Re: [PATCH] Bluetooth: btusb: validate Realtek vendor event length

[Paul Menzel]

Dear Pengpeng,


Thank you for your patch.

Am 06.07.26 um 11:16 schrieb Pengpeng Hou:
> btusb_recv_event_realtek() inspects skb->data[2] when checking
> for a Realtek coredump subevent.

(Minor thing, that *for a* would fit on the line above.)

Also the sentence mislead me a little, as skb->data[0] is also checked.

> Require the packet to contain the HCI event header and the subevent byte
> before treating it as a coredump event. Short packets keep following the
> normal hci_recv_frame() path.

Could you give an example packet, that was/would be misdetected?

Please add a Fixes: tag.

> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
>   drivers/bluetooth/btusb.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 08c0a99a62c5..8f7ed469cac6 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -2782,7 +2782,9 @@ static int btusb_setup_realtek(struct hci_dev *hdev)
>   
>   static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
>   {
> -	if (skb->data[0] == HCI_VENDOR_PKT && skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) {
> +	if (skb->len >= HCI_EVENT_HDR_SIZE + 1 &&
> +	    skb->data[0] == HCI_VENDOR_PKT &&
> +	    skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) {
>   		struct rtk_dev_coredump_hdr hdr = {
>   			.code = RTK_DEVCOREDUMP_CODE_MEMDUMP,
>   		};


Kind regards,

Paul