From bd76a28a739dd4d15ac119c7f9cfe3f7cf8a85c0 Mon Sep 17 00:00:00 2001 From: Marek Szyprowski Date: Tue, 4 Aug 2026 11:46:30 +0200 Subject: [PATCH] Bluetooth: btmrvl: fix event packet length validation The event length validation added by 65be90af2756 commit used a single check against sizeof(*event), which assumed every event type uses the maximum payload size. Unfortunately event packet length depends on the type of the received event, so it must be checked separately for each event type to avoid rejecting some known well-formed events. Fixes: 65be90af2756 ("Bluetooth: btmrvl: validate event packet lengths") Signed-off-by: Marek Szyprowski Signed-off-by: Luiz Augusto von Dentz --- drivers/bluetooth/btmrvl_main.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c index aaf1614ccfd7..e25930351f64 100644 --- a/drivers/bluetooth/btmrvl_main.c +++ b/drivers/bluetooth/btmrvl_main.c @@ -81,7 +81,7 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb) struct btmrvl_event *event; int ret = 0; - if (skb->len < sizeof(*event)) + if (skb->len <= offsetof(typeof(*event), data[0])) return -EINVAL; event = (struct btmrvl_event *) skb->data; @@ -93,6 +93,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb) switch (event->data[0]) { case BT_EVENT_AUTO_SLEEP_MODE: + if (skb->len <= offsetof(typeof(*event), data[2])) + return -EINVAL; if (!event->data[2]) { if (event->data[1] == BT_PS_ENABLE) adapter->psmode = 1; @@ -106,6 +108,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb) break; case BT_EVENT_HOST_SLEEP_CONFIG: + if (skb->len <= offsetof(typeof(*event), data[3])) + return -EINVAL; if (!event->data[3]) BT_DBG("gpio=%x, gap=%x", event->data[1], event->data[2]); @@ -114,6 +118,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb) break; case BT_EVENT_HOST_SLEEP_ENABLE: + if (skb->len <= offsetof(typeof(*event), data[1])) + return -EINVAL; if (!event->data[1]) { adapter->hs_state = HS_ACTIVATED; if (adapter->psmode) @@ -126,6 +132,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb) break; case BT_EVENT_MODULE_CFG_REQ: + if (skb->len <= offsetof(typeof(*event), data[2])) + return -EINVAL; if (priv->btmrvl_dev.sendcmdflag && event->data[1] == MODULE_BRINGUP_REQ) { BT_DBG("EVENT:%s", @@ -143,6 +151,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb) break; case BT_EVENT_POWER_STATE: + if (skb->len <= offsetof(typeof(*event), data[1])) + return -EINVAL; if (event->data[1] == BT_PS_SLEEP) adapter->ps_state = PS_SLEEP; BT_DBG("EVENT:%s",