[PW_SID:1082469] [v3] Bluetooth: hci_bcm4377: validate firmware event length in completion ring#99
[PW_SID:1082469] [v3] Bluetooth: hci_bcm4377: validate firmware event length in completion ring#99BluezTestBot wants to merge 1 commit intoworkflowfrom
Conversation
…ring The firmware-controlled entry->len is used as the memcpy size for inline payload data without bounds checking when the PAYLOAD_MAPPED flag is not set. This causes out-of-bounds reads from the completion ring DMA memory for the HCI_D2H and SCO_D2H transfer rings. Add a length validation against the completion ring payload_size. Fixes: 8a06127 ("Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
IncrementalBuild |
1 participant
From: Tristan Madani tristan@talencesecurity.com
The firmware-controlled entry->len is used as the memcpy size for inline
payload data without bounds checking when the PAYLOAD_MAPPED flag is not
set. This causes out-of-bounds reads from the completion ring DMA memory
for the HCI_D2H and SCO_D2H transfer rings.
Add a length validation against the completion ring payload_size.
Fixes: 8a06127 ("Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani tristan@talencesecurity.com
drivers/bluetooth/hci_bcm4377.c | 7 +++++++
1 file changed, 7 insertions(+)