From nobody Sat Sep 26 19:35:30 2026 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 81A723E3152 for ; Mon, 31 Aug 2026 09:59:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788170380; cv=none; b=sw0lhkAT907G45K3qHRTocJ0Q5+MpECH0JDsaJ4Pv63Ljb6mff+5ZRSMGlIY+hyDYNdwXYVM+YdRZH6jWG+KFei5MBTsHiLzQ/m20MJNECYGGLfB3jccd9dqDsY7LoQxisXqW8Zb2H9hcakZ2Y9tgsrN5WxjnngRbt8pOLshge8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788170380; c=relaxed/simple; bh=8oIoq3/BxEm7Bcl0GQ8KUIZQgDk0bEzaSgG154+Dchg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GD4YkgSXgTOwiDM/cJOKg4BUi9kHRH3Fh3nAPNFOLrR9ncQchx9vGWXA05iY3SdPiHKm0auqlLAGSxM8ba//2Pt/J41h8t4UUt/t85MGj/9rDNKaKVoAGmepvmrRqdR3JhudDWCC+jPI57xfF3itz/CuhKwXrJVomSlX+jQuJ+Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=OWrVi+6i; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OWrVi+6i" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2d7195706f1so31674385ad.0 for ; Mon, 31 Aug 2026 02:59:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788170379; x=1788775179; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=31EY+ggiKNRoWg2rQDHXLSRikiCKuhKgERxrI2qpU+M=; b=OWrVi+6iXR47cNS6+VM3OlpgOUkXSHfpL0LxGCxDx827Ets3+Nx+Gj/694y/mTrA/Y oz5t4WCnWdDAUriwRym7yvC8K3pzwO2uQmPZlJFXa2CAfG69q7RspsPstfz9d1M95pTJ OJKQNSmTNhQWJ2ZQ124OeX+iFJbKtapca8C/BZiWcPh7PjWtQt3HWWQB4qcqxL3xxExs STcMWzC4N8ob5Ucb17XkxgdZajW06/m3pFnltTLooyys/xLpBBUFXtgPY/o1B3Af72r/ SDHB8+32rrUAZS8kzpgrHjRu/gZdbOgL9/Nz1t85N7STxLMXtiFrR0i5sy7c+jNuyUP2 2dFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788170379; x=1788775179; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=31EY+ggiKNRoWg2rQDHXLSRikiCKuhKgERxrI2qpU+M=; b=AiuG6Ta9Bb9AiTjlV+OCZmvpuKcukD/1h3eTnt+6kOjiunrSWSXGXcxEW1zunEXij7 3iYxGeUk03FtivXSDs2sccYvfwKvPnzdMU1JN/pNxgdcZvyf6PeBxprEL/CcMY62Xiuu 13ac/VqLMHKHwFYp8xVwt2ibkYuvsWkgC+6hWm1NszuIpEE37vdSlIP8foLtCwWYp7EQ XX7rr4jVUfRiTTTE3UhZsXXf7Lr9OvIAr8aUjmqlmLciOYpf5ngSODP/CDYGOUIk17uC ZO+J0iUGEb/Zlf8wWcPljKFN/DTNcJlpIbOTxnWv+7M6HLu3YUqnZhWJRap2IR4zXUhS 1odA== X-Forwarded-Encrypted: i=1; AHgh+RrAcsvcMr5dKNYN+IOBF2rsvZk6jORkz08vqyW2Qb1k3mKklla+eB8rtZL1yURycesm3qRuqPEYGW2FtkU=@vger.kernel.org X-Gm-Message-State: AFuF++mTsawWxjdg+PTuMd8sbuJidniNH4WaRnHxaSyL76wpkDoKUKB1 fmv2B1SE4wumY0fg/PHcBLrkc4EGqMrxNT898pXFZzRcMFQ05HDSjgtg X-Gm-Gg: AYBFou2gARcZXOhUMIbND1K/rL9eCRzEeM5SAXMIb9gEH3G+ttvghowuoXu8BVmRc1S tGfHff7Uf+5gNDINvVe8iUEvCiDqq9T9ENWv17uBQKbB+hYxSk21X2punhzZQ5v7kuu/Jdp0P/s fVNMMML8GitSbo7jrmRQTqzxZ5lDHObLt9CqXs0gmY9SNqALCAOLXAncKljcWPMDnnUecfcHcyT a1iHcYwEGjH5IYIT6jTGak+on0d5T4IgcpmSu4mmHbI6n5UNVjfM5Y7DBxSU3fN5TPB2N/ssID5 akUDMdrIFiUfVTA6b751OO0olZo9Nrzk4YA6odXA7h4NhXXLoGdpvEFntV9D1h26qqb/0rzTW5X