[PATCH] Bluetooth: virtio_bt: avoid OOB read of build info string in virtbt_setup_zephyr()

[PATCH] Bluetooth: virtio_bt: avoid OOB read of build info string in virtbt_setup_zephyr()

[HyeongJun An]

virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build
Information) and passes the response to bt_dev_info() and hci_set_fw_info()
as a "%s" string starting at skb->data + 1, without checking the length:

  bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
  hci_set_fw_info(hdev, "%s", skb->data + 1);

A backend that returns a one-byte response (status only) leaves
skb->data + 1 past the end of the received data, and the %s walk reads
adjacent slab memory until it meets a NUL. The same happens when the
payload is not NUL-terminated within skb->len. The out-of-bounds bytes
end up in the kernel log and the firmware-info debugfs file.

Print the build-information string with a bounded "%.*s" limited to
skb->len - 1 instead. This keeps the string readable for well-behaved
backends while never reading past the received data, and does not fail
setup, so a backend returning a short or unterminated response keeps
working.

This mirrors commit dd068ef04412 ("Bluetooth: bpa10x: avoid OOB read of
revision string in bpa10x_setup()"), which fixed the identical pattern;
the virtio backend is likewise treated as untrusted for the receive path.

Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Assisted-by: Claude:claude-opus-4-8
---
 drivers/bluetooth/virtio_bt.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 140ab55c9fc5..c20d54088c8c 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -120,9 +120,13 @@ static int virtbt_setup_zephyr(struct hci_dev *hdev)
 	if (IS_ERR(skb))
 		return PTR_ERR(skb);
 
-	bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
+	/* Bounded print: the backend controls skb->len. */
+	if (skb->len > 1) {
+		int len = skb->len - 1;
 
-	hci_set_fw_info(hdev, "%s", skb->data + 1);
+		bt_dev_info(hdev, "%.*s", len, (char *)(skb->data + 1));
+		hci_set_fw_info(hdev, "%.*s", len, skb->data + 1);
+	}
 
 	kfree_skb(skb);
 	return 0;
-- 
2.43.0

[PATCH v2] Bluetooth: virtio_bt: avoid OOB read of build info string

[HyeongJun An]

The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read
Build Information) and hands the response to bt_dev_info() and
hci_set_fw_info() as a "%s" string starting at skb->data + 1, without
checking the length. A backend that answers with status only leaves that
pointer past the end of the received data, so the walk reads adjacent
slab memory until it meets a NUL. Those bytes reach the kernel log and
the firmware-info debugfs file.

To fix this, print the string with a bounded "%.*s" limited to
skb->len - 1. A short or unterminated response then prints as much as
arrived instead of failing setup.

This mirrors commit dd068ef04412 ("Bluetooth: bpa10x: avoid OOB read of
revision string in bpa10x_setup()"), which fixed the identical pattern.

Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Assisted-by: Claude:claude-opus-4-8
---
v2: shortened the subject to fit the list's 80-character limit
    tightened the message

v1: https://lore.kernel.org/linux-bluetooth/20260715121628.1590321-1-sammiee5311@gmail.com/

 drivers/bluetooth/virtio_bt.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 140ab55c9fc5..c20d54088c8c 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -120,9 +120,13 @@ static int virtbt_setup_zephyr(struct hci_dev *hdev)
 	if (IS_ERR(skb))
 		return PTR_ERR(skb);
 
-	bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
+	/* Bounded print: the backend controls skb->len. */
+	if (skb->len > 1) {
+		int len = skb->len - 1;
 
-	hci_set_fw_info(hdev, "%s", skb->data + 1);
+		bt_dev_info(hdev, "%.*s", len, (char *)(skb->data + 1));
+		hci_set_fw_info(hdev, "%.*s", len, skb->data + 1);
+	}
 
 	kfree_skb(skb);
 	return 0;
-- 
2.43.0

Re: [PATCH] Bluetooth: virtio_bt: avoid OOB read of build info string in virtbt_setup_zephyr()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 15 Jul 2026 21:16:28 +0900 you wrote:
> virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read Build
> Information) and passes the response to bt_dev_info() and hci_set_fw_info()
> as a "%s" string starting at skb->data + 1, without checking the length:
> 
>   bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
>   hci_set_fw_info(hdev, "%s", skb->data + 1);
> 
> [...]

Here is the summary with links:
  - Bluetooth: virtio_bt: avoid OOB read of build info string in virtbt_setup_zephyr()
    https://git.kernel.org/bluetooth/bluetooth-next/c/d264c90ca22e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH v2] Bluetooth: virtio_bt: avoid OOB read of build info string

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 30 Jul 2026 10:57:28 +0900 you wrote:
> The virtbt_setup_zephyr() sends the Zephyr vendor command 0xfc08 (Read
> Build Information) and hands the response to bt_dev_info() and
> hci_set_fw_info() as a "%s" string starting at skb->data + 1, without
> checking the length. A backend that answers with status only leaves that
> pointer past the end of the received data, so the walk reads adjacent
> slab memory until it meets a NUL. Those bytes reach the kernel log and
> the firmware-info debugfs file.
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: virtio_bt: avoid OOB read of build info string
    https://git.kernel.org/bluetooth/bluetooth-next/c/d264c90ca22e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html