github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-26 17:20:32 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/drivers/bluetooth
History
Pengpeng Hou df541cd485 Bluetooth: btusb: validate Realtek vendor event length 
btusb_recv_event_realtek() reads the event code at data[0] and the Realtek
subevent code at data[2] before deciding whether to consume a vendor event
as a coredump.

For example, the two-byte event ff 00 contains a complete vendor-event
header declaring zero parameters. The old classifier still reads a
nonexistent third byte and can misclassify the event as a coredump if the
adjacent byte is 0x34.

Require the HCI event header and first parameter to be present before
inspecting the Realtek subevent code. Short events continue through the
normal HCI receive path, which owns their protocol validation.

Fixes: 044014ce85 ("Bluetooth: btrtl: Add Realtek devcoredump support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-20 17:41:28 -04:00
..
ath3k.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
bcm203x.c
bfusb.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
bpa10x.c Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() 2026-07-06 10:46:58 -04:00
btbcm.c Bluetooth: btbcm: Add entry for BCM4343A2 UART Bluetooth 2026-04-10 10:22:21 -04:00
btbcm.h
btintel_pcie.c Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe() 2026-07-06 10:46:58 -04:00
btintel_pcie.h Bluetooth: btintel_pcie: Separate coredump work from RX work 2026-06-11 14:24:42 -04:00
btintel.c Bluetooth: btintel_pcie: Support Product level reset 2026-06-11 14:24:37 -04:00
btintel.h Bluetooth: btintel_pcie: Load IOSF debug regs by controller variant 2026-06-11 14:24:41 -04:00
btmrvl_debugfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btmrvl_drv.h
btmrvl_main.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btmrvl_sdio.c Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind 2025-05-21 10:27:20 -04:00
btmrvl_sdio.h
btmtk.c Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path 2026-06-11 14:24:40 -04:00
btmtk.h Bluetooth: btmtk: add event filter to filter specific event 2026-06-11 14:24:37 -04:00
btmtksdio.c Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() 2026-06-11 14:24:42 -04:00
btmtkuart.c Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
btnxpuart.c Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() 2026-07-06 10:46:57 -04:00
btqca.c Bluetooth: qca: fix NVM tag length underflow in TLV parser 2026-07-13 10:02:57 -04:00
btqca.h Bluetooth: qca: add WCN3950 support 2025-03-25 12:42:35 -04:00
btqcomsmd.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
btrsi.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
btrtl.c Bluetooth: btrtl: validate firmware patch bounds 2026-07-13 10:08:06 -04:00
btrtl.h
btsdio.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
btusb.c Bluetooth: btusb: validate Realtek vendor event length 2026-07-20 17:41:28 -04:00
hci_ag6xx.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_aml.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_ath.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_bcm.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_bcm4377.c Bluetooth: hci_bcm4377: Use generic power management 2026-01-29 13:22:42 -05:00
hci_bcsp.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_h4.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_h5.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hci_intel.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_ldisc.c Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled 2026-07-06 09:49:59 -04:00
hci_ll.c Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x 2026-04-13 09:19:42 -04:00
hci_mrvl.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_nokia.c Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
hci_qca.c Bluetooth: hci_qca: Clear memdump state on invalid dump size 2026-07-13 10:09:52 -04:00
hci_serdev.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
hci_uart.h Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
hci_vhci.c Bluetooth: vhci: validate devcoredump state before side effects 2026-06-11 14:24:41 -04:00
Kconfig bluetooth: remove all PCMCIA drivers 2026-06-11 14:24:38 -04:00
Makefile bluetooth: remove all PCMCIA drivers 2026-06-11 14:24:38 -04:00
virtio_bt.c Bluetooth: virtio_bt: validate rx pkt_type header length 2026-05-06 16:22:33 -04:00