Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:09:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bluetooth: hci_nokia: validate firmware packet bounds

Browse Source 
nokia_setup_fw() walks a length-prefixed firmware stream and
decodes HCI command packets from each record.

Check that each record fits in the remaining firmware image, that command
records contain the HCI command header, and that the payload length is
covered before submitting the command.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Pengpeng Hou
2026-08-07 12:33:41 -04:00
committed by Luiz Augusto von Dentz
parent dc16388d45
commit 45640627e3
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/bluetooth/hci_nokia.c
+20
View File
@@ -354,9 +354,29 @@ static int nokia_setup_fw(struct hci_uart *hu)
u16 opcode;
struct sk_buff *skb;
if (pkt_size > fw_size - 2) {
err = -EINVAL;
dev_err(dev, "%s: Malformed firmware packet\n",
hu->hdev->name);
goto done;
}
switch (pkt_type) {
case HCI_COMMAND_PKT:
if (pkt_size < 1 + HCI_COMMAND_HDR_SIZE) {
err = -EINVAL;
dev_err(dev, "%s: Malformed firmware command\n",
hu->hdev->name);
goto done;
}
cmd = (struct hci_command_hdr *)(fw_ptr + 3);
if (cmd->plen > pkt_size - 1 - HCI_COMMAND_HDR_SIZE) {
err = -EINVAL;
dev_err(dev, "%s: Truncated firmware command\n",
hu->hdev->name);
goto done;
}
opcode = le16_to_cpu(cmd->opcode);
skb = __hci_cmd_sync(hu->hdev, opcode, cmd->plen,