[PATCH v2] Bluetooth: btmtk: fix OOB read from short WMT event SKB

Tristan Madani
2026-04-15T22:25:10Z

From: Tristan Madani <tristan@talencesecurity.com>

The WMT event response SKB is cast to typed structs (7, 9, and 18
bytes) without checking that the SKB contains enough data. Short
firmware responses cause out-of-bounds reads from SKB tailroom.

Add length validation before each struct access.

Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Note: v2 resubmission -- original sent via Gmail had HTML rendering
issues. This version uses git send-email for plain-text formatting.

drivers/bluetooth/btmtk.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index XXXXXXX..XXXXXXX 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -658,6 +658,8 @@ int btmtk_process_wmt_evt(struct btmtk_data *data, struct sk_buff *evt_skb)
struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;

+ if (data->evt_skb->len < sizeof(*wmt_evt))
+ return -EINVAL;
wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
if (wmt_evt->whdr.op != hdr->op) {

@@ -674,6 +676,9 @@ int btmtk_process_wmt_evt(struct btmtk_data *data, struct sk_buff *evt_skb)
switch (wmt_evt->whdr.op) {
case BTMTK_WMT_FUNC_CTRL:
+ if (data->evt_skb->len < sizeof(*wmt_evt_funcc))
+ return -EINVAL;
+
wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)