Bluetooth: btintel: security fixes
Status from this message: This series was applied to bluetooth/bluetooth-next.git (master)
Get series with b4
b4 am [email protected]Versions newest first
Patches in v1 All 3 applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/3 | Bluetooth: btintel: fix buffer over-read in btintel_hw_error()drivers/ | +2 | 1 reply | Applied |
| 2/3 | Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()drivers/ | +1 | 0 replies | Applied |
| 3/3 | Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()drivers/ | +10 | 0 replies | Applied |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH v1 0/3] Bluetooth: btintel: security fixes
Three small, independent fixes found by an internal audit of the Intel Bluetooth drivers:
1. btintel: bound the "Exception info" print, which reads past a controller-supplied buffer that is not NUL-terminated.
2. btintel_pcie: widen plen to u32 so HDR_SIZE + dlen cannot wrap and defeat the RX length check.
3. btintel_pcie: reject TX packets larger than the DMA buffer before they reach the memcpy() in the TX submit path.
All three pass checkpatch --strict.
Chandrashekar Devegowda (3):
Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
Bluetooth: btintel_pcie: fix plen overflow in
btintel_pcie_recv_frame()
Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
drivers/bluetooth/btintel.c | 3 ++- drivers/bluetooth/btintel_pcie.c | 12 +++++++++++- 2 files changed, 13 insertions(+), 2 deletions(-)
base-commit: 06d991977eeff5d51327e1e64889e70658e8f7ff
Signature · 1 line
2.43.0