diff options
| author |   Tristan Madani <tristan@talencesecurity.com> | 2026-04-21 11:14:54 +0000 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-05-06 16:22:19 -0400 |
| commit | 634a4408c0615c523cf7531790f4f14a422b9206 (patch) | |
| tree | a0c3529588fea3d1f5469b501e3ae11636504b2b /tools/include/io_uring/git:/git.zx2c4.com/ssh:/git@git.zx2c4.com | |
| parent | Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (diff) | |
Bluetooth: btmtk: validate WMT event SKB length before struct access
btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to
struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc
(9 bytes) without first checking that the SKB contains enough data.
A short firmware response causes out-of-bounds reads from SKB tailroom.
Use skb_pull_data() to validate and advance past the base WMT event
header. For the FUNC_CTRL case, pull the additional status field bytes
before accessing them.
Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/include/io_uring/git:/git.zx2c4.com/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions