From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: Tristan Madani <tristmd@gmail.com>
Cc: linux-bluetooth@vger.kernel.org, marcel@holtmann.org,
sean.wang@mediatek.com, mark-yw.chen@mediatek.com,
linux-mediatek@lists.infradead.org, stable@vger.kernel.org
Subject: Re: [PATCH v3] Bluetooth: btmtk: validate WMT event SKB length before struct access
Date: Mon, 20 Apr 2026 16:41:52 -0400 [thread overview]
Message-ID: <CABBYNZK5dsj7oTpXAgJ1mOBYBvN+haDK0okR7ed33QC=Td18JQ@mail.gmail.com> (raw)
In-Reply-To: <20260417102919.2549352-1-tristmd@gmail.com>
Hi Tristan,
On Fri, Apr 17, 2026 at 6:29 AM Tristan Madani <tristmd@gmail.com> wrote:
>
> From: Tristan Madani <tristan@talencesecurity.com>
>
> btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to
> struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc
> (9 bytes) without first checking that the SKB contains enough data.
> A short firmware response causes out-of-bounds reads from SKB tailroom.
>
> Add length validation before each struct access to prevent OOB reads
> from malformed WMT event responses.
>
> Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
> drivers/bluetooth/btmtk.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
> index 6fb6ca274..b1a96ebae 100644
> --- a/drivers/bluetooth/btmtk.c
> +++ b/drivers/bluetooth/btmtk.c
> @@ -695,6 +695,12 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
> if (data->evt_skb == NULL)
> goto err_free_wc;
>
> + /* Validate SKB length before accessing WMT event structs */
> + if (data->evt_skb->len < sizeof(*wmt_evt)) {
> + err = -EINVAL;
> + goto err_free_skb;
> + }
Can't we just use skb_pull_data instead?
> +
> /* Parse and handle the return WMT event */
> wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
> if (wmt_evt->whdr.op != hdr->op) {
> @@ -712,6 +718,10 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
> status = BTMTK_WMT_PATCH_DONE;
> break;
> case BTMTK_WMT_FUNC_CTRL:
> + if (data->evt_skb->len < sizeof(*wmt_evt_funcc)) {
> + err = -EINVAL;
> + goto err_free_skb;
> + }
Ditto.
> wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
> if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
> status = BTMTK_WMT_ON_DONE;
> --
> 2.47.3
>
https://sashiko.dev/#/patchset/20260417102919.2549352-1-tristmd%40gmail.com
We should probably check if the comments above are valid and have them fixed.
--
Luiz Augusto von Dentz
prev parent reply other threads:[~2026-04-20 20:42 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-17 10:29 [PATCH v3] Bluetooth: btmtk: validate WMT event SKB length before struct access Tristan Madani
2026-04-20 20:41 ` Luiz Augusto von Dentz [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CABBYNZK5dsj7oTpXAgJ1mOBYBvN+haDK0okR7ed33QC=Td18JQ@mail.gmail.com' \
--to=luiz.dentz@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=marcel@holtmann.org \
--cc=mark-yw.chen@mediatek.com \
--cc=sean.wang@mediatek.com \
--cc=stable@vger.kernel.org \
--cc=tristmd@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).