Sai Teja Aluvala c9c15d4d89 Bluetooth: btintel: validate DDC record lengths ...

Parse DDC record lengths in unsigned storage so 0xFF does not wrap.
Reject records smaller than the mandatory three-byte header, records
exceeding U8_MAX, and records exceeding remaining firmware bytes before
issuing Intel_Write_DDC.

This issue was reported by Claude Mythos.

Fixes: 145f2368c5 ("Bluetooth: btintel: Add Device Configuration support")
Signed-off-by: Sai Teja Aluvala <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>

2026-09-23 09:32:38 -04:00

..

ath3k.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

bcm203x.c

…

bfusb.c

Bluetooth: bfusb: validate received block boundaries

2026-08-07 12:36:22 -04:00

bpa10x.c

Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

2026-07-06 10:46:58 -04:00

btbcm.c

Bluetooth: btbcm: Add entry for BCM4343A2 UART Bluetooth

2026-04-10 10:22:21 -04:00

btbcm.h

…

btintel_pcie.c

Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

2026-09-23 09:29:54 -04:00

btintel_pcie.h

Bluetooth: btintel_pcie: split coredump worker into per-trigger works

2026-08-07 12:35:01 -04:00

btintel.c

Bluetooth: btintel: validate DDC record lengths

2026-09-23 09:32:38 -04:00

btintel.h

Bluetooth: btintel: Add Bluetooth SAR revision 2 support

2026-08-07 15:38:32 -04:00

btmrvl_debugfs.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

btmrvl_drv.h

…

btmrvl_main.c

Bluetooth: btmrvl: fix event packet length validation

2026-08-07 15:39:06 -04:00

btmrvl_sdio.c

Bluetooth: btmrvl_sdio: Do not free HCI_VENDOR_PKT frame by hci_recv_frame()

2026-08-07 15:38:31 -04:00

btmrvl_sdio.h

…

btmtk.c

Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events

2026-09-15 14:54:48 -04:00

btmtk.h

Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware

2026-09-08 17:11:42 -04:00

btmtksdio.c

Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown

2026-09-15 14:55:01 -04:00

btmtkuart.c

Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access

2026-09-15 14:54:54 -04:00

btnxpuart.c

Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

2026-09-16 13:32:24 -04:00

btqca.c

Bluetooth: btqca: Simplify qca_send_reset() by using __hci_reset_sync()

2026-08-07 12:31:15 -04:00

btqca.h

Bluetooth: qca: add WCN3950 support

2025-03-25 12:42:35 -04:00

btqcomsmd.c

Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

2026-09-08 17:13:54 -04:00

btrsi.c

Bluetooth: btrsi: Move set_bt_context after successful HCI registration

2026-08-07 15:38:30 -04:00

btrtl.c

Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

2026-09-08 17:04:10 -04:00

btrtl.h

…

btsdio.c

Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap

2025-07-16 15:37:53 -04:00

btusb.c

Bluetooth: btusb: fix NXP IW610 composite device handling

2026-09-15 14:26:10 -04:00

hci_ag6xx.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_aml.c

Bluetooth: hci_aml: validate firmware segment lengths

2026-08-07 15:38:32 -04:00

hci_ath.c

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

2026-05-06 16:21:43 -04:00

hci_bcm4377.c

Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378

2026-08-24 13:10:49 -04:00

hci_bcm.c

Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative

2026-08-24 13:04:03 -04:00

hci_bcsp.c

Bluetooth: hci_bcsp: validate received packet lengths

2026-08-07 15:38:29 -04:00

hci_h4.c

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

2026-05-06 16:21:43 -04:00

hci_h5.c

Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative

2026-08-24 13:04:11 -04:00

hci_intel.c

Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative

2026-08-24 13:04:18 -04:00

hci_ldisc.c

Bluetooth: hci_uart: Fix false success return in hci_uart_setup()

2026-08-24 13:13:20 -04:00

hci_ll.c

Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x

2026-04-13 09:19:42 -04:00

hci_mrvl.c

Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()

2026-08-31 14:05:27 -04:00

hci_nokia.c

Bluetooth: hci_nokia: validate firmware packet bounds

2026-08-07 12:33:41 -04:00

hci_qca.c

Bluetooth: hci_qca: Do not write to the serial port after it is closed

2026-09-15 14:52:19 -04:00

hci_serdev.c

Bluetooth: hci_uart: Fix false success return in hci_uart_setup()

2026-08-24 13:13:20 -04:00

hci_uart.h

Bluetooth: fix corruption in h4_recv_buf() after cleanup

2025-10-24 10:31:24 -04:00

hci_vhci.c

Bluetooth: vhci: validate devcoredump state before side effects

2026-06-11 14:24:41 -04:00

Kconfig

bluetooth: remove all PCMCIA drivers

2026-06-11 14:24:38 -04:00

Makefile

Bluetooth: enable context analysis

2026-08-07 12:27:20 -04:00

virtio_bt.c

Bluetooth: virtio_bt: avoid OOB read of build info string

2026-08-07 15:38:32 -04:00