Bluetooth: btintel: security fixes

Three small, independent fixes found by an internal audit of the Intel Bluetooth drivers:

1. btintel: bound the "Exception info" print, which reads past a controller-supplied buffer that is not NUL-terminated.
2. btintel_pcie: widen plen to u32 so HDR_SIZE + dlen cannot wrap and defeat the RX length check.
3. btintel_pcie: reject TX packets larger than the DMA buffer before they reach the memcpy() in the TX submit path.

All three pass checkpatch --strict.

Chandrashekar Devegowda (3):
Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
Bluetooth: btintel_pcie: fix plen overflow in
btintel_pcie_recv_frame()
Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

 drivers/bluetooth/btintel.c      |  3 ++-
 drivers/bluetooth/btintel_pcie.c | 12 +++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

base-commit: 06d991977eeff5d51327e1e64889e70658e8f7ff

2.43.0

The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end.

Bound the print with "%.*s" and skb->len - 1.

---
 drivers/bluetooth/btintel.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 5e6d1ddc99c6..12bf795db84e 100644
@@ -290,7 +290,8 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)
 		goto unlock;
 	}
 
-	bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
+	bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1),
+		   (char *)(skb->data + 1));
 
 	kfree_skb(skb);
 

2.43.0

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1171032/

---Test result---

Test Summary:

CheckPatch                    PASS      2.08 seconds
VerifyFixes                   PASS      0.11 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       PASS      0.98 seconds
SubjectPrefix                 PASS      0.33 seconds
BuildKernel                   PASS      28.35 seconds
CheckAllWarning               PASS      32.16 seconds
CheckSparse                   PASS      35.56 seconds
BuildKernel32                 PASS      29.98 seconds
CheckKernelLLVM               PASS      35.27 seconds
TestRunnerSetup               PASS      760.21 seconds
IncrementalBuild              PASS      30.85 seconds

https://github.com/bluez/bluetooth-next/pull/812

---
Regards,
Linux Bluetooth

plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet.

Widen plen to u32 so the addition cannot wrap.

---
 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 444cc50174fb..734ff8f6363f 100644
@@ -2163,7 +2163,7 @@ static int btintel_pcie_recv_frame(struct btintel_pcie_data *data,
 {
 	int ret;
 	u8 pkt_type;
-	u16 plen;
+	u32 plen;
 	u32 pcie_pkt_type;
 	void *pdata;
 	struct hci_dev *hdev = data->hdev;

2.43.0

btintel_pcie_send_frame() eventually copies skb->data into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer.

Reject packets larger than
BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN on entry.

---
 drivers/bluetooth/btintel_pcie.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

index 734ff8f6363f..01278ff62ffd 100644
@@ -3235,6 +3235,16 @@ static int btintel_pcie_send_frame(struct hci_dev *hdev,
 	if (test_bit(BTINTEL_PCIE_RECOVERY_IN_PROGRESS, &data->flags))
 		return -ENODEV;
 
+	/* Account for the 4-byte PCIe type header prepended before the
+	 * DMA copy.  Written as a subtraction to avoid wrap-around on
+	 * attacker-controlled skb->len.
+	 */
+	if (skb->len > BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN) {
+		bt_dev_err(hdev, "Packet too large: %u > %u", skb->len,
+			   BTINTEL_PCIE_BUFFER_SIZE - BTINTEL_PCIE_HCI_TYPE_LEN);
+		return -EMSGSIZE;
+	}
+
 	/* Due to the fw limitation, the type header of the packet should be
 	 * 4 bytes unlike 1 byte for UART. In UART, the firmware can read
 	 * the first byte to get the packet type and redirect the rest of data

2.43.0