github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-18 16:48:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
2c1e4e0061
linux/drivers/bluetooth
History
Zijun Hu b640ff9af3 Bluetooth: btintel: Validate length before parsing diagnostics TLV 
btintel_diagnostics() accesses tlv->val[0] without first validating
that the diagnostics VSE is long enough to contain that field, so
may cause reading data beyond the received frame.

Fix by validating the length before access.

Fixes: af395330ab ("Bluetooth: btintel: Add Intel devcoredump support")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-28 16:13:12 -04:00
..
ath3k.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
bcm203x.c Bluetooth: bcm203x: remove superfluous header files 2022-03-18 17:12:09 +01:00
bfusb.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
bpa10x.c Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() 2026-07-06 10:46:58 -04:00
btbcm.c Bluetooth: btbcm: Add entry for BCM4343A2 UART Bluetooth 2026-04-10 10:22:21 -04:00
btbcm.h Bluetooth: hci_bcm: Add support for FW loading in autobaud mode 2022-07-21 17:04:38 -07:00
btintel_pcie.c Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe() 2026-07-06 10:46:58 -04:00
btintel_pcie.h Bluetooth: btintel_pcie: Separate coredump work from RX work 2026-06-11 14:24:42 -04:00
btintel.c Bluetooth: btintel: Validate length before parsing diagnostics TLV 2026-07-28 16:13:12 -04:00
btintel.h Bluetooth: btintel_pcie: Load IOSF debug regs by controller variant 2026-06-11 14:24:41 -04:00
btmrvl_debugfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btmrvl_drv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmrvl_main.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btmrvl_sdio.c Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind 2025-05-21 10:27:20 -04:00
btmrvl_sdio.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmtk.c Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path 2026-06-11 14:24:40 -04:00
btmtk.h Bluetooth: btmtk: add event filter to filter specific event 2026-06-11 14:24:37 -04:00
btmtksdio.c Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() 2026-06-11 14:24:42 -04:00
btmtkuart.c Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
btnxpuart.c Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() 2026-07-06 10:46:57 -04:00
btqca.c Bluetooth: qca: fix NVM tag length underflow in TLV parser 2026-07-13 10:02:57 -04:00
btqca.h Bluetooth: qca: add WCN3950 support 2025-03-25 12:42:35 -04:00
btqcomsmd.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
btrsi.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
btrtl.c Bluetooth: btrtl: validate firmware patch bounds 2026-07-13 10:08:06 -04:00
btrtl.h Bluetooth: btrtl: Add Realtek devcoredump support 2023-08-11 11:35:14 -07:00
btsdio.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
btusb.c Bluetooth: btusb: validate Realtek vendor event length 2026-07-20 17:41:28 -04:00
hci_ag6xx.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_aml.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_ath.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_bcm.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_bcm4377.c Bluetooth: hci_bcm4377: Use generic power management 2026-01-29 13:22:42 -05:00
hci_bcsp.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_h4.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_h5.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hci_intel.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_ldisc.c Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled 2026-07-06 09:49:59 -04:00
hci_ll.c Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x 2026-04-13 09:19:42 -04:00
hci_mrvl.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_nokia.c Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
hci_qca.c Bluetooth: hci_qca: Clear memdump state on invalid dump size 2026-07-13 10:09:52 -04:00
hci_serdev.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
hci_uart.h Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
hci_vhci.c Bluetooth: vhci: validate devcoredump state before side effects 2026-06-11 14:24:41 -04:00
Kconfig bluetooth: remove all PCMCIA drivers 2026-06-11 14:24:38 -04:00
Makefile bluetooth: remove all PCMCIA drivers 2026-06-11 14:24:38 -04:00
virtio_bt.c Bluetooth: virtio_bt: validate rx pkt_type header length 2026-05-06 16:22:33 -04:00