[PATCH] Bluetooth: btmrvl: fix event packet length validation

[PATCH] Bluetooth: btmrvl: fix event packet length validation

[Marek Szyprowski]

The event length validation added by 75e574f6a212 commit used a single
check against sizeof(*event), which assumed every event type uses the
maximum payload size. Unfortunately event packet length depends on the
type of the received event, so it must be checked separately for each
event type to avoid rejecting some known well-formed events.

Fixes: 75e574f6a212 ("Bluetooth: btmrvl: validate event packet lengths")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
---
 drivers/bluetooth/btmrvl_main.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index aaf1614ccfd7..e25930351f64 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -81,7 +81,7 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 	struct btmrvl_event *event;
 	int ret = 0;
 
-	if (skb->len < sizeof(*event))
+	if (skb->len <= offsetof(typeof(*event), data[0]))
 		return -EINVAL;
 
 	event = (struct btmrvl_event *) skb->data;
@@ -93,6 +93,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 
 	switch (event->data[0]) {
 	case BT_EVENT_AUTO_SLEEP_MODE:
+		if (skb->len <= offsetof(typeof(*event), data[2]))
+			return -EINVAL;
 		if (!event->data[2]) {
 			if (event->data[1] == BT_PS_ENABLE)
 				adapter->psmode = 1;
@@ -106,6 +108,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_HOST_SLEEP_CONFIG:
+		if (skb->len <= offsetof(typeof(*event), data[3]))
+			return -EINVAL;
 		if (!event->data[3])
 			BT_DBG("gpio=%x, gap=%x", event->data[1],
 							event->data[2]);
@@ -114,6 +118,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_HOST_SLEEP_ENABLE:
+		if (skb->len <= offsetof(typeof(*event), data[1]))
+			return -EINVAL;
 		if (!event->data[1]) {
 			adapter->hs_state = HS_ACTIVATED;
 			if (adapter->psmode)
@@ -126,6 +132,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_MODULE_CFG_REQ:
+		if (skb->len <= offsetof(typeof(*event), data[2]))
+			return -EINVAL;
 		if (priv->btmrvl_dev.sendcmdflag &&
 				event->data[1] == MODULE_BRINGUP_REQ) {
 			BT_DBG("EVENT:%s",
@@ -143,6 +151,8 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
 		break;
 
 	case BT_EVENT_POWER_STATE:
+		if (skb->len <= offsetof(typeof(*event), data[1]))
+			return -EINVAL;
 		if (event->data[1] == BT_PS_SLEEP)
 			adapter->ps_state = PS_SLEEP;
 		BT_DBG("EVENT:%s",
-- 
2.43.0

Re: [PATCH] Bluetooth: btmrvl: fix event packet length validation

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue,  4 Aug 2026 11:46:30 +0200 you wrote:
> The event length validation added by 75e574f6a212 commit used a single
> check against sizeof(*event), which assumed every event type uses the
> maximum payload size. Unfortunately event packet length depends on the
> type of the received event, so it must be checked separately for each
> event type to avoid rejecting some known well-formed events.
> 
> Fixes: 75e574f6a212 ("Bluetooth: btmrvl: validate event packet lengths")
> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
> 
> [...]

Here is the summary with links:
  - Bluetooth: btmrvl: fix event packet length validation
    https://git.kernel.org/bluetooth/bluetooth-next/c/d56d51cc0cb6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html