From cf87709d7ff83b4de5d42b61e4a9806fe374cb9d Mon Sep 17 00:00:00 2001 From: Kiran K Date: Thu, 8 Oct 2026 19:36:01 +0530 Subject: [PATCH] Bluetooth: btintel: Zero version data before parsing TLVs Firmware may omit optional TLVs, leaving their corresponding fields unset in the caller-supplied struct intel_version_tlv. Since the structure is typically stack-allocated and not cleared beforehand, fields for which no TLV is received retain uninitialized stack memory. This stale data can be logged via btintel_version_info_tlv() and copied back to the caller, leaking kernel stack contents. Clear the structure in btintel_read_version_tlv() before parsing so that fields with no corresponding TLV are deterministically zero instead of containing garbage. Fixes: 57375beef71a ("Bluetooth: btintel: Add infrastructure to read controller information") Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz --- drivers/bluetooth/btintel.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c index f298c91f4f4e..c4a6b5ea64f1 100644 --- a/drivers/bluetooth/btintel.c +++ b/drivers/bluetooth/btintel.c @@ -752,6 +752,7 @@ static int btintel_read_version_tlv(struct hci_dev *hdev, return -EIO; } + memset(version, 0, sizeof(*version)); err = btintel_parse_version_tlv(hdev, version, skb); kfree_skb(skb);