[PATCH] Bluetooth: btrtl: validate config entry bounds

[PATCH] Bluetooth: btrtl: validate config entry bounds

[Pengpeng Hou]

btrtl_get_uart_settings() walks variable-length entries in an externally
loaded Realtek configuration blob.  It previously checked only that the
cursor was below the physical data area before reading an entry header and
advancing by its declared payload length.  A truncated final entry could
therefore make the parser read an incomplete header or consume a payload
beyond the configuration data.

The format gives a logical entry area in config->total_len.  First prove it
fits in the physical blob.  Parse only that logical area afterward.  This
preserves valid physical tail padding while requiring each fixed header and
payload to fit in the current logical configuration area.

Fixes: b85b0ee1001b ("Bluetooth: btrtl: add support for retrieving the UART settings")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/bluetooth/btrtl.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 49ecb18fea45..fab9a59a1eb4 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1460,11 +1460,11 @@ int btrtl_get_uart_settings(struct hci_dev *hdev,
 {
 	struct rtl_vendor_config *config;
 	struct rtl_vendor_config_entry *entry;
-	int i, total_data_len;
+	int i, declared_data_len, physical_data_len;
 	bool found = false;
 
-	total_data_len = btrtl_dev->cfg_len - sizeof(*config);
-	if (total_data_len <= 0) {
+	physical_data_len = btrtl_dev->cfg_len - sizeof(*config);
+	if (physical_data_len <= 0) {
 		rtl_dev_warn(hdev, "no config loaded");
 		return -EINVAL;
 	}
@@ -1475,14 +1475,25 @@ int btrtl_get_uart_settings(struct hci_dev *hdev,
 		return -EINVAL;
 	}
 
-	if (total_data_len < le16_to_cpu(config->total_len)) {
+	declared_data_len = le16_to_cpu(config->total_len);
+	if (declared_data_len > physical_data_len) {
 		rtl_dev_err(hdev, "config is too short");
 		return -EINVAL;
 	}
 
-	for (i = 0; i < total_data_len; ) {
+	for (i = 0; i < declared_data_len; ) {
+		if (declared_data_len - i < sizeof(*entry)) {
+			rtl_dev_err(hdev, "truncated config entry header");
+			return -EINVAL;
+		}
+
 		entry = ((void *)config->entry) + i;
 
+		if (entry->len > declared_data_len - i - sizeof(*entry)) {
+			rtl_dev_err(hdev, "truncated config entry payload");
+			return -EINVAL;
+		}
+
 		switch (le16_to_cpu(entry->offset)) {
 		case 0xc:
 			if (entry->len < sizeof(*device_baudrate)) {
-- 
2.43.0

RE: Bluetooth: btrtl: validate config entry bounds

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1128000

---Test result---

Test Summary:
CheckPatch                    PASS      0.75 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.14 seconds
GitLint                       PASS      0.34 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      30.16 seconds
CheckAllWarning               PASS      29.66 seconds
CheckSparse                   PASS      28.21 seconds
BuildKernel32                 PASS      26.32 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      464.27 seconds
IncrementalBuild              PASS      24.43 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/442

---
Regards,
Linux Bluetooth