *ptr = data, *uuids_start = NULL;
+        struct bt_uuid *uuid;
+
+        if (len < 4)
+                return ptr;
+
+        list_for_each_entry(uuid, &hdev->uuids, list) {
+                u16 uuid16;
+
+                if (uuid->size != 16)
+                        continue;
+
+                uuid16 = get_unaligned_le16(&uuid->uuid[12]);
+                if (uuid16 < 0x1100)
+                        continue;
+
+                if (uuid16 == PNP_INFO_SVCLASS_ID)
+                        continue;
+
+                if (!uuids_start) {
+                        uuids_start = ptr;
+                        uuids_start[0] = 1;
+                        uuids_start[1] = EIR_UUID16_ALL;
+                        ptr += 2;
+                }
+
+                /* Stop if not enough space to put next UUID */
+                if ((ptr - data) + sizeof(u16) > len) {
+                        uuids_start[1] = EIR_UUID16_SOME;
+                        break;
+                }
+
+                *ptr++ = (uuid16 & 0x00ff);
+                *ptr++ = (uuid16 & 0xff00) >> 8;
+                uuids_start[0] += sizeof(uuid16);
+        }
+
+        return ptr;
+}
+
 static void create_eir(struct hci_dev *hdev, u8 *data)
 {
         u8 *ptr = data;
-        u8 *uuids_start;
-        struct bt_uuid *uuid;
         size_t name_len;
 
         name_len = strlen(hdev->dev_name);
@@ -480,39 +520,7 @@ static void create_eir(struct hci_dev *hdev, u8 *data)
                 ptr += 10;
         }
 
-        uuids_start = NULL;
-
-        /* Group all UUID16 types */
-        list_for_each_entry(uuid, &hdev->uuids, list) {
-                u16 uuid16;
-
-                if (uuid->size != 16)
-                        continue;
-
-                uuid16 = get_unaligned_le16(&uuid->uuid[12]);
-                if (uuid16 < 0x1100)
-                        continue;
-
-                if (uuid16 == PNP_INFO_SVCLASS_ID)
-                        continue;
-
-                if (!uuids_start) {
-                        uuids_start = ptr;
-                        uuids_start[0] = 1;
-                        uuids_start[1] = EIR_UUID16_ALL;
-                        ptr += 2;
-                }
-
-                /* Stop if not enough space to put next UUID */
-                if ((ptr - data) + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
-                        uuids_start[1] = EIR_UUID16_SOME;
-                        break;
-                }
-
-                *ptr++ = (uuid16 & 0x00ff);
-                *ptr++ = (uuid16 & 0xff00) >> 8;
-                uuids_start[0] += sizeof(uuid16);
-        }
+        ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 }
 
 static int update_eir(struct hci_dev *hdev)