[PATCH] Bluetooth: btmrvl: fix event packet length validation

[Marek Szyprowski <m.szyprowski@samsung.com>]

The event length validation added by 75e574f6a212 commit used a single
check against sizeof(*event), which assumed every event type uses the
maximum payload size. Unfortunately event packet length depends on the
type of the received event, so it must be checked separately for each
event type to avoid rejecting some known well-formed events.

Fixes: 75e574f6a212 ("Bluetooth: btmrvl: validate event packet lengths")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
---
 drivers/bluetooth/btmrvl_main.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index aaf1614ccfd7..e25930351f64 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -81,7 +81,7 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 	struct btmrvl_event *event;
 	int ret = 0;
 
-	if (skb->len < sizeof(*event))
+	if (skb->len <= offsetof(typeof(*event), data[0]))
 		return -EINVAL;
 
 	event = (struct btmrvl_event *) skb->data;
@@ -93,6 +93,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 
 	switch (event->data[0]) {
 	case BT_EVENT_AUTO_SLEEP_MODE:
+		if (skb->len <= offsetof(typeof(*event), data[2]))
+			return -EINVAL;
 		if (!event->data[2]) {
 			if (event->data[1] == BT_PS_ENABLE)
 				adapter->psmode = 1;
@@ -106,6 +108,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_HOST_SLEEP_CONFIG:
+		if (skb->len <= offsetof(typeof(*event), data[3]))
+			return -EINVAL;
 		if (!event->data[3])
 			BT_DBG("gpio=%x, gap=%x", event->data[1],
 							event->data[2]);
@@ -114,6 +118,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_HOST_SLEEP_ENABLE:
+		if (skb->len <= offsetof(typeof(*event), data[1]))
+			return -EINVAL;
 		if (!event->data[1]) {
 			adapter->hs_state = HS_ACTIVATED;
 			if (adapter->psmode)
@@ -126,6 +132,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_MODULE_CFG_REQ:
+		if (skb->len <= offsetof(typeof(*event), data[2]))
+			return -EINVAL;
 		if (priv->btmrvl_dev.sendcmdflag &&
 				event->data[1] == MODULE_BRINGUP_REQ) {
 			BT_DBG("EVENT:%s",
@@ -143,6 +151,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_POWER_STATE:
+		if (skb->len <= offsetof(typeof(*event), data[1]))
+			return -EINVAL;
 		if (event->data[1] == BT_PS_SLEEP)
 			adapter->ps_state = PS_SLEEP;
 		BT_DBG("EVENT:%s",
-- 
2.43.0