diff options
| author | Laxman Acharya Padhya <acharyalaxman8848@gmail.com> | 2026-07-10 23:10:03 +0545 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-07-13 10:08:06 -0400 |
| commit | 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 (patch) | |
| tree | fd4fee8674c213b0f5230a2e850de791893d9bd8 /tools/perf/scripts/python/stackcollapse.py | |
| parent | 2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e (diff) | |
Bluetooth: btrtl: validate firmware patch bounds
rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
firmware version. A malformed firmware patch shorter than the version field
can make this subtraction underflow and turn the copy into an oversized
read and write during Bluetooth setup.
The existing patch_offset + patch_length check can also wrap on 32-bit
architectures. Validate the patch length and range without arithmetic
overflow before allocating or copying the patch.
Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions