github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-27 08:33:17 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: btmtk: validate WMT event SKB length before struct access

Browse Source 
btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to
struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc
(9 bytes) without first checking that the SKB contains enough data.
A short firmware response causes out-of-bounds reads from SKB tailroom.

Use skb_pull_data() to validate and advance past the base WMT event
header. For the FUNC_CTRL case, pull the additional status field bytes
before accessing them.

Fixes: d019930b00 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Tristan Madani 2026-04-21 11:14:54 +00:00 committed by Luiz Augusto von Dentz
parent f958c7805b
commit 634a4408c0
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/bluetooth/btmtk.c
View File

@ -695,8 +695,13 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
if (data->evt_skb == NULL) if (data->evt_skb == NULL)
goto err_free_wc; goto err_free_wc;
/* Parse and handle the return WMT event */ wmt_evt = skb_pull_data(data->evt_skb, sizeof(*wmt_evt));
wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data; if (!wmt_evt) {
bt_dev_err(hdev, "WMT event too short (%u bytes)",
data->evt_skb->len);
err = -EINVAL;
goto err_free_skb;
}
if (wmt_evt->whdr.op != hdr->op) { if (wmt_evt->whdr.op != hdr->op) {
bt_dev_err(hdev, "Wrong op received %d expected %d", bt_dev_err(hdev, "Wrong op received %d expected %d",
wmt_evt->whdr.op, hdr->op); wmt_evt->whdr.op, hdr->op);
@ -712,6 +717,12 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
status = BTMTK_WMT_PATCH_DONE; status = BTMTK_WMT_PATCH_DONE;
break; break;
case BTMTK_WMT_FUNC_CTRL: case BTMTK_WMT_FUNC_CTRL:
if (!skb_pull_data(data->evt_skb,
sizeof(wmt_evt_funcc->status))) {
err = -EINVAL;
goto err_free_skb;
}
wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt; wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
if (be16_to_cpu(wmt_evt_funcc->status) == 0x404) if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
status = BTMTK_WMT_ON_DONE; status = BTMTK_WMT_ON_DONE;