Bluetooth: btmtk: fix OOB read from short WMT event SKB

From: Tristan Madani <[email protected]>

The WMT event response SKB is cast to typed structs (7, 9, and 18 bytes) without checking that the SKB contains enough data. Short firmware responses cause out-of-bounds reads from SKB tailroom.

Add length validation before each struct access.

---
Note: v2 resubmission -- original sent via Gmail had HTML rendering issues. This version uses git send-email for plain-text formatting.

drivers/bluetooth/btmtk.c | 5 +++++

 1 file changed, 5 insertions(+)

index XXXXXXX..XXXXXXX 100644
@@ -658,6 +658,8 @@ int btmtk_process_wmt_evt(struct btmtk_data *data, struct sk_buff *evt_skb)
 	struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
 
+	if (data->evt_skb->len < sizeof(*wmt_evt))
+		return -EINVAL;
 	wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
 	if (wmt_evt->whdr.op != hdr->op) {
 

@@ -674,6 +676,9 @@ int btmtk_process_wmt_evt(struct btmtk_data *data, struct sk_buff *evt_skb)
 	switch (wmt_evt->whdr.op) {
 	case BTMTK_WMT_FUNC_CTRL:
+		if (data->evt_skb->len < sizeof(*wmt_evt_funcc))
+			return -EINVAL;
+
 		wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
 		if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
 

This is an automated email and please do not reply to this email.

Dear Submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
While preparing the CI tests, the patches you submitted couldn't be applied to the current HEAD of the repository.

----- Output -----

error: corrupt patch at line 28
hint: Use 'git am --show-current-patch' to see the failed patch

Please resolve the issue and submit the patches again.

---
Regards,
Linux Bluetooth