En-Wei Wu feb6bde1a3 Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling ...

[ Upstream commit 4bcb0c7dc25446b99fc7a8fa2a143d69f3314162 ]

Use skb_pull() and skb_pull_data() to safely parse QCA dump packets.

This avoids direct pointer math on skb->data, which could lead to
invalid access if the packet is shorter than expected.

Fixes: 20981ce2d5 ("Bluetooth: btusb: Add WCN6855 devcoredump support")
Signed-off-by: En-Wei Wu <en-wei.wu@canonical.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-06-04 14:42:18 +02:00

..

ath3k.c

Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl

2024-06-27 13:49:02 +02:00

bcm203x.c

Bluetooth: bcm203x: remove superfluous header files

2022-03-18 17:12:09 +01:00

bfusb.c

Bluetooth: bfusb: fix division by zero in send path

2021-10-25 15:04:46 +02:00

bluecard_cs.c

Bluetooth: Use fallthrough pseudo-keyword

2020-07-10 19:09:42 +02:00

bpa10x.c

Bluetooth: bpa10x: change return value

2019-09-04 16:11:46 +02:00

bt3c_cs.c

Bluetooth: bt3c_cs: Fix obsolete function

2018-09-27 12:57:39 +02:00

btbcm.c

Bluetooth: btbcm: add default address for BCM43430A1

2023-08-11 11:50:05 -07:00

btbcm.h

Bluetooth: hci_bcm: Add support for FW loading in autobaud mode

2022-07-21 17:04:38 -07:00

btintel.c

Bluetooth: btintel: Direct exception event to bluetooth stack

2024-11-22 15:38:32 +01:00

btintel.h

Bluetooth: btintel: Send new command for PPAG

2023-08-24 12:23:26 -07:00

btmrvl_debugfs.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE

2022-06-10 14:51:36 +02:00

btmrvl_drv.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE

2022-06-10 14:51:36 +02:00

btmrvl_main.c

Bluetooth: HCI: Remove HCI_AMP support

2024-06-12 11:11:55 +02:00

btmrvl_sdio.c

Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()

2024-10-10 11:57:16 +02:00

btmrvl_sdio.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE

2022-06-10 14:51:36 +02:00

btmtk.c

Bluetooth: btmtk: avoid UAF in btmtk_process_coredump

2024-12-19 18:11:34 +01:00

btmtk.h

Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922

2024-04-13 13:07:33 +02:00

btmtksdio.c

Bluetooth: btmtksdio: Add in-band wakeup support

2022-07-21 17:08:03 -07:00

btmtkuart.c

Bluetooth: btmtkuart: fix recv_buf() return value

2024-01-25 15:35:29 -08:00

btnxpuart.c

Bluetooth: btnxpuart: Fix kernel panic during FW release

2025-05-22 14:12:24 +02:00

btqca.c

Bluetooth: qca: simplify WCN399x NVM loading

2025-04-25 10:45:17 +02:00

btqca.h

Bluetooth: qca: fix info leak when fetching fw build id

2024-05-17 12:02:38 +02:00

btqcomsmd.c

Bluetooth: btqcomsmd: Fix command timeout after setting BD address

2023-03-23 13:09:38 -07:00

btrsi.c

Bluetooth: HCI: Remove HCI_AMP support

2024-06-12 11:11:55 +02:00

btrtl.c

Bluetooth: btrtl: Prevent potential NULL dereference

2025-04-25 10:45:40 +02:00

btrtl.h

Bluetooth: btrtl: Add Realtek devcoredump support

2023-08-11 11:35:14 -07:00

btsdio.c

Bluetooth: HCI: Remove HCI_AMP support

2024-06-12 11:11:55 +02:00

btusb.c

Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling

2025-06-04 14:42:18 +02:00

dtl1_cs.c

networking: add and use skb_put_u8()

2017-06-16 11:48:40 -04:00

h4_recv.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156

2019-05-30 11:26:35 -07:00

hci_ag6xx.c

Bluetooth: hci_uart: Remove redundant assignment to fw_ptr

2021-06-26 07:52:41 +02:00

hci_ath.c

Bluetooth: hci_uart: check for missing tty operations

2019-07-31 13:17:33 -07:00

hci_bcm4377.c

Bluetooth: hci_bcm4377: Use correct unit for timeouts

2024-08-03 08:53:44 +02:00

hci_bcm.c

Bluetooth: hci_bcm: do not mark valid bd_addr as invalid

2023-06-29 10:52:08 -07:00

hci_bcsp.c

treewide: Convert del_timer*() to timer_shutdown*()

2022-12-25 13:38:09 -08:00

hci_h4.c

Bluetooth: hci_h4: Fix padding calculation error within h4_recv_buf()

2021-11-16 13:57:25 +01:00

hci_h5.c

Bluetooth: btrtl: fix out of bounds memory access

2024-03-26 18:19:38 -04:00

hci_intel.c

Bluetooth: hci_intel: Add check for platform_driver_register

2022-07-21 17:05:10 -07:00

hci_ldisc.c

Bluetooth: hci_uart: Fix another race during initialization

2025-04-25 10:45:37 +02:00

hci_ll.c

Bluetooth: hci_ll: drop of_match_ptr for ID table

2023-04-23 21:49:03 -07:00

hci_mrvl.c

Bluetooth: hci_mrvl: Add serdev support for 88W8997

2023-04-23 21:45:29 -07:00

hci_nokia.c

Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()

2023-08-11 11:50:41 -07:00

hci_qca.c

Bluetooth: qca: If memdump doesn't work, re-enable IBS

2024-09-12 11:11:33 +02:00

hci_serdev.c

Bluetooth: HCI: Remove HCI_AMP support

2024-06-12 11:11:55 +02:00

hci_uart.h

Bluetooth: hci_uart: Fix another race during initialization

2025-04-25 10:45:37 +02:00

hci_vhci.c

Bluetooth: vhci: Avoid needless snprintf() calls

2025-04-25 10:45:47 +02:00

Kconfig

Bluetooth: Add vhci devcoredump support

2023-04-23 21:58:21 -07:00

Makefile

Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets

2023-04-23 21:51:55 -07:00

virtio_bt.c

Bluetooth: HCI: Remove HCI_AMP support

2024-06-12 11:11:55 +02:00