Bluetooth: virtio_bt: clamp rx length before skb_put

virtbt_rx_work() calls skb_put(skb, len) where len comes directly
from virtqueue_get_buf() with no validation against the buffer we
posted to the device. The RX skb is allocated in virtbt_add_inbuf()
and exposed to virtio as exactly 1000 bytes via sg_init_one().

Checking len against skb_tailroom(skb) is not sufficient because
alloc_skb() can leave more tailroom than the 1000 bytes actually
handed to the device. A malicious or buggy backend can therefore
report used.len between 1001 and skb_tailroom(skb), causing skb_put()
to include uninitialized kernel heap bytes that were never written by
the device.

The same path also accepts len == 0, in which case skb_put(skb, 0)
leaves the skb empty but virtbt_rx_handle() still reads the pkt_type
byte from skb->data, consuming uninitialized memory.

Define VIRTBT_RX_BUF_SIZE once and reuse it in alloc_skb() and
sg_init_one(), and gate virtbt_rx_work() on that same constant so
the bound checked matches the buffer actually exposed to the device.
Reject used.len == 0 in the same gate so an empty completion can
no longer reach virtbt_rx_handle().

Use bt_dev_err_ratelimited() because the length value comes from an
untrusted backend that can otherwise flood the kernel log.

Same class of bug as commit c04db81cd028 ("net/9p: Fix buffer
overflow in USB transport layer"), which hardened the USB 9p
transport against unchecked device-reported length.

Fixes: 160fbcf3bfb9 ("Bluetooth: virtio_bt: Use skb_put to set length")
Cc: stable@vger.kernel.org
Cc: Soenke Huster <soenke.huster@eknoes.de>
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 76d61af8a275e9aeeb444e6a7556d5d8b25e6761..2c5c39356a1c8121e46f1fb34d0bf7324741a0f4 100644 (file)
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -12,6 +12,7 @@
 #include <net/bluetooth/hci_core.h>
 
 #define VERSION "0.1"
+#define VIRTBT_RX_BUF_SIZE 1000
 
 enum {
        VIRTBT_VQ_TX,
@@ -33,11 +34,11 @@ static int virtbt_add_inbuf(struct virtio_bluetooth *vbt)
        struct sk_buff *skb;
        int err;
 
-       skb = alloc_skb(1000, GFP_KERNEL);
+       skb = alloc_skb(VIRTBT_RX_BUF_SIZE, GFP_KERNEL);
        if (!skb)
                return -ENOMEM;
 
-       sg_init_one(sg, skb->data, 1000);
+       sg_init_one(sg, skb->data, VIRTBT_RX_BUF_SIZE);
 
        err = virtqueue_add_inbuf(vq, sg, 1, skb, GFP_KERNEL);
        if (err < 0) {
@@ -227,8 +228,15 @@ static void virtbt_rx_work(struct work_struct *work)
        if (!skb)
                return;
 
-       skb_put(skb, len);
-       virtbt_rx_handle(vbt, skb);
+       if (!len || len > VIRTBT_RX_BUF_SIZE) {
+               bt_dev_err_ratelimited(vbt->hdev,
+                                      "rx reply len %u outside [1, %u]\n",
+                                      len, VIRTBT_RX_BUF_SIZE);
+               kfree_skb(skb);
+       } else {
+               skb_put(skb, len);
+               virtbt_rx_handle(vbt, skb);
+       }
 
        if (virtbt_add_inbuf(vbt) < 0)
                return;