[PATCH] Bluetooth: btusb: validate QCA rampatch size

[Laxman Acharya Padhya]

btusb_setup_qca_load_rampatch() reads the rampatch version structure at
fw->data + info->ver_offset. A truncated rampatch can therefore make the
driver read beyond the firmware buffer while parsing the version fields.

The download path also expects the complete device-specific rampatch
header. Reject files too short to contain both the header and version
structure before accessing either.

Fixes: 3267c884cefa ("Bluetooth: btusb: Add support for QCA ROME chipset family")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx>
---
 drivers/bluetooth/btusb.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 8f7ed469cac..9801835d7c7 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3526,6 +3526,7 @@ static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
 	struct qca_rampatch_version *rver;
 	const struct firmware *fw;
 	const char *fw_subdir;
+	size_t min_size;
 	u32 ver_rom, ver_patch, rver_rom;
 	u16 rver_rom_low, rver_rom_high, rver_patch;
 	char fwname[80];
@@ -3551,6 +3552,15 @@ static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
 
 	bt_dev_info(hdev, "using rampatch file: %s", fwname);
 
+	min_size = max_t(size_t, info->rampatch_hdr,
+			 info->ver_offset + sizeof(*rver));
+	if (fw->size < min_size) {
+		bt_dev_err(hdev, "rampatch file is truncated (%zu < %zu)",
+			   fw->size, min_size);
+		err = -EINVAL;
+		goto done;
+	}
+
 	rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
 	rver_rom_low = le16_to_cpu(rver->rom_version_low);
 	rver_patch = le16_to_cpu(rver->patch_version);
-- 
2.51.2