AZL-94470

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: qca: fix NVM