kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/drivers/bluetooth
History
HyeongJun An 502adc06ba Bluetooth: virtio_bt: avoid OOB read of build info string 
The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read
Build Information) and hands the response to bt_dev_info() and
hci_set_fw_info() as a "%s" string starting at skb->data + 1, without
checking the length. A backend that answers with status only leaves that
pointer past the end of the received data, so the walk reads adjacent
slab memory until it meets a NUL. Those bytes reach the kernel log and
the firmware-info debugfs file.

To fix this, print the string with a bounded "%.*s" limited to
skb->len - 1. A short or unterminated response then prints as much as
arrived instead of failing setup.

This mirrors commit dd068ef044 ("Bluetooth: bpa10x: avoid OOB read of
revision string in bpa10x_setup()"), which fixed the identical pattern.

Fixes: afd2daa26c ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
History 2026-08-07 15:38:32 -04:00
..
ath3k.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
bcm203x.c Bluetooth: bcm203x: remove superfluous header files 2022-03-18 17:12:09 +01:00
bfusb.c Bluetooth: bfusb: validate received block boundaries 2026-08-07 12:36:22 -04:00
bpa10x.c Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() 2026-07-06 10:46:58 -04:00
btbcm.c Bluetooth: btbcm: Add entry for BCM4343A2 UART Bluetooth 2026-04-10 10:22:21 -04:00
btbcm.h Bluetooth: hci_bcm: Add support for FW loading in autobaud mode 2022-07-21 17:04:38 -07:00
btintel.c Bluetooth: btintel: Add Bluetooth SAR revision 2 support 2026-08-07 15:38:32 -04:00
btintel.h Bluetooth: btintel: Add Bluetooth SAR revision 2 support 2026-08-07 15:38:32 -04:00
btintel_pcie.c Bluetooth: btintel_pcie: Add vendor_reset PCI sysfs for PLDR 2026-08-07 15:38:31 -04:00
btintel_pcie.h Bluetooth: btintel_pcie: split coredump worker into per-trigger works 2026-08-07 12:35:01 -04:00
btmrvl_debugfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
btmrvl_drv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmrvl_main.c Bluetooth: btmrvl: validate event packet lengths 2026-08-07 15:38:19 -04:00
btmrvl_sdio.c Bluetooth: btmrvl_sdio: Do not free HCI_VENDOR_PKT frame by hci_recv_frame() 2026-08-07 15:38:31 -04:00
btmrvl_sdio.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmtk.c Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read() 2026-07-28 16:13:48 -04:00
btmtk.h Bluetooth: btmtk: add event filter to filter specific event 2026-06-11 14:24:37 -04:00
btmtksdio.c Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() 2026-06-11 14:24:42 -04:00
btmtkuart.c Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
btnxpuart.c Bluetooth: btnxpuart: Fix use-after-free in probe error path 2026-08-07 12:34:41 -04:00
btqca.c Bluetooth: btqca: Simplify qca_send_reset() by using __hci_reset_sync() 2026-08-07 12:31:15 -04:00
btqca.h Bluetooth: qca: add WCN3950 support 2025-03-25 12:42:35 -04:00
btqcomsmd.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
btrsi.c Bluetooth: btrsi: Move set_bt_context after successful HCI registration 2026-08-07 15:38:30 -04:00
btrtl.c Bluetooth: btrtl: validate firmware patch bounds 2026-07-13 10:08:06 -04:00
btrtl.h Bluetooth: btrtl: Add Realtek devcoredump support 2023-08-11 11:35:14 -07:00
btsdio.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
btusb.c Bluetooth: btusb: Simplify btusb_recv_bulk() by hci_acl_dlen() 2026-08-07 15:38:31 -04:00
hci_ag6xx.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_aml.c Bluetooth: hci_aml: validate firmware segment lengths 2026-08-07 15:38:32 -04:00
hci_ath.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_bcm.c Bluetooth: use a named initializer for acpi_device_id 2026-08-07 15:38:31 -04:00
hci_bcm4377.c Bluetooth: hci_bcm4377: Use generic power management 2026-01-29 13:22:42 -05:00
hci_bcsp.c Bluetooth: hci_bcsp: validate received packet lengths 2026-08-07 15:38:29 -04:00
hci_h4.c Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized 2026-05-06 16:21:43 -04:00
hci_h5.c Bluetooth: use a named initializer for acpi_device_id 2026-08-07 15:38:31 -04:00
hci_intel.c Bluetooth: hci_intel: drop unused assignment of acpi_device_id::driver_data 2026-08-07 15:38:31 -04:00
hci_ldisc.c Bluetooth: hcli_ldisc: Remove reduntant braces 2026-08-07 15:38:32 -04:00
hci_ll.c Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x 2026-04-13 09:19:42 -04:00
hci_mrvl.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_nokia.c Bluetooth: hci_nokia: validate firmware packet bounds 2026-08-07 12:33:41 -04:00
hci_qca.c Bluetooth: use a named initializer for acpi_device_id 2026-08-07 15:38:31 -04:00
hci_serdev.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
hci_uart.h Bluetooth: fix corruption in h4_recv_buf() after cleanup 2025-10-24 10:31:24 -04:00
hci_vhci.c Bluetooth: vhci: validate devcoredump state before side effects 2026-06-11 14:24:41 -04:00
Kconfig bluetooth: remove all PCMCIA drivers 2026-06-11 14:24:38 -04:00
Makefile Bluetooth: enable context analysis 2026-08-07 12:27:20 -04:00
virtio_bt.c Bluetooth: virtio_bt: avoid OOB read of build info string 2026-08-07 15:38:32 -04:00