diff options
| author | Johan Hovold <johan+linaro@kernel.org> | 2024-05-01 14:34:53 +0200 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2024-05-03 13:05:33 -0400 |
| commit | 0adcf6be1445ed50bfd4a451a7a782568f270197 (patch) | |
| tree | 44c21f15bd73fe34a4acc9e45938df97d968ebfd /drivers/bluetooth | |
| parent | cda0d6a198e2a7ec6f176c36173a57bdd8af7af2 (diff) | |
| download | linux-0adcf6be1445ed50bfd4a451a7a782568f270197.tar.gz | |
Bluetooth: qca: fix info leak when fetching board id
Add the missing sanity check when fetching the board id to avoid leaking
slab data when later requesting the firmware.
Fixes: a7f8dedb4be2 ("Bluetooth: qca: add support for QCA2066")
Cc: stable@vger.kernel.org # 6.7
Cc: Tim Jiang <quic_tjiang@quicinc.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'drivers/bluetooth')
| -rw-r--r-- | drivers/bluetooth/btqca.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c index 664db524b1dd49..8d8a664620a360 100644 --- a/drivers/bluetooth/btqca.c +++ b/drivers/bluetooth/btqca.c @@ -252,6 +252,11 @@ static int qca_read_fw_board_id(struct hci_dev *hdev, u16 *bid) goto out; } + if (skb->len < 3) { + err = -EILSEQ; + goto out; + } + *bid = (edl->data[1] << 8) + edl->data[2]; bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid); |