From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C45A38758C for ; Sat, 25 Jul 2026 08:54:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969701; cv=none; b=fAGd+exwT09ufpwiGOMuqcnIklzfSkIIHSoFlL3Ez/JLB+txZDxPfLJNg8EOnFRryd9VCdwo9q3byiw7LskkNHyMxdMn9ZGHLaavN10Ycf0qFxG3AAqZ9yR8o5HgVtauiTK0BYcljVsebwH+rxGimnYBtZjvhX4pXMxQPA0I4Kk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969701; c=relaxed/simple; bh=Kj5ugJ1eZInHZaFbn92Md+qPPlJdInBfBOXBmblaynE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=A6jRKyYTkpUy8NCBo4yEG3b6qt4d04OTIuQdJyeUNHoyxzPwf9Dc45RuMAePvYV43PP3UIJUQZT6/EbLh1bLj/tEO44inGt5ZdF36l0TpN+GpTvRURR+KFI6cZeJadsxgPjEAz21FSkcpVhW8VYh2Iz+5CR9iUtIRAMUcXBxMSs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=pEb1SDyl; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=caL3DZcF; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="pEb1SDyl"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="caL3DZcF" Received: from pps.filterd (m0279873.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66P4m3Xm939565 for ; Sat, 25 Jul 2026 08:54:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 16Z3omNga/gMPYQsHadNiSPfd8mJyMGRalN1RzeCCMw=; b=pEb1SDylawFEK1MP BmxQB/r65aGFog7uz08pojPQfjRG7BB0IoXWHeS0/CBp1vfXeA8tTrMROqAW3Xj6 /xLkHTcnNAoQnBc0QRY6jwcvkqshsl8aEo7tx37ih47G6tSXVD17rOhNeohQexvR Eo1/UG2VeNnOVvYeZyrpwfeNdAWcIWyaXN05L3g+vkQqTYqr+XZEVNwGUvmLShXp fLh+cabXZ0U6QOG9IRQ3nTyg27vCIKn+rV1JdMf+/RvLsUD667gtE7IY4TWpQkXQ nWu7pNvikJrOB82CLlB0Qsgvm2bJD+FQ33rAsA/WMTVJ3Z9VMMhPvBq5TU0Fw3tN pkl1tA== Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fmjgn0xax-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 25 Jul 2026 08:54:55 +0000 (GMT) Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2ce756aa72eso4236345ad.1 for ; Sat, 25 Jul 2026 01:54:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784969695; x=1785574495; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=16Z3omNga/gMPYQsHadNiSPfd8mJyMGRalN1RzeCCMw=; b=caL3DZcF23p0oDc2JBLVZoxiKbdC/y9fMsjN53/wMIb38RXU+7j7ox/loNo4jP3awy +CtSfWdiAokmGIoUtAVcODXUyvEGQDlwmoYTeiryb4PXTUyGupUFS135gTtrWoM20Cm0 2OwLOjPe4fAXxdxSMda1J4DqB+UdEF5iKFitRv9/GVkQDxjNcIJXbu9zEeSqGg7Zrf8Z D5243gFAHe1YKPUNr1S+0nqkNwIiRoXp4qkDkc4RSDuid3X3c6Usv/UjBFt3TF1vKaqN n2EgxPhCMoiurj88kyZyaFGSFO+YDik1gmiKTukGM0OUCoV/WrB1LhigEAsdWueWpZLD K/Pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784969695; x=1785574495; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=16Z3omNga/gMPYQsHadNiSPfd8mJyMGRalN1RzeCCMw=; b=ZBQsf0pZQ/HgGpjYRHsDwm2cUezPuIHpUuimXoKb9zU/ZZQfEV8b6RZpGYA7lPgWG2 hbJbaERN95wDuxaat6dcno2HvxwEcHDiasCePo1dpBwmn2UgJemoQ13bgKlulbhwJA/a lkiPsr+bvsCdIg/Yg6ZwjXvebSxbOxzUhBH0FiabjIApc7/tyduxB+8hoPcBjxL6vW2G g/6CZwNfF4u6Zi70Ha79+SYstPNuekpAiupvv83nl74lKM0igIVfi4uQK27bjyV6sWA/ p5phk+Frvyug6DgCpCIGGc0R3vnND2YI4zUMkrisH9xmvphcIBTAdl8cbm7uIwZ57Ell 2Qgg== X-Forwarded-Encrypted: i=1; AHgh+RrSEHB+o6wyBZjGk0hx7bWM/evTOuQQYuzxd+km55r5cjl78qpu6ZKevkrz/dirQddT9zf8XYx9U1maAwI=@vger.kernel.org X-Gm-Message-State: AOJu0YwCiJOgyeqKNxYbU9XAVqfSZXNq2nqU48DX56Q/w02kXy20ChGy KV4QPS5bvfNwY3NQGQeZyJW05bGChZ/5FuqP5bDhdKAlLZabNPgBhMNuoXJN54rGad1MoF4G+Pt DlnzQG+5IN2tHpPcnUQAw8xd61DqJeqAikE30t3JO7Hfy6b2+OnHpvhz5uN2lmUgN6e0= X-Gm-Gg: AR+sD11Zh9k0ZArk0qWzxPSnGOffSbUam1+42eyIbpNi+8s2NAiWKeqVxbhs1BicuW9 j+UYEbe5Zqz4e6qDm/ehPLlAb59Qyo1Dt2yZctd06hO3fWOt1yqJAXxPZmlsLWq5klhCNQHS6pn 9RBVXCKrap9IR+KatokOCs71vjWZMdT25jQn7wMnj4k6cH/7CskfpptAE7ETR7AAJzayaJJqgcL Q+t7G61kS0zD1y46JrbWgfGz1f/Esvj1LExHpQmScPXk1lf4iX382d2rQlI6/ONZutfoYHsBnQb hb27+u0l5AZVgYxydvlFFBtKooDpCMRbbO3vk2YCUod1ulEliBj1uFpkf2JPg2MoNn0Q6hEnw26 DcT2nx82MMmcNpgLH2jgckppNrV6Qy042iANRi1spdwgMFIQ= X-Received: by 2002:a17:903:1a03:b0:2c9:ed4a:c3a4 with SMTP id d9443c01a7336-2cfde567b7bmr14045325ad.0.1784969694735; Sat, 25 Jul 2026 01:54:54 -0700 (PDT) X-Received: by 2002:a17:903:1a03:b0:2c9:ed4a:c3a4 with SMTP id d9443c01a7336-2cfde567b7bmr14045215ad.0.1784969694355; Sat, 25 Jul 2026 01:54:54 -0700 (PDT) Received: from hu-zijuhu-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-314bc419c52sm7823000eec.10.2026.07.25.01.54.