Commit 284987ab authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'for-net-2025-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth 

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
 - MGMT: Fix OOB access in parse_adv_monitor_pattern()
 - hci_event: validate skb length for unknown CC opcode

* tag 'for-net-2025-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
  Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
  Bluetooth: hci_event: validate skb length for unknown CC opcode
====================

Link: https://patch.msgid.link/20251031170959.590470-1-luiz.dentz@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents b7904323 8d59fba4

drivers/bluetooth/btrtl.c

+3 −1
Original line number Diff line number Diff line
@@ -625,8 +625,10 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, 
		len += entry->len;

	}



	if (!len)

	if (!len) {

		kvfree(ptr);

		return -EPERM;

	}



	*_buf = ptr;

	return len;

include/net/bluetooth/mgmt.h

+1 −1
Original line number Diff line number Diff line
@@ -780,7 +780,7 @@ struct mgmt_adv_pattern { 
	__u8 ad_type;

	__u8 offset;

	__u8 length;

	__u8 value[31];

	__u8 value[HCI_MAX_AD_LENGTH];

} __packed;



#define MGMT_OP_ADD_ADV_PATTERNS_MONITOR	0x0052

net/bluetooth/hci_event.c

+7 −0
Original line number Diff line number Diff line
@@ -4218,6 +4218,13 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data, 
	}



	if (i == ARRAY_SIZE(hci_cc_table)) {

		if (!skb->len) {

			bt_dev_err(hdev, "Unexpected cc 0x%4.4x with no status",

				   *opcode);

			*status = HCI_ERROR_UNSPECIFIED;

			return;

		}



		/* Unknown opcode, assume byte 0 contains the status, so

		 * that e.g. __hci_cmd_sync() properly returns errors

		 * for vendor specific commands send by HCI drivers.

net/bluetooth/mgmt.c

+3 −3
Original line number Diff line number Diff line
@@ -5395,9 +5395,9 @@ static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 
	for (i = 0; i < pattern_count; i++) {

		offset = patterns[i].offset;

		length = patterns[i].length;

		if (offset >= HCI_MAX_EXT_AD_LENGTH ||

		    length > HCI_MAX_EXT_AD_LENGTH ||

		    (offset + length) > HCI_MAX_EXT_AD_LENGTH)

		if (offset >= HCI_MAX_AD_LENGTH ||

		    length > HCI_MAX_AD_LENGTH ||

		    (offset + length) > HCI_MAX_AD_LENGTH)

			return MGMT_STATUS_INVALID_PARAMS;



		p = kmalloc(sizeof(*p), GFP_KERNEL);