This is a note to let you know that I've just added the patch titled
Bluetooth: qca: fix info leak when fetching board id
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
bluetooth-qca-fix-info-leak-when-fetching-board-id.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 0adcf6be1445ed50bfd4a451a7a782568f270197 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro@xxxxxxxxxx>
Date: Wed, 1 May 2024 14:34:53 +0200
Subject: Bluetooth: qca: fix info leak when fetching board id
From: Johan Hovold <johan+linaro@xxxxxxxxxx>
commit 0adcf6be1445ed50bfd4a451a7a782568f270197 upstream.
Add the missing sanity check when fetching the board id to avoid leaking
slab data when later requesting the firmware.
Fixes: a7f8dedb4be2 ("Bluetooth: qca: add support for QCA2066")
Cc: stable@xxxxxxxxxxxxxxx # 6.7
Cc: Tim Jiang <quic_tjiang@xxxxxxxxxxx>
Signed-off-by: Johan Hovold <johan+linaro@xxxxxxxxxx>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/bluetooth/btqca.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -235,6 +235,11 @@ static int qca_read_fw_board_id(struct h
goto out;
}
+ if (skb->len < 3) {
+ err = -EILSEQ;
+ goto out;
+ }
+
*bid = (edl->data[1] << 8) + edl->data[2];
bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid);
Patches currently in stable-queue which might be from johan+linaro@xxxxxxxxxx are
queue-6.6/bluetooth-qca-fix-info-leak-when-fetching-fw-build-id.patch
queue-6.6/bluetooth-qca-fix-info-leak-when-fetching-board-id.patch
queue-6.6/bluetooth-qca-generalise-device-address-check.patch
queue-6.6/bluetooth-qca-add-missing-firmware-sanity-checks.patch
queue-6.6/bluetooth-qca-fix-nvm-configuration-parsing.patch
queue-6.6/bluetooth-qca-fix-wcn3991-device-address-check.patch
queue-6.6/bluetooth-qca-fix-firmware-check-error-path.patch
queue-6.6/bluetooth-qca-fix-invalid-device-address-check.patch
queue-6.6/regulator-core-fix-debugfs-creation-regression.patch