rzDdMdy0pnrvbEDW94DMEKHJLON2KWhMN4kiefA9DOpiCu0AHtdsAS/e3JFXmEaJwyUg6xAFh3u vVUnPxAAOSyUFSfOaCVFom1jD2Vp9Xg9bElV3gF3FP0feLEwOq7TjekxpVVaoSWystEZ4yieWWp XiJNYGQ3QZzI43d7R30XWhGRxMUOziC+xIzpzmZRk1KtH3uRGZ7pWmdq1cPCqWgELopEvqVBrpV +3qu30BBM5kYW9ZIdUdTFdKtdxrCnq3GLIArdqtEkSGcp17bP1RPJ3XYE9RbPd4kOIkcXxsGYto gmmZBzJLTyud9l/T94pVOv5FBo/FWm8iUl4jl8JKYdlh0dN0= X-Received: by 2002:a17:902:d2cb:b0:2cc:f5aa:9513 with SMTP id d9443c01a7336-2d93f9f7c7fmr28821375ad.10.1788170378759; Mon, 31 Aug 2026 02:59:38 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d759640becsm32270775ad.36.2026.08.31.02.59.34 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 31 Aug 2026 02:59:38 -0700 (PDT) From: Laxman Acharya Padhya To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org, ali@iusegentoo.com, kiraank@gmail.com, kiran.k@intel.com, ravishankar.srivatsa@intel.com, amit.k.bag@intel.com, Laxman Acharya Padhya Subject: [PATCH v3 1/3] Bluetooth: btintel: validate version TLV value lengths Date: Mon, 31 Aug 2026 15:44:21 +0545 Message-ID: <20260831095923.18830-2-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20260831095923.18830-1-acharyalaxman8848@gmail.com> References: <20260814171503.42684-1-acharyalaxman8848@gmail.com> <20260831095923.18830-1-acharyalaxman8848@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field. Fixes: 57375beef71a ("Bluetooth: btintel: Add infrastructure to read contro= ller information") Reviewed-by: Ali Ahmet Memis Signed-off-by: Laxman Acharya Padhya Tested-by: Kiran K --- drivers/bluetooth/btintel.c | 37 ++++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c index cbeb27033..998c99b17 100644 --- a/drivers/bluetooth/btintel.c +++ b/drivers/bluetooth/btintel.c @@ -573,12 +573,44 @@ int btintel_version_info_tlv(struct hci_dev *hdev, } EXPORT_SYMBOL_GPL(btintel_version_info_tlv); =20 +static u8 btintel_version_tlv_min_len(u8 type) +{ + switch (type) { + case INTEL_TLV_CNVI_TOP: + case INTEL_TLV_CNVR_TOP: + case INTEL_TLV_CNVI_BT: + case INTEL_TLV_CNVR_BT: + case INTEL_TLV_BUILD_NUM: + case INTEL_TLV_GIT_SHA1: + return sizeof(u32); + case INTEL_TLV_DEV_REV_ID: + case INTEL_TLV_TIME_STAMP: + return sizeof(u16); + case INTEL_TLV_IMAGE_TYPE: + case INTEL_TLV_BUILD_TYPE: + case INTEL_TLV_SECURE_BOOT: + case INTEL_TLV_OTP_LOCK: + case INTEL_TLV_API_LOCK: + case INTEL_TLV_DEBUG_LOCK: + case INTEL_TLV_LIMITED_CCE: + case INTEL_TLV_SBE_TYPE: + return sizeof(u8); + case INTEL_TLV_MIN_FW: + return 3; + case INTEL_TLV_OTP_BDADDR: + return sizeof(bdaddr_t); + default: + return 0; + } +} + int btintel_parse_version_tlv(struct hci_dev *hdev, struct intel_version_tlv *version, struct sk_buff *skb) { /* Consume Command Complete Status field */ - skb_pull(skb, 1); + if (!skb_pull(skb, 1)) + return -EINVAL; =20 /* Event parameters contain multiple TLVs. Read each of them * and only keep the required data. Also, it use existing legacy @@ -598,6 +630,9 @@ int btintel_parse_version_tlv(struct hci_dev *hdev, if (skb->len < tlv->len + sizeof(*tlv)) return -EINVAL; =20 + if (tlv->len < btintel_version_tlv_min_len(tlv->type)) + return -EINVAL; + switch (tlv->type) { case INTEL_TLV_CNVI_TOP: version->cnvi_top =3D get_unaligned_le32(tlv->val); --=20 2.51.2 From nobody Sat Sep 26 19:35:30 2026 Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4190F3E3152 for ; Mon, 31 Aug 2026 09:59:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788170385; cv=none; b=vDlfDscPqHpVe8r/T7QYQcUETcRt/nqdcfMzw7ZfZa68VtcTSkTBYyAAAtlvdKWGa13L/8tk1DgCaq2+Kk/USHRSv8so7+eD8QBOraQEpvtrWpj5KnSJgF6w6ay3JceCaU+9DSquxqyv+jrJheGCtxrs283Y3tcP6arxF6eQAO8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788170385; c=relaxed/simple; bh=MzFCtlg7NQAurQZpo0kH6aO7FER+9XzqIwyG0ItL1QY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=k6tNz1HtaTPf17ZyWOTsYJfkBCVN+pvrjjGNEQefPIWMahMaUmD/GpHmd9y7iuvjFVB4PK3KJpWAERiU6cMY48xkIHA5IT84A88LS7rTPVMPVWJQGsAzOFKtF3NGzLiAHU2dfWdgaMP2NNheJUqT97TI+Cpim6d79HOXO9cwLtY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FmnRR0cR; arc=none smtp.client-ip=209.85.214.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FmnRR0cR" Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2ceab75934dso37641805ad.2 for ; Mon, 31 Aug 2026 02:59:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788170383; x=1788775183; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JWug8GNdY5MzAA3B+UQMoRVhKpGdZFi0ogypUl1fSBQ=; b=FmnRR0cRIex16fT5cQKbPdU+e1z3okzFfXGz+VYIIRfRqQmYqqt4MmFXPatjZx880Y kbWYUzSLVo0iH19Uty/972VyppFc6pvepefxo5unQqJnc9T3qVpgPWzfeVhqibAo4lqN FKdz+4I40CFyo/5kZCtkq9vogCd4aIFsHUadfglH7qD5gv6XXHFFSQO3gfDs0eT1B2UO ZCjAo2H267R14AFB6Bv0cr0WkPxrkgdu6U7zAinobXv+LKBxOwooIhM5PY/TWwVYqLDq xNg43j8BE02QtqQqYFV+ZL63Wr/B2V8iBxLtWMoXtgRMj8dk+/5gWzBJKaOquj228/T3 F2TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788170383; x=1788775183; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=JWug8GNdY5MzAA3B+UQMoRVhKpGdZFi0ogypUl1fSBQ=; b=l9IT62D/pcbNyoRqucDfWtApZ/J7dPiwIbBc+FBxrjlBU3Hg6LghoweXpF0cR3gwO4 ashsQoQvzgsiADlT4V24tjXZboYHVJNg4kJFN+WAJ9QcEduDKR00tUe8hjCHAbETzcJr J3gGgKA8XyjERXCubBTS2wHsxHLEmgSPy+mcuH5X2iAnCD61LPf9djlc1yEOIXpuBjOU 8W92duUQKXJQkubRPFXyW57r6rBzK4Y6O7yOM7/8+/0QJNmDzDPkeN1sZMrDbrL7P8Qm /sGMdvS9mMsXSyQ1duzuM/NduU6JvWnyY0Cp1dndczV/wzFFsG1x5lVuhu+ViYqhR4fN 3taQ== X-Forwarded-Encrypted: i=1; AHgh+Ro0LwN9fEfHV3h4Dx5jiwzrvmX9QGA1bdHV/tXYLfm6mA73KzxJsssHE9+tlWvc+4SIj18MtYF8njvmKYc=@vger.kernel.org X-Gm-Message-State: AFuF++nSdBWxk76QbSOs9PMakL56heITbwgVJbX/gjNdN1muvl98hVyZ eqzkpwt3SE93K6A/DBPJPkjSilBIj18AnE1wDxq1xchA9Acy4FM246Q5 X-Gm-Gg: AYBFou09UdtGGZns32NMAO3I+L94ehCMpvBkxov0ZxTmBQUBZnD61d8qx4LXjLROcc9 8PfEtjHTJVzZa1iuSWYAhmnnupoGnRxoo3hdkKtijh2jtNTrSWqc9UOfdW/u3OYuOXoUdJuMFjY 0kFOwldJhDWvI5/I1A+40MCnPK0L4gQ8HUjdQ6u77bNBfBOv5RXdsupjrVqRR3E6wyPMuy8/51+ ejJa+2IU2UlKPlml/8Y5xGf33wzcfPSSoGtS4XTbt+EsHU2FRW1hkbAX6GWtkzn45d2ylyMCyM7 X2Glr4algUKoCAXgu+T2UIqy/7hO6Ha0kiNdAslwPCncn5zv411EmAaUPN6/A3b5JgnZDL7dBYp QNzra5pRBBwksihRHnBotk+ulIr6E5i6eq7byaFGbDautOlSR5u44xfaiCFP7zOdPeHy/pRIHGc GLbknOoEKCJpJu+Y5TUxEpodPn6xQ2nTriUKqV3RMkPTjUFXPt8mb+MveMeCExXrcCx1jmGpfcV aAbgutb7YquuVMZyTECUBwtm3XUoHP/poUweyCPZaPS6yFtXL6f0e3xxcNrdeLRLvnwnUKbWYAN FCNAluXoRPgz1gckk3kGX8T4qfwZmszq3xUyC7+vyyqIKx0H7t/quL0KicJ5++Z3AWVT3xiLal/ JOsCc++Mc2aqfVJ2VpW1ya+jLa9XRks6WZE38gV/XvX5mVkZ+F7wtY1aF0w== X-Received: by 2002:a17:902:e804:b0:2ce:9c48:22d3 with SMTP id d9443c01a7336-2d74df05f9cmr355235905ad.11.1788170383473; Mon, 31 Aug 2026 02:59:43 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d759640becsm32270775ad.36.2026.08.31.02.59.39 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 31 Aug 2026 02:59:43 -0700 (PDT) From: Laxman Acharya Padhya To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org, ali@iusegentoo.com, kiraank@gmail.com, kiran.k@intel.com, ravishankar.srivatsa@intel.com, amit.k.bag@intel.com, Laxman Acharya Padhya Subject: [PATCH v3 2/3] Bluetooth: btintel: bound firmware ID by TLV length Date: Mon, 31 Aug 2026 15:44:22 +0545 Message-ID: <20260831095923.18830-3-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20260831095923.18830-1-acharyalaxman8848@gmail.com> References: <20260814171503.42684-1-acharyalaxman8848@gmail.com> <20260831095923.18830-1-acharyalaxman8848@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response. Limit the conversion to the advertised TLV value length. Fixes: 164c62f958f8 ("Bluetooth: btintel: Add firmware ID to firmware name") Reviewed-by: Ali Ahmet Memis Signed-off-by: Laxman Acharya Padhya Tested-by: Kiran K --- drivers/bluetooth/btintel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c index 998c99b17..887170534 100644 --- a/drivers/bluetooth/btintel.c +++ b/drivers/bluetooth/btintel.c @@ -704,7 +704,7 @@ int btintel_parse_version_tlv(struct hci_dev *hdev, break; case INTEL_TLV_FW_ID: snprintf(version->fw_id, sizeof(version->fw_id), - "%s", tlv->val); + "%.*s", tlv->len, tlv->val); break; default: /* Ignore rest of information */ --=20 2.51.2 From nobody Sat Sep 26 19:35:30 2026 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2BAAA3E451A for ; Mon, 31 Aug 2026 09:59:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788170390; cv=none; b=KUmwTM1vB+vd96Fg5drdCGKz61oJgR469k1w85+fdrd/NeaMufIVQSXUVdQrWi7ie4G1XSaQ3UR0X8oEf3UrxLqLejwswpDgr0FyG/IjyZZOPi2ix6gIriRnaewUYPZF68a2fomkvxtlRX5n2dDoD5MLesW4zDFT5heMxC4efwQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788170390; c=relaxed/simple; bh=lKg7QWSQkaKWdhrt/8jU5HFtGKDAfOSrr1yOX51qu/8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DLjz7CoSbujCNN1hh+FhYVLKZJZcqa+kq8FDQlB0dDzwppOH35E2F+i9AzO5QVJZw6qJI3oloxk4U3j4IEqhx4Dox3T7SUN1tNV+nV92pRSCFBuW8F3Uht6ux/e8QzCMQ2rvIOB4Jyk/dDrWV7J1OGhU6vaoPhcCaxNQBF8sUAA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bnYTqLXW; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bnYTqLXW" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2d560775ca2so22559175ad.1 for ; Mon, 31 Aug 2026 02:59:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788170388; x=1788775188; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+g24sLj9lBZO0873hmeHK2aiHPKKlVEYPXZG2TjfcJg=; b=bnYTqLXWwZI2aBS1Er2KsJK7pD1DHlD2vczNkNlliDYvx9v+S9WsdrzJ88h3Y/ZgDT IvwMiPGlAADNsHqgA0llcTccFIqjnyNJ8z4xlTRVB9Ko9RbFe0cqTGqvIoXT+kHPwCGe 4PSY+RJWxjr9x1U9+lxyQRhDEuHvlWdWnDQBJqfcAMG/eVBJR6UT+Nxpdsqk5W0KcdGb fWEvH84Qs/okWOpa1B4wuohrCUOsSJ3DeZ9ySKxf6TK3tnfAd5XStWGjcZhr1P35FicA nkLKmFQ67Xuqp85OVfprJUhfK7tIUobPHZ6vNYPJnDYSnAtw3hC8spd/zNi3WyN7w8ZH EMug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788170388; x=1788775188; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=+g24sLj9lBZO0873hmeHK2aiHPKKlVEYPXZG2TjfcJg=; b=j7V8GSRt09LogfMnNYvO4eUGefTV4T3X9WpEwTPx42UMOlZCY3iAq5oC199+p4gz3j gSPX/G/JnAMrv2sDBUyR5IdhYwG7OTftvqsSpyIdby4ltGr9EeaIlko446VBzGOFd5HV UmKxrxbds5ypH5SUGiTaI6RbO1kjnIeyCv7T1KXgDWhleInR8t4ufKwx2YZa5qs/1AAm a08Hy+9XJGemETbVca3JJcxckxMEgra4PupMxkyIkljqt/Upa/hDvmZrvxNLAx83OGVx 1f04RLzZNIv3pR80INul1pkBA1hYbfKIXCw5JHngAvI9002GIJUvtoEhGsibZUR5vrW2 +dgA== X-Forwarded-Encrypted: i=1; AHgh+RpTAKTUXmehDsXMEOzq+I+3r89WM42b0RZ0mU2zZiajWqw5Vs5BmiiITCSQ+pG9AbJNhjCH08vTaWMA03c=@vger.kernel.org X-Gm-Message-State: AFuF++kGGWjdNkufHrhqLQEq0idU/5RN01kQ0C0dNBfBFU9u0hk4Q0E7 0NS2LonPi22d7GxuIUDv2MxZxgxQWcj7I+mUunB+MnW6foUNjVC3O1xq X-Gm-Gg: AR+sD12H8uziPKla5o6Lzr3vZVrfsIcynIQeRvjeosfoPqp2kz1ggpq0EqQbKcBmMwU W3Ra0gr1zN9CcUppjED7oHvv9FaObYAMPbtJkgb/Mno5aTaH8gCT6/1NSCBtPgp3fWrmIn20g1h 8ZDzP5bXy+w+zf9Ra38d/cD/snO4EhiRJNm58sVFWMqvQ7iVlJZ2RdGTq2Aq1s6HBdbSGAmvYbx m5YGlqaLtEj9ZstzUVF+YuI1m3+QGDq9K0UpC1LyAVaZ0sJTAl2tjtC6vR0K9DgJLTgNMIznqDb s6IOcOLY09aYDAcjGElkRtRtpm9qCT2Me8DjgblEm//VZ69eNtddb6D2mGGOgGTME1P+KMyLjlO uR9wVJqb8go9DrNCLxGCLgcSxo8q04gj0qYmMFLnfheUwfQWQDCn50ai9Sk4qSOLM6O5+Y6LpqO br5JK0pRtN1kVO3iiKKd1JAgs9JASVAXl5pO0/KO2N2Fex8d4dDZw/2ffNoSImQr3oyW/VuTDQD i/KJAevh9CnWSOqgVR9sMV4PZ08JBXlipIapgpJ6r4ICQbdh9fE1VNMgW7gycs35KeOgohuEqUD nm7qDYLV2Ni6rPG7sO8CkoGfJI/wurCpsyjnCXZ3NVKKfCq+8j1pov51bQm0AUghJKjLwuo/bkq KiupyPmzTqWhlhRJdwjXgQpCZ5Jcl1pDt+0gbOvageGLTa9A= X-Received: by 2002:a17:902:ec82:b0:2d6:3c2f:6a4 with SMTP id d9443c01a7336-2d74df293c5mr315489125ad.13.1788170388180; Mon, 31 Aug 2026 02:59:48 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d759640becsm32270775ad.36.2026.08.31.02.59.43 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 31 Aug 2026 02:59:47 -0700 (PDT) From: Laxman Acharya Padhya To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org, ali@iusegentoo.com, kiraank@gmail.com, kiran.k@intel.com, ravishankar.srivatsa@intel.com, amit.k.bag@intel.com, Laxman Acharya Padhya Subject: [PATCH v3 3/3] Bluetooth: btintel: propagate version TLV parsing errors Date: Mon, 31 Aug 2026 15:44:23 +0545 Message-ID: <20260831095923.18830-4-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20260831095923.18830-1-acharyalaxman8848@gmail.com> References: <20260814171503.42684-1-acharyalaxman8848@gmail.com> <20260831095923.18830-1-acharyalaxman8848@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" btintel_read_version_tlv() ignores the parser return value, so setup continues with partially initialized version data after a malformed TLV causes parsing to stop. Return the parser error to the caller so an invalid response fails setup instead of being treated as successful. Keep this behavioral change separate from the bounds checks so it can be reverted independently if an existing controller sends malformed data. Signed-off-by: Laxman Acharya Padhya Reviewed-by: Ali Ahmet Memis Tested-by: Kiran K --- drivers/bluetooth/btintel.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c index 887170534..964d2de30 100644 --- a/drivers/bluetooth/btintel.c +++ b/drivers/bluetooth/btintel.c @@ -723,6 +723,7 @@ static int btintel_read_version_tlv(struct hci_dev *hde= v, { struct sk_buff *skb; const u8 param[1] =3D { 0xFF }; + int err; =20 if (!version) return -EINVAL; @@ -741,10 +742,10 @@ static int btintel_read_version_tlv(struct hci_dev *h= dev, return -EIO; } =20 - btintel_parse_version_tlv(hdev, version, skb); + err =3D btintel_parse_version_tlv(hdev, version, skb); =20 kfree_skb(skb); - return 0; + return err; } =20 /* ------- REGMAP IBT SUPPORT ------- */ --=20 2.51.2