public inbox for linux-bluetooth@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] Bluetooth: bfusb: Fix buffer over-read in rx processing loop
@ 2025-10-07 23:29 pip-izony
  2025-10-08  1:17 ` bluez.test.bot
                   ` (2 more replies)
  0 siblings, 3 replies; 12+ messages in thread
From: pip-izony @ 2025-10-07 23:29 UTC (permalink / raw)
  To: Marcel Holtmann
  Cc: Seungjin Bae, Kyungtae Kim, Luiz Augusto von Dentz, linux-kernel,
	linux-bluetooth, stable

From: Seungjin Bae <eeodqql09@gmail.com>

The bfusb_rx_complete() function parses incoming URB data in while loop.
The logic does not sufficiently validate the remaining buffer size(count)
accross loop iterations, which can lead to a buffer over-read.

For example, with 4-bytes remaining buffer, if the first iteration takes
the `hdr & 0x4000` branch, 2-bytes are consumed. On the next iteration,
only 2-bytes remain, but the else branch is trying to access the third
byte(buf[2]). This causes an out-of-bounds read and a potential kernel panic.

This patch fixes the vulnerability by adding checks to ensure enough
data remains in the buffer before it is accessed.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
---
 drivers/bluetooth/bfusb.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index 8df310983bf6..f17eae6dbd7d 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -360,6 +360,10 @@ static void bfusb_rx_complete(struct urb *urb)
 			count -= 2;
 			buf   += 2;
 		} else {
+            if (count < 3) {
+                bf_dev_err(data->hdev, "block header is too short");
+                break;
+            }
 			len = (buf[2] == 0) ? 256 : buf[2];
 			count -= 3;
 			buf   += 3;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2025-10-09 17:34 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-07 23:29 [PATCH] Bluetooth: bfusb: Fix buffer over-read in rx processing loop pip-izony
2025-10-08  1:17 ` bluez.test.bot
2025-10-08  1:56 ` [PATCH v2] " pip-izony
2025-10-08  3:01   ` [v2] " bluez.test.bot
2025-10-08  3:51   ` [PATCH v2] " Paul Menzel
2025-10-09  2:57     ` [PATCH v3] " pip-izony
2025-10-09  3:50       ` [v3] " bluez.test.bot
2025-10-09  7:01       ` [PATCH v3] " Paul Menzel
2025-10-09 16:48         ` [PATCH v4] " pip-izony
2025-10-09 17:14           ` Luiz Augusto von Dentz
2025-10-09 17:34           ` [v4] " bluez.test.bot
2025-10-08  4:58 ` [PATCH] " Greg KH

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox