diff options
| author | Li Qiang <liqiang01@kylinos.cn> | 2026-07-16 16:47:31 +0800 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-08-07 15:38:30 -0400 |
| commit | 0fdb6ca821170c0c80a42b7dcb34cc75b55c2f1b (patch) | |
| tree | aaa4b27388ce784035852556fc56c781cdf65768 /drivers/bluetooth | |
| parent | ceea75ad8925425ee6520ead964b55888fe871ec (diff) | |
Bluetooth: hci_ldisc: reject invalid tty write lengths
The HCI UART write worker assumes that a tty write callback returns a
value in the range from zero through the skb length. A negative value or
a value larger than the skb length is passed to accounting and skb_pull,
which can corrupt skb state.
Treat either return value as a transmit error and discard the skb.
Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'drivers/bluetooth')
| -rw-r--r-- | drivers/bluetooth/hci_ldisc.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index 2ad42c3bbaac..46dfbe6f1c2e 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -163,6 +163,12 @@ restart: set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); len = tty->ops->write(tty, skb->data, skb->len); + if (len < 0 || len > skb->len) { + hdev->stat.err_tx++; + kfree_skb(skb); + continue; + } + hdev->stat.byte_tx += len; skb_pull(skb, len); |