[PATCH] Bluetooth: btusb: validate QCA rampatch size

[PATCH] Bluetooth: btusb: validate QCA rampatch size

[Laxman Acharya Padhya]

btusb_setup_qca_load_rampatch() reads the rampatch version structure at
fw->data + info->ver_offset. A truncated rampatch can therefore make the
driver read beyond the firmware buffer while parsing the version fields.

The download path also expects the complete device-specific rampatch
header. Reject files too short to contain both the header and version
structure before accessing either.

Fixes: 3267c884cefa ("Bluetooth: btusb: Add support for QCA ROME chipset family")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
---
 drivers/bluetooth/btusb.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 8f7ed469cac..9801835d7c7 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3526,6 +3526,7 @@ static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
 	struct qca_rampatch_version *rver;
 	const struct firmware *fw;
 	const char *fw_subdir;
+	size_t min_size;
 	u32 ver_rom, ver_patch, rver_rom;
 	u16 rver_rom_low, rver_rom_high, rver_patch;
 	char fwname[80];
@@ -3551,6 +3552,15 @@ static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
 
 	bt_dev_info(hdev, "using rampatch file: %s", fwname);
 
+	min_size = max_t(size_t, info->rampatch_hdr,
+			 info->ver_offset + sizeof(*rver));
+	if (fw->size < min_size) {
+		bt_dev_err(hdev, "rampatch file is truncated (%zu < %zu)",
+			   fw->size, min_size);
+		err = -EINVAL;
+		goto done;
+	}
+
 	rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
 	rver_rom_low = le16_to_cpu(rver->rom_version_low);
 	rver_patch = le16_to_cpu(rver->patch_version);
-- 
2.51.2

RE: Bluetooth: btusb: validate QCA rampatch size

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1137581

---Test result---

Test Summary:
CheckPatch                    PASS      0.82 seconds
VerifyFixes                   PASS      0.15 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       PASS      0.60 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      26.84 seconds
CheckAllWarning               PASS      29.02 seconds
CheckSparse                   PASS      27.68 seconds
BuildKernel32                 PASS      25.88 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      504.95 seconds
IncrementalBuild              PASS      25.80 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/519

---
Regards,
Linux Bluetooth