[PATCH] Bluetooth: btusb: validate Realtek vendor event length

[PATCH] Bluetooth: btusb: validate Realtek vendor event length

[Pengpeng Hou]

btusb_recv_event_realtek() inspects skb->data[2] when checking
for a Realtek coredump subevent.

Require the packet to contain the HCI event header and the subevent byte
before treating it as a coredump event. Short packets keep following the
normal hci_recv_frame() path.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/bluetooth/btusb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 08c0a99a62c5..8f7ed469cac6 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2782,7 +2782,9 @@ static int btusb_setup_realtek(struct hci_dev *hdev)
 
 static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
 {
-	if (skb->data[0] == HCI_VENDOR_PKT && skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) {
+	if (skb->len >= HCI_EVENT_HDR_SIZE + 1 &&
+	    skb->data[0] == HCI_VENDOR_PKT &&
+	    skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) {
 		struct rtk_dev_coredump_hdr hdr = {
 			.code = RTK_DEVCOREDUMP_CODE_MEMDUMP,
 		};
-- 
2.43.0

Re: [PATCH] Bluetooth: btusb: validate Realtek vendor event length

[Paul Menzel]

Dear Pengpeng,


Thank you for your patch.

Am 06.07.26 um 11:16 schrieb Pengpeng Hou:
> btusb_recv_event_realtek() inspects skb->data[2] when checking
> for a Realtek coredump subevent.

(Minor thing, that *for a* would fit on the line above.)

Also the sentence mislead me a little, as skb->data[0] is also checked.

> Require the packet to contain the HCI event header and the subevent byte
> before treating it as a coredump event. Short packets keep following the
> normal hci_recv_frame() path.

Could you give an example packet, that was/would be misdetected?

Please add a Fixes: tag.

> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>   drivers/bluetooth/btusb.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 08c0a99a62c5..8f7ed469cac6 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -2782,7 +2782,9 @@ static int btusb_setup_realtek(struct hci_dev *hdev)
>   
>   static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
>   {
> -	if (skb->data[0] == HCI_VENDOR_PKT && skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) {
> +	if (skb->len >= HCI_EVENT_HDR_SIZE + 1 &&
> +	    skb->data[0] == HCI_VENDOR_PKT &&
> +	    skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) {
>   		struct rtk_dev_coredump_hdr hdr = {
>   			.code = RTK_DEVCOREDUMP_CODE_MEMDUMP,
>   		};


Kind regards,

Paul

RE: Bluetooth: btusb: validate Realtek vendor event length

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1122166

---Test result---

Test Summary:
CheckPatch                    PASS      0.55 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.10 seconds
GitLint                       PASS      0.23 seconds
SubjectPrefix                 PASS      0.27 seconds
BuildKernel                   PASS      23.62 seconds
CheckAllWarning               PASS      27.47 seconds
CheckSparse                   PASS      24.61 seconds
BuildKernel32                 PASS      22.92 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      423.74 seconds
IncrementalBuild              PASS      22.01 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/402

---
Regards,
Linux Bluetooth