github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: hci_ldisc: reject invalid tty write lengths

Browse Source 
The HCI UART write worker assumes that a tty write callback returns a
value in the range from zero through the skb length. A negative value or
a value larger than the skb length is passed to accounting and skb_pull,
which can corrupt skb state.

Treat either return value as a transmit error and discard the skb.

Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Li Qiang 2026-07-16 16:47:31 +08:00 committed by Luiz Augusto von Dentz
parent ceea75ad89
commit 0fdb6ca821
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/bluetooth/hci_ldisc.c
View File

@ -163,6 +163,12 @@ static void hci_uart_write_work(struct work_struct *work)
set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
len = tty->ops->write(tty, skb->data, skb->len);
if (len < 0 || len > skb->len) {
hdev->stat.err_tx++;
kfree_skb(skb);
continue;
}
hdev->stat.byte_tx += len;
skb_pull(skb, len);