[PATCH] Bluetooth: btintel: Bound exception info print to the received length
Ali Ahmet Memis <[email protected]>
| Newsgroups | org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
btintel_hw_error() validates that the Intel exception info response is
exactly 13 bytes, and then prints the 12 bytes following the status byte
with a plain "%s". Nothing validates that those 12 bytes contain a NUL,
so the conversion can run past the end of the received response and into
whatever follows it in the skb.
Bound the conversion to the length that was actually received.
Fixes: 973bb97e5aee ("Bluetooth: btintel: Add generic function for handling hardware errors")
Signed-off-by: Ali Ahmet Memis <[email protected]>
---
drivers/bluetooth/btintel.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index bf567b7c5f00..4112f39f251f 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -288,7 +288,9 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)
goto unlock;
}
- bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
+ /* The exception info field is not guaranteed to be NUL terminated */
+ bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1),
+ (char *)(skb->data + 1));
kfree_skb(skb);
--
2.55.0