Bluetooth: qca: fix info leak when fetching board id
commit0adcf6be14
upstream. Add the missing sanity check when fetching the board id to avoid leaking slab data when later requesting the firmware. Fixes:a7f8dedb4b
("Bluetooth: qca: add support for QCA2066") Cc: stable@vger.kernel.org # 6.7 Cc: Tim Jiang <quic_tjiang@quicinc.com> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
1796f7a9ae
commit
f30c37cb45
|
@ -235,6 +235,11 @@ static int qca_read_fw_board_id(struct hci_dev *hdev, u16 *bid)
|
|||
goto out;
|
||||
}
|
||||
|
||||
if (skb->len < 3) {
|
||||
err = -EILSEQ;
|
||||
goto out;
|
||||
}
|
||||
|
||||
*bid = (edl->data[1] << 8) + edl->data[2];
|
||||
bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid);
|
||||
|
||||
|
|
Loading…
Reference in New Issue