diff options
| author |   Kees Cook <kees@kernel.org> | 2025-05-20 09:31:35 -0700 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2025-05-22 13:06:28 -0400 |
| commit | 3aa1dc3c9060e335e82e9c182bf3d1db29220b1b (patch) | |
| tree | 29a7975e75257dfd7092a1bd10881e329d493a6c /drivers | |
| parent | Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() (diff) | |
| download | wireguard-linux-3aa1dc3c9060e335e82e9c182bf3d1db29220b1b.tar.xz wireguard-linux-3aa1dc3c9060e335e82e9c182bf3d1db29220b1b.zip | |
Bluetooth: btintel: Check dsbr size from EFI variable
Since the size of struct btintel_dsbr is already known, we can just
start there instead of querying the EFI variable size. If the final
result doesn't match what we expect also fail. This fixes a stack buffer
overflow when the EFI variable is larger than struct btintel_dsbr.
Reported-by: zepta <z3ptaa@gmail.com>
Closes: https://lore.kernel.org/all/CAPBS6KoaWV9=dtjTESZiU6KK__OZX0KpDk-=JEH8jCHFLUYv3Q@mail.gmail.com
Fixes: eb9e749c0182 ("Bluetooth: btintel: Allow configuring drive strength of BRI")
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/bluetooth/btintel.c | 10 |
1 files changed, 2 insertions, 8 deletions
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c index ae92490d0c78..55cc1652bfe4 100644 --- a/drivers/bluetooth/btintel.c +++ b/drivers/bluetooth/btintel.c @@ -2719,7 +2719,7 @@ static int btintel_uefi_get_dsbr(u32 *dsbr_var) } __packed data; efi_status_t status; - unsigned long data_size = 0; + unsigned long data_size = sizeof(data); efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03, 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31); @@ -2730,15 +2730,9 @@ static int btintel_uefi_get_dsbr(u32 *dsbr_var) return -EOPNOTSUPP; status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, - NULL); - - if (status != EFI_BUFFER_TOO_SMALL || !data_size) - return -EIO; - - status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, &data); - if (status != EFI_SUCCESS) + if (status != EFI_SUCCESS || data_size != sizeof(data)) return -ENXIO; *dsbr_var = data.dsbr; |