diff options
| author | Kiran K <kiran.k@intel.com> | 2026-09-03 20:21:01 +0530 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-09-08 17:05:28 -0400 |
| commit | 6436e1b5331b1aebf905c13e0880a37032719b75 (patch) | |
| tree | d47f99e6a123f74b6e963123b7b4ca86abb4d245 /tools/lib/python | |
| parent | 83e3e515fd261600ed8491fb0a8bcdfb115c904e (diff) | |
Bluetooth: btintel_pcie: validate packet_len before skb_put_data
btintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without
checking if it exceeds the RX buffer size. An oversized packet_len
can lead to an out-of-bounds read in skb_put_data().
Validate packet_len to ensure it is non-zero and does not exceed
BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr), logging an error when
invalid.
This issue was reported by Claude Mythos. It can be simulated either by
using customized firmware configured to return an invalid packet_len or
by modifying rfh_hdr->packet_len in the driver before calling
btintel_pcie_submit_rx_work().
Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Signed-off-by: Kiran K <kiran.k@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions