linuxmsm/laptops-kernel
0
0
Fork 0
mirror of https://github.com/linux-msm/laptops-kernel.git synced 2026-08-13 14:19:53 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: btintel: Validate length before parsing diagnostics TLV

Browse Source 
btintel_diagnostics() accesses tlv->val[0] without first validating
that the diagnostics VSE is long enough to contain that field, so
may cause reading data beyond the received frame.

Fix by validating the length before access.

Fixes: af395330ab ("Bluetooth: btintel: Add Intel devcoredump support")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Zijun Hu
2026-07-28 16:13:12 -04:00
committed by Luiz Augusto von Dentz
parent af24e338bf
commit b640ff9af3
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/bluetooth/btintel.c
+3
View File
@@ -3771,6 +3771,9 @@ static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb)
{
struct intel_tlv *tlv = (void *)&skb->data[5];
if (skb->len < 5 + sizeof(*tlv) + sizeof(tlv->val[0]))
goto recv_frame;
/* The first event is always an event type TLV */
if (tlv->type != INTEL_TLV_TYPE_ID)
goto recv_frame;