[PATCH] Bluetooth: MGMT: Add length check in confirm_name

[caitao <294305068@qq.com>]

From: caitao <caitao@kylinos.cn>

The confirm_name function did not validate the length of the incoming
data before accessing the mgmt_cp_confirm_name structure, which could
lead to out-of-bounds reads if a short packet was sent.

Add a length check at the beginning of the function to ensure the data
is at least sizeof(struct mgmt_cp_confirm_name). If the check fails,
return MGMT_STATUS_INVALID_PARAMS without accessing the invalid data.

Signed-off-by: caitao <caitao@kylinos.cn>
---
 net/bluetooth/mgmt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index a0a491e5311e..aab8e64283aa 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -6271,6 +6271,10 @@ static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
 
 	bt_dev_dbg(hdev, "sock %p", sk);
 
+	if (len < sizeof(*cp))
+		return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
+					 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
+
 	hci_dev_lock(hdev);
 
 	if (!hci_discovery_active(hdev)) {
-- 
2.43.0