Commit 0adcf6be authored by Johan Hovold's avatar Johan Hovold Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: qca: fix info leak when fetching board id 



Add the missing sanity check when fetching the board id to avoid leaking
slab data when later requesting the firmware.

Fixes: a7f8dedb ("Bluetooth: qca: add support for QCA2066")
Cc: stable@vger.kernel.org	# 6.7
Cc: Tim Jiang <quic_tjiang@quicinc.com>
Signed-off-by: default avatarJohan Hovold <johan+linaro@kernel.org>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent cda0d6a1

drivers/bluetooth/btqca.c

+5 −0
Original line number Diff line number Diff line
@@ -252,6 +252,11 @@ static int qca_read_fw_board_id(struct hci_dev *hdev, u16 *bid) 
		goto out;

	}



	if (skb->len < 3) {

		err = -EILSEQ;

		goto out;

	}



	*bid = (edl->data[1] << 8) + edl->data[2];

	bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid);