Commit 634a4408 authored by Tristan Madani's avatar Tristan Madani Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: btmtk: validate WMT event SKB length before struct access 



btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to
struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc
(9 bytes) without first checking that the SKB contains enough data.
A short firmware response causes out-of-bounds reads from SKB tailroom.

Use skb_pull_data() to validate and advance past the base WMT event
header. For the FUNC_CTRL case, pull the additional status field bytes
before accessing them.

Fixes: d019930b ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarTristan Madani <tristan@talencesecurity.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent f958c780

drivers/bluetooth/btmtk.c

+13 −2
Original line number Diff line number Diff line
@@ -695,8 +695,13 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev, 
	if (data->evt_skb == NULL)

		goto err_free_wc;



	/* Parse and handle the return WMT event */

	wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;

	wmt_evt = skb_pull_data(data->evt_skb, sizeof(*wmt_evt));

	if (!wmt_evt) {

		bt_dev_err(hdev, "WMT event too short (%u bytes)",

			   data->evt_skb->len);

		err = -EINVAL;

		goto err_free_skb;

	}

	if (wmt_evt->whdr.op != hdr->op) {

		bt_dev_err(hdev, "Wrong op received %d expected %d",

			   wmt_evt->whdr.op, hdr->op);
@@ -712,6 +717,12 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev, 
			status = BTMTK_WMT_PATCH_DONE;

		break;

	case BTMTK_WMT_FUNC_CTRL:

		if (!skb_pull_data(data->evt_skb,

				   sizeof(wmt_evt_funcc->status))) {

			err = -EINVAL;

			goto err_free_skb;

		}



		wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;

		if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)

			status = BTMTK_WMT_ON_DONE;