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 25 Jul 2026 01:54:53 -0700 (PDT) From: Zijun Hu Date: Sat, 25 Jul 2026 01:54:40 -0700 Subject: [PATCH 02/11] Bluetooth: btintel: Validate length before parsing diagnostics TLV Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260725-generic_fix-v1-2-305aec261a19@oss.qualcomm.com> References: <20260725-generic_fix-v1-0-305aec261a19@oss.qualcomm.com> In-Reply-To: <20260725-generic_fix-v1-0-305aec261a19@oss.qualcomm.com> To: Marcel Holtmann , Luiz Augusto von Dentz , Abhishek Pandit-Subedi , Chethan Tumkur Narayan , Manish Mandlik Cc: Zijun Hu , Luiz Augusto von Dentz , linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Zijun Hu X-Mailer: b4 0.15.2 X-Proofpoint-GUID: wNvK3i5Jxtgfi5ZPZXo_oApLP2RrIw3l X-Authority-Analysis: v=2.4 cv=HMHz0Itv c=1 sm=1 tr=0 ts=6a6479df cx=c_pps a=JL+w9abYAAE89/QcEU+0QA==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=rJkE3RaqiGZ5pbrm-msn:22 a=EUspDBNiAAAA:8 a=o-UwCio7QWoOg0g0fS0A:9 a=QEXdDO2ut3YA:10 a=324X-CrmTo6CU4MGRt3R:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI1MDA4MyBTYWx0ZWRfX5GJPU/M1j6LD kxtyDz7T34gLDs34UyEmIjJHT2eXkq4en7Z/Zg3ekpxWSlc/7ZqKvuTF1uio1Qz3Rup86HHybDq GgR+b2I0fpYsNJgOjI24SCFr43EQHsIWQo5tbf8Rbl/UwU82elWAmBm/iYIHdLgA+qgW0QbsuOc PtEjkljFXptmMgfEOuczTF845L/y5vwKJ5jMu4pbD/x0G4n1nvx/LzVeN1arr5fIie9XWZgWAaK 4AymEX5H7vs8PinIWAxk5RsHWjPVzaaM7mttgBYZ1/WpYuO+OGm3tZtBoAChGlkeDOBJJvU4HDO OxLM2uA296s1ReRmHYELiqPkie4xOf0m383/JHD0CrzxbZ+ibl+WaYICuHlM6510widDHSpv9dK txDChUo94gGNPkXKz7G+saB3nT6vdCP+NGWREmxtVE1UBGQhUxg85/LgE31Oaeki7BetYH4V14k nXEtwFi2cI35hnkScZg== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI1MDA4MyBTYWx0ZWRfX7QTgALagdNIT +S25mm1qELl8x8hIxaowEY+61ZrFBaI/HRvJwpE3xFvnxzN6lh1F6XnnPvY2jadu53hkx6sRF+a nq7T//wUPov4/6HEKyU68DztRoaIZdU= X-Proofpoint-ORIG-GUID: wNvK3i5Jxtgfi5ZPZXo_oApLP2RrIw3l X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-25_02,2026-07-24_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 lowpriorityscore=0 impostorscore=0 suspectscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607250083 btintel_diagnostics() accesses tlv->val[0] without first validating that the diagnostics VSE is long enough to contain that field, so may cause reading data beyond the received frame. Fix by validating the length before access. Fixes: af395330abed ("Bluetooth: btintel: Add Intel devcoredump support") Signed-off-by: Zijun Hu --- drivers/bluetooth/btintel.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c index d7baf1b9d852..dbcb3f138477 100644 --- a/drivers/bluetooth/btintel.c +++ b/drivers/bluetooth/btintel.c @@ -3766,16 +3766,19 @@ int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) return 0; } EXPORT_SYMBOL_GPL(btintel_configure_setup); static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) { struct intel_tlv *tlv = (void *)&skb->data[5]; + if (skb->len < 5 + sizeof(*tlv) + sizeof(tlv->val[0])) + goto recv_frame; + /* The first event is always an event type TLV */ if (tlv->type != INTEL_TLV_TYPE_ID) goto recv_frame; switch (tlv->val[0]) { case INTEL_TLV_SYSTEM_EXCEPTION: case INTEL_TLV_FATAL_EXCEPTION: case INTEL_TLV_DEBUG_EXCEPTION: -- 2.34.1