[PATCH] Bluetooth: btintel: Bound exception info print to the received length

[Ali Ahmet Memis]

btintel_hw_error() validates that the Intel exception info response is
exactly 13 bytes, and then prints the 12 bytes following the status byte
with a plain "%s". Nothing validates that those 12 bytes contain a NUL,
so the conversion can run past the end of the received response and into
whatever follows it in the skb.

Bound the conversion to the length that was actually received.

Fixes: 973bb97e5aee ("Bluetooth: btintel: Add generic function for handling hardware errors")
Signed-off-by: Ali Ahmet Memis <ali@xxxxxxxxxxxxxx>
---
 drivers/bluetooth/btintel.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index bf567b7c5f00..4112f39f251f 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -288,7 +288,9 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)
 		goto unlock;
 	}
 
-	bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
+	/* The exception info field is not guaranteed to be NUL terminated */
+	bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1),
+		   (char *)(skb->data + 1));
 
 	kfree_skb(skb);
 
-- 
2.55.0