diff options
| author | Kiran K <kiran.k@intel.com> | 2026-10-08 19:36:01 +0530 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-10-14 14:38:25 -0400 |
| commit | cf87709d7ff83b4de5d42b61e4a9806fe374cb9d (patch) | |
| tree | fceeac7a3e6166750043d5e467ddbd1a429fa2be /drivers | |
| parent | 64aabf94ecccb1120a63b4ee5a6761871a181a41 (diff) | |
Bluetooth: btintel: Zero version data before parsing TLVs
Firmware may omit optional TLVs, leaving their corresponding fields
unset in the caller-supplied struct intel_version_tlv. Since the
structure is typically stack-allocated and not cleared beforehand,
fields for which no TLV is received retain uninitialized stack
memory. This stale data can be logged via btintel_version_info_tlv()
and copied back to the caller, leaking kernel stack contents.
Clear the structure in btintel_read_version_tlv() before parsing so
that fields with no corresponding TLV are deterministically zero
instead of containing garbage.
Fixes: 57375beef71a ("Bluetooth: btintel: Add infrastructure to read controller information")
Signed-off-by: Kiran K <kiran.k@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/bluetooth/btintel.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c index f298c91f4f4e..c4a6b5ea64f1 100644 --- a/drivers/bluetooth/btintel.c +++ b/drivers/bluetooth/btintel.c @@ -752,6 +752,7 @@ static int btintel_read_version_tlv(struct hci_dev *hdev, return -EIO; } + memset(version, 0, sizeof(*version)); err = btintel_parse_version_tlv(hdev, version, skb); kfree_skb(skb); |