diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2026-07-22 10:18:58 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-07-22 10:18:59 -0700 |
| commit | 9a67bbfe48ee5289a4be3f4020cd542b74122c60 (patch) | |
| tree | c32a61d295682c7880d6887d71d44344e97a4bc8 /drivers | |
| parent | fec15bb3dab0c88dd513a5198173de66f830f289 (diff) | |
| parent | df541cd485ff80a5ddc579d99687bc7506df9851 (diff) | |
| download | linux-9a67bbfe48ee5289a4be3f4020cd542b74122c60.tar.gz linux-9a67bbfe48ee5289a4be3f4020cd542b74122c60.tar.bz2 linux-9a67bbfe48ee5289a4be3f4020cd542b74122c60.zip | |
Merge tag 'for-net-2026-07-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says:
====================
bluetooth pull request for net:
- hci_sync: Protect UUID list traversal
- RFCOMM: Fix session UAF in set_termios
- btusb: validate Realtek vendor event length
* tag 'for-net-2026-07-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
Bluetooth: btusb: validate Realtek vendor event length
Bluetooth: RFCOMM: Fix session UAF in set_termios
Bluetooth: hci_sync: Protect UUID list traversal
====================
Link: https://patch.msgid.link/20260721160240.884274-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/bluetooth/btusb.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 08c0a99a62c5..8f7ed469cac6 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -2782,7 +2782,9 @@ static int btusb_setup_realtek(struct hci_dev *hdev) static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb) { - if (skb->data[0] == HCI_VENDOR_PKT && skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) { + if (skb->len >= HCI_EVENT_HDR_SIZE + 1 && + skb->data[0] == HCI_VENDOR_PKT && + skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) { struct rtk_dev_coredump_hdr hdr = { .code = RTK_DEVCOREDUMP_CODE_MEMDUMP, }; |