[PATCH] Bluetooth: btintel: Bound exception info print to the received length

[PATCH] Bluetooth: btintel: Bound exception info print to the received length

[Ali Ahmet Memis]

btintel_hw_error() validates that the Intel exception info response is
exactly 13 bytes, and then prints the 12 bytes following the status byte
with a plain "%s". Nothing validates that those 12 bytes contain a NUL,
so the conversion can run past the end of the received response and into
whatever follows it in the skb.

Bound the conversion to the length that was actually received.

Fixes: 973bb97e5aee ("Bluetooth: btintel: Add generic function for handling hardware errors")
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
---
 drivers/bluetooth/btintel.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index bf567b7c5f00..4112f39f251f 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -288,7 +288,9 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)
 		goto unlock;
 	}
 
-	bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
+	/* The exception info field is not guaranteed to be NUL terminated */
+	bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1),
+		   (char *)(skb->data + 1));
 
 	kfree_skb(skb);
 
-- 
2.55.0

Re: [PATCH] Bluetooth: btintel: Bound exception info print to the received length

[Paul Menzel]

Dear Ali,


Thank you for your patch.

Am 14.08.26 um 10:01 schrieb Ali Ahmet Memis:
> btintel_hw_error() validates that the Intel exception info response is
> exactly 13 bytes, and then prints the 12 bytes following the status byte
> with a plain "%s". Nothing validates that those 12 bytes contain a NUL,
> so the conversion can run past the end of the received response and into
> whatever follows it in the skb.
> 
> Bound the conversion to the length that was actually received.
> 
> Fixes: 973bb97e5aee ("Bluetooth: btintel: Add generic function for handling hardware errors")
> Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
> ---
>   drivers/bluetooth/btintel.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
> index bf567b7c5f00..4112f39f251f 100644
> --- a/drivers/bluetooth/btintel.c
> +++ b/drivers/bluetooth/btintel.c
> @@ -288,7 +288,9 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)
>   		goto unlock;
>   	}
>   
> -	bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
> +	/* The exception info field is not guaranteed to be NUL terminated */
> +	bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1),
> +		   (char *)(skb->data + 1));
>   
>   	kfree_skb(skb);

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul


PS: gemini/gemini-3.1-pro-preview found also other occurrences [1].


[1]: 
https://sashiko.dev/#/patchset/20260814080123.902388-1-ali%40iusegentoo.com