diff options
| author |   Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com> | 2025-10-24 12:29:10 -0400 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2025-10-31 12:41:01 -0400 |
| commit | 5c5f1f64681cc889d9b13e4a61285e9e029d6ab5 (patch) | |
| tree | 069982aeea24ae976e36cb89733672cc6396ef36 /scripts/basic/git:/ssh:/git@git.zx2c4.com | |
| parent | Merge tag 'net-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (diff) | |
| download | wireguard-linux-5c5f1f64681cc889d9b13e4a61285e9e029d6ab5.tar.xz wireguard-linux-5c5f1f64681cc889d9b13e4a61285e9e029d6ab5.zip | |
Bluetooth: hci_event: validate skb length for unknown CC opcode
In hci_cmd_complete_evt(), if the command complete event has an unknown
opcode, we assume the first byte of the remaining skb->data contains the
return status. However, parameter data has previously been pulled in
hci_event_func(), which may leave the skb empty. If so, using skb->data[0]
for the return status uses un-init memory.
The fix is to check skb->len before using skb->data.
Reported-by: syzbot+a9a4bedfca6aa9d7fa24@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a9a4bedfca6aa9d7fa24
Tested-by: syzbot+a9a4bedfca6aa9d7fa24@syzkaller.appspotmail.com
Fixes: afcb3369f46ed ("Bluetooth: hci_event: Fix vendor (unknown) opcode status handling")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'scripts/basic/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions