imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-10-28 12:53:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: hci_nokia: validate firmware packet bounds

Browse Source 
nokia_setup_fw() walks a length-prefixed firmware stream and
decodes HCI command packets from each record.

Check that each record fits in the remaining firmware image, that command
records contain the HCI command header, and that the payload length is
covered before submitting the command.

Signed-off-by: Pengpeng Hou <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
This commit is contained in:
Pengpeng Hou authored and Luiz Augusto von Dentz committed 2026-08-07 12:33:41 -04:00
1 parent dc16388d45
commit 45640627e3
1 file changed
+20
Download Patch File Download Diff File Expand all files Collapse all files
drivers/bluetooth/hci_nokia.c
+20
View File
@@ -354,9 +354,29 @@ static int nokia_setup_fw(struct hci_uart *hu)
u16 opcode;
struct sk_buff *skb;
if (pkt_size > fw_size - 2) {
err = -EINVAL;
dev_err(dev, "%s: Malformed firmware packet\n",
hu->hdev->name);
goto done;
}
switch (pkt_type) {
case HCI_COMMAND_PKT:
if (pkt_size < 1 + HCI_COMMAND_HDR_SIZE) {
err = -EINVAL;
dev_err(dev, "%s: Malformed firmware command\n",
hu->hdev->name);
goto done;
}
cmd = (struct hci_command_hdr *)(fw_ptr + 3);
if (cmd->plen > pkt_size - 1 - HCI_COMMAND_HDR_SIZE) {
err = -EINVAL;
dev_err(dev, "%s: Truncated firmware command\n",
hu->hdev->name);
goto done;
}
opcode = le16_to_cpu(cmd->opcode);
skb = __hci_cmd_sync(hu->hdev, opcode, cmd->plen,