nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

Bluetooth: qca: fix info leak when fetching fw build id

Browse source 
Add the missing sanity checks and move the 255-byte build-id buffer off
the stack to avoid leaking stack data through debugfs in case the
build-info reply is malformed.

Fixes: c0187b0bd3 ("Bluetooth: btqca: Add support to read FW build version for WCN3991 BTSoC")
Cc: stable@vger.kernel.org	# 5.12
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Johan Hovold 2024-05-01 14:34:52 +02:00 committed by Luiz Augusto von Dentz
parent dd336649ba
commit cda0d6a198
2 changed files with 22 additions and 6 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

27
drivers/bluetooth/btqca.c
View file

@ -99,7 +99,8 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)
{ {
struct sk_buff *skb; struct sk_buff *skb;
struct edl_event_hdr *edl; struct edl_event_hdr *edl;
char cmd, build_label[QCA_FW_BUILD_VER_LEN]; char *build_label;
char cmd;
int build_lbl_len, err = 0; int build_lbl_len, err = 0;
bt_dev_dbg(hdev, "QCA read fw build info"); bt_dev_dbg(hdev, "QCA read fw build info");
@ -114,6 +115,11 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)
return err; return err;
} }
if (skb->len < sizeof(*edl)) {
err = -EILSEQ;
goto out;
}
edl = (struct edl_event_hdr *)(skb->data); edl = (struct edl_event_hdr *)(skb->data);
if (!edl) { if (!edl) {
bt_dev_err(hdev, "QCA read fw build info with no header"); bt_dev_err(hdev, "QCA read fw build info with no header");
@ -129,14 +135,25 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)
goto out; goto out;
} }
build_lbl_len = edl->data[0]; if (skb->len < sizeof(*edl) + 1) {
if (build_lbl_len <= QCA_FW_BUILD_VER_LEN - 1) { err = -EILSEQ;
memcpy(build_label, edl->data + 1, build_lbl_len); goto out;
*(build_label + build_lbl_len) = '\0';
} }
build_lbl_len = edl->data[0];
if (skb->len < sizeof(*edl) + 1 + build_lbl_len) {
err = -EILSEQ;
goto out;
}
build_label = kstrndup(&edl->data[1], build_lbl_len, GFP_KERNEL);
if (!build_label)
goto out;
hci_set_fw_info(hdev, "%s", build_label); hci_set_fw_info(hdev, "%s", build_label);
kfree(build_label);
out: out:
kfree_skb(skb); kfree_skb(skb);
return err; return err;

1
drivers/bluetooth/btqca.h
View file

@ -48,7 +48,6 @@
#define get_soc_ver(soc_id, rom_ver) \ #define get_soc_ver(soc_id, rom_ver) \
((le32_to_cpu(soc_id) << 16) | (le16_to_cpu(rom_ver))) ((le32_to_cpu(soc_id) << 16) | (le16_to_cpu(rom_ver)))
#define QCA_FW_BUILD_VER_LEN 255
#define QCA_HSP_GF_SOC_ID 0x1200 #define QCA_HSP_GF_SOC_ID 0x1200
#define QCA_HSP_GF_SOC_MASK 0x0000ff00 #define QCA_HSP_GF_SOC_MASK 0x0000ff00