mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 11:41:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: btmrvl: fix event packet length validation

Browse Source 
The event length validation added by 65be90af27 commit used a single
check against sizeof(*event), which assumed every event type uses the
maximum payload size. Unfortunately event packet length depends on the
type of the received event, so it must be checked separately for each
event type to avoid rejecting some known well-formed events.

Fixes: 65be90af27 ("Bluetooth: btmrvl: validate event packet lengths")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Marek Szyprowski
2026-08-04 11:46:30 +02:00
committed by Luiz Augusto von Dentz
parent b80de2cbb1
commit bd76a28a73
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/bluetooth/btmrvl_main.c
View File

@@ -81,7 +81,7 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
struct btmrvl_event *event;
int ret = 0;
if (skb->len < sizeof(*event))
if (skb->len <= offsetof(typeof(*event), data[0]))
return -EINVAL;
event = (struct btmrvl_event *) skb->data;
@@ -93,6 +93,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
switch (event->data[0]) {
case BT_EVENT_AUTO_SLEEP_MODE:
if (skb->len <= offsetof(typeof(*event), data[2]))
return -EINVAL;
if (!event->data[2]) {
if (event->data[1] == BT_PS_ENABLE)
adapter->psmode = 1;
@@ -106,6 +108,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
break;
case BT_EVENT_HOST_SLEEP_CONFIG:
if (skb->len <= offsetof(typeof(*event), data[3]))
return -EINVAL;
if (!event->data[3])
BT_DBG("gpio=%x, gap=%x", event->data[1],
event->data[2]);
@@ -114,6 +118,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
break;
case BT_EVENT_HOST_SLEEP_ENABLE:
if (skb->len <= offsetof(typeof(*event), data[1]))
return -EINVAL;
if (!event->data[1]) {
adapter->hs_state = HS_ACTIVATED;
if (adapter->psmode)
@@ -126,6 +132,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
break;
case BT_EVENT_MODULE_CFG_REQ:
if (skb->len <= offsetof(typeof(*event), data[2]))
return -EINVAL;
if (priv->btmrvl_dev.sendcmdflag &&
event->data[1] == MODULE_BRINGUP_REQ) {
BT_DBG("EVENT:%s",
@@ -143,6 +151,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
break;
case BT_EVENT_POWER_STATE:
if (skb->len <= offsetof(typeof(*event), data[1]))
return -EINVAL;
if (event->data[1] == BT_PS_SLEEP)
adapter->ps_state = PS_SLEEP;
BT_DBG("EVENT:%s",