syz test

Arnaud Lecomte
2025-04-23T11:20:40Z

#syz test

--- a/net/bluetooth/coredump.c
+++ b/net/bluetooth/coredump.c
@@ -249,6 +249,11 @@ static void hci_devcd_dump(struct hci_dev *hdev)

size = hdev->dump.tail - hdev->dump.head;

+ if (size >SKB_MAX_ALLOC) {
+ bt_dev_err(hdev, "Dump too large (%u bytes)", size);
+ return;
+ }
+
/* Emit a devcoredump with the available data */
dev_coredumpv(&hdev->dev, hdev->dump.head, size, GFP_KERNEL);

--