[PATCH v3] Bluetooth: btmtk: validate WMT event SKB length before struct access

[Luiz Augusto von Dentz]

Hi Tristan,

On Fri, Apr 17, 2026 at 6:29 AM Tristan Madani <tristmd at gmail.com> wrote:
>
> From: Tristan Madani <tristan at talencesecurity.com>
>
> btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to
> struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc
> (9 bytes) without first checking that the SKB contains enough data.
> A short firmware response causes out-of-bounds reads from SKB tailroom.
>
> Add length validation before each struct access to prevent OOB reads
> from malformed WMT event responses.
>
> Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
> Cc: stable at vger.kernel.org
> Signed-off-by: Tristan Madani <tristan at talencesecurity.com>
> ---
>  drivers/bluetooth/btmtk.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
> index 6fb6ca274..b1a96ebae 100644
> --- a/drivers/bluetooth/btmtk.c
> +++ b/drivers/bluetooth/btmtk.c
> @@ -695,6 +695,12 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
>         if (data->evt_skb == NULL)
>                 goto err_free_wc;
>
> +       /* Validate SKB length before accessing WMT event structs */
> +       if (data->evt_skb->len < sizeof(*wmt_evt)) {
> +               err = -EINVAL;
> +               goto err_free_skb;
> +       }

Can't we just use skb_pull_data instead?

> +
>         /* Parse and handle the return WMT event */
>         wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
>         if (wmt_evt->whdr.op != hdr->op) {
> @@ -712,6 +718,10 @@ static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
>                         status = BTMTK_WMT_PATCH_DONE;
>                 break;
>         case BTMTK_WMT_FUNC_CTRL:
> +               if (data->evt_skb->len < sizeof(*wmt_evt_funcc)) {
> +                       err = -EINVAL;
> +                       goto err_free_skb;
> +               }

Ditto.

>                 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
>                 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
>                         status = BTMTK_WMT_ON_DONE;
> --
> 2.47.3
>

https://sashiko.dev/#/patchset/20260417102919.2549352-1-tristmd%40gmail.com

We should probably check if the comments above are valid and have them fixed.

-- 
Luiz Augusto von Dentz