Commit 21bd244b authored Apr 21, 2026 by Michael Bommarito Committed by Luiz Augusto von Dentz May 06, 2026

Bluetooth: virtio_bt: clamp rx length before skb_put



virtbt_rx_work() calls skb_put(skb, len) where len comes directly
from virtqueue_get_buf() with no validation against the buffer we
posted to the device. The RX skb is allocated in virtbt_add_inbuf()
and exposed to virtio as exactly 1000 bytes via sg_init_one().

Checking len against skb_tailroom(skb) is not sufficient because
alloc_skb() can leave more tailroom than the 1000 bytes actually
handed to the device. A malicious or buggy backend can therefore
report used.len between 1001 and skb_tailroom(skb), causing skb_put()
to include uninitialized kernel heap bytes that were never written by
the device.

The same path also accepts len == 0, in which case skb_put(skb, 0)
leaves the skb empty but virtbt_rx_handle() still reads the pkt_type
byte from skb->data, consuming uninitialized memory.

Define VIRTBT_RX_BUF_SIZE once and reuse it in alloc_skb() and
sg_init_one(), and gate virtbt_rx_work() on that same constant so
the bound checked matches the buffer actually exposed to the device.
Reject used.len == 0 in the same gate so an empty completion can
no longer reach virtbt_rx_handle().

Use bt_dev_err_ratelimited() because the length value comes from an
untrusted backend that can otherwise flood the kernel log.

Same class of bug as commit c04db81c ("net/9p: Fix buffer
overflow in USB transport layer"), which hardened the USB 9p
transport against unchecked device-reported length.

Fixes: 160fbcf3 ("Bluetooth: virtio_bt: Use skb_put to set length")
Cc: stable@vger.kernel.org
Cc: Soenke Huster <soenke.huster@eknoes.de>
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

parent 634a4408

drivers/bluetooth/virtio_bt.c

+12 −4

Original line number	Diff line number	Diff line
		@@ -12,6 +12,7 @@
		#include <net/bluetooth/hci_core.h>

		#define VERSION "0.1"
		#define VIRTBT_RX_BUF_SIZE 1000

		enum {
		VIRTBT_VQ_TX,
		@@ -33,11 +34,11 @@ static int virtbt_add_inbuf(struct virtio_bluetooth *vbt)
		struct sk_buff *skb;
		int err;

		skb = alloc_skb(1000, GFP_KERNEL);
		skb = alloc_skb(VIRTBT_RX_BUF_SIZE, GFP_KERNEL);
		if (!skb)
		return -ENOMEM;

		sg_init_one(sg, skb->data, 1000);
		sg_init_one(sg, skb->data, VIRTBT_RX_BUF_SIZE);

		err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
		if (err < 0) {
		@@ -227,8 +228,15 @@ static void virtbt_rx_work(struct work_struct *work)
		if (!skb)
		return;

		if (!len \|\| len > VIRTBT_RX_BUF_SIZE) {
		bt_dev_err_ratelimited(vbt->hdev,
		"rx reply len %u outside [1, %u]\n",
		len, VIRTBT_RX_BUF_SIZE);
		kfree_skb(skb);
		} else {
		skb_put(skb, len);
		virtbt_rx_handle(vbt, skb);
		}

		if (virtbt_add_inbuf(vbt) < 0)
		return;