[PATCH] Bluetooth: btintel: Bound exception info print to the received length

[PATCH] Bluetooth: btintel: Bound exception info print to the received length

[Ali Ahmet Memis]

btintel_hw_error() validates that the Intel exception info response is
exactly 13 bytes, and then prints the 12 bytes following the status byte
with a plain "%s". Nothing validates that those 12 bytes contain a NUL,
so the conversion can run past the end of the received response and into
whatever follows it in the skb.

Bound the conversion to the length that was actually received.

Fixes: 973bb97e5aee ("Bluetooth: btintel: Add generic function for handling hardware errors")
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
---
 drivers/bluetooth/btintel.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index bf567b7c5f00..4112f39f251f 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -288,7 +288,9 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)
 		goto unlock;
 	}
 
-	bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
+	/* The exception info field is not guaranteed to be NUL terminated */
+	bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1),
+		   (char *)(skb->data + 1));
 
 	kfree_skb(skb);
 
-- 
2.55.0

RE: Bluetooth: btintel: Bound exception info print to the received length

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1145926

---Test result---

Test Summary:
CheckPatch                    PASS      0.63 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      0.10 seconds
GitLint                       PASS      0.65 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   PASS      27.95 seconds
CheckAllWarning               PASS      31.46 seconds
CheckSparse                   PASS      29.62 seconds
BuildKernel32                 PASS      26.95 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      519.10 seconds
IncrementalBuild              PASS      26.44 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/580

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: btintel: Bound exception info print to the received length

[Paul Menzel]

Dear Ali,


Thank you for your patch.

Am 14.08.26 um 10:01 schrieb Ali Ahmet Memis:
> btintel_hw_error() validates that the Intel exception info response is
> exactly 13 bytes, and then prints the 12 bytes following the status byte
> with a plain "%s". Nothing validates that those 12 bytes contain a NUL,
> so the conversion can run past the end of the received response and into
> whatever follows it in the skb.
> 
> Bound the conversion to the length that was actually received.
> 
> Fixes: 973bb97e5aee ("Bluetooth: btintel: Add generic function for handling hardware errors")
> Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
> ---
>   drivers/bluetooth/btintel.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
> index bf567b7c5f00..4112f39f251f 100644
> --- a/drivers/bluetooth/btintel.c
> +++ b/drivers/bluetooth/btintel.c
> @@ -288,7 +288,9 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)
>   		goto unlock;
>   	}
>   
> -	bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
> +	/* The exception info field is not guaranteed to be NUL terminated */
> +	bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1),
> +		   (char *)(skb->data + 1));
>   
>   	kfree_skb(skb);

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul


PS: gemini/gemini-3.1-pro-preview found also other occurrences [1].


[1]: 
https://sashiko.dev/#/patchset/20260814080123.902388-1-ali%40iusegentoo.com