[PATCH] Bluetooth: btmrvl: fix event packet length validation

[PATCH] Bluetooth: btmrvl: fix event packet length validation

[Marek Szyprowski]

The event length validation added by 75e574f6a212 commit used a single
check against sizeof(*event), which assumed every event type uses the
maximum payload size. Unfortunately event packet length depends on the
type of the received event, so it must be checked separately for each
event type to avoid rejecting some known well-formed events.

Fixes: 75e574f6a212 ("Bluetooth: btmrvl: validate event packet lengths")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
---
 drivers/bluetooth/btmrvl_main.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index aaf1614ccfd7..e25930351f64 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -81,7 +81,7 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 	struct btmrvl_event *event;
 	int ret = 0;
 
-	if (skb->len < sizeof(*event))
+	if (skb->len <= offsetof(typeof(*event), data[0]))
 		return -EINVAL;
 
 	event = (struct btmrvl_event *) skb->data;
@@ -93,6 +93,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 
 	switch (event->data[0]) {
 	case BT_EVENT_AUTO_SLEEP_MODE:
+		if (skb->len <= offsetof(typeof(*event), data[2]))
+			return -EINVAL;
 		if (!event->data[2]) {
 			if (event->data[1] == BT_PS_ENABLE)
 				adapter->psmode = 1;
@@ -106,6 +108,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_HOST_SLEEP_CONFIG:
+		if (skb->len <= offsetof(typeof(*event), data[3]))
+			return -EINVAL;
 		if (!event->data[3])
 			BT_DBG("gpio=%x, gap=%x", event->data[1],
 							event->data[2]);
@@ -114,6 +118,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_HOST_SLEEP_ENABLE:
+		if (skb->len <= offsetof(typeof(*event), data[1]))
+			return -EINVAL;
 		if (!event->data[1]) {
 			adapter->hs_state = HS_ACTIVATED;
 			if (adapter->psmode)
@@ -126,6 +132,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_MODULE_CFG_REQ:
+		if (skb->len <= offsetof(typeof(*event), data[2]))
+			return -EINVAL;
 		if (priv->btmrvl_dev.sendcmdflag &&
 				event->data[1] == MODULE_BRINGUP_REQ) {
 			BT_DBG("EVENT:%s",
@@ -143,6 +151,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_POWER_STATE:
+		if (skb->len <= offsetof(typeof(*event), data[1]))
+			return -EINVAL;
 		if (event->data[1] == BT_PS_SLEEP)
 			adapter->ps_state = PS_SLEEP;
 		BT_DBG("EVENT:%s",
-- 
2.43.0

RE: Bluetooth: btmrvl: fix event packet length validation

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2025 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1139978

---Test result---

Test Summary:
CheckPatch                    FAIL      0.53 seconds
VerifyFixes                   PASS      0.08 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       PASS      0.21 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      20.71 seconds
CheckAllWarning               PASS      22.75 seconds
CheckSparse                   PASS      21.66 seconds
BuildKernel32                 PASS      20.41 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      378.27 seconds
IncrementalBuild              PASS      19.10 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: btmrvl: fix event packet length validation
ERROR: Please use git commit description style 'commit <12+ chars of sha1> ("<title line>")' - ie: 'commit 75e574f6a212 ("Bluetooth: btmrvl: validate event packet lengths")'
#80: 
The event length validation added by 75e574f6a212 commit used a single

total: 1 errors, 0 warnings, 48 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14729543.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/531

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: btmrvl: fix event packet length validation

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue,  4 Aug 2026 11:46:30 +0200 you wrote:
> The event length validation added by 75e574f6a212 commit used a single
> check against sizeof(*event), which assumed every event type uses the
> maximum payload size. Unfortunately event packet length depends on the
> type of the received event, so it must be checked separately for each
> event type to avoid rejecting some known well-formed events.
> 
> Fixes: 75e574f6a212 ("Bluetooth: btmrvl: validate event packet lengths")
> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
> 
> [...]

Here is the summary with links:
  - Bluetooth: btmrvl: fix event packet length validation
    https://git.kernel.org/bluetooth/bluetooth-next/c/d56d51cc0cb6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html