Bluetooth: qca: fix info leak when fetching board id

Add the missing sanity check when fetching the board id to avoid leaking
slab data when later requesting the firmware.

Fixes: a7f8dedb4be2 ("Bluetooth: qca: add support for QCA2066")
Cc: stable@vger.kernel.org	# 6.7
Cc: Tim Jiang <quic_tjiang@quicinc.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
index 664db524b1dd496fa0ba27f65f912dcb837d183b..8d8a664620a360c1a07b9329e69d0c3d529a9d32 100644 (file)
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -252,6 +252,11 @@ static int qca_read_fw_board_id(struct hci_dev *hdev, u16 *bid)
                goto out;
        }
 
+       if (skb->len < 3) {
+               err = -EILSEQ;
+               goto out;
+       }
+
        *bid = (edl->data[1] << 8) + edl->data[2];
        bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid);