github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: btintel: Zero version data before parsing TLVs

Browse Source 
Firmware may omit optional TLVs, leaving their corresponding fields
unset in the caller-supplied struct intel_version_tlv. Since the
structure is typically stack-allocated and not cleared beforehand,
fields for which no TLV is received retain uninitialized stack
memory. This stale data can be logged via btintel_version_info_tlv()
and copied back to the caller, leaking kernel stack contents.

Clear the structure in btintel_read_version_tlv() before parsing so
that fields with no corresponding TLV are deterministically zero
instead of containing garbage.

Fixes: 57375beef7 ("Bluetooth: btintel: Add infrastructure to read controller information")
Signed-off-by: Kiran K <kiran.k@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Kiran K 2026-10-08 19:36:01 +05:30 committed by Luiz Augusto von Dentz
parent 64aabf94ec
commit cf87709d7f
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/bluetooth/btintel.c
View File

@ -752,6 +752,7 @@ static int btintel_read_version_tlv(struct hci_dev *hdev,
return -EIO;
}
memset(version, 0, sizeof(*version));
err = btintel_parse_version_tlv(hdev, version, skb);
kfree_skb(skb);