Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

Browse source

The "Exception info %s" print uses skb->data + 1, but the 12-byte
payload is not guaranteed to be NUL-terminated and can be read past
its end.

Bound the print with "%.*s" and skb->len - 1.

Fixes: 973bb97e5a ("Bluetooth: btintel: Add generic function for handling hardware errors")
Cc: stable@vger.kernel.org
Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

...

This commit is contained in:

Chandrashekar Devegowda 2026-09-22 12:10:20 +05:30 • committed by Luiz Augusto von Dentz

parent 6d91041bb3

commit 40eb4b18ad

1 changed files with 2 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

drivers/bluetooth/btintel.c

View file