Bluetooth: btmtk: validate WMT event SKB length before struct access

btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to
struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc
(9 bytes) without first checking that the SKB contains enough data.
A short firmware response causes out-of-bounds reads from SKB tailroom.

Use skb_pull_data() to validate and advance past the base WMT event
header. For the FUNC_CTRL case, pull the additional status field bytes
before accessing them.

Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 6fb6ca2748086ea43454d67d7a06255532241576..f70c1b0f8990356a575551b9e50a32ad9588b554 100644 (file)
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -695,8 +695,13 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
        if (data->evt_skb == NULL)
                goto err_free_wc;
 
-       /* Parse and handle the return WMT event */
-       wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
+       wmt_evt = skb_pull_data(data->evt_skb, sizeof(*wmt_evt));
+       if (!wmt_evt) {
+               bt_dev_err(hdev, "WMT event too short (%u bytes)",
+                          data->evt_skb->len);
+               err = -EINVAL;
+               goto err_free_skb;
+       }
        if (wmt_evt->whdr.op != hdr->op) {
                bt_dev_err(hdev, "Wrong op received %d expected %d",
                           wmt_evt->whdr.op, hdr->op);
@@ -712,6 +717,12 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
                        status = BTMTK_WMT_PATCH_DONE;
                break;
        case BTMTK_WMT_FUNC_CTRL:
+               if (!skb_pull_data(data->evt_skb,
+                                  sizeof(wmt_evt_funcc->status))) {
+                       err = -EINVAL;
+                       goto err_free_skb;
+               }
+
                wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
                if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
                        status = BTMTK_WMT_ON_DONE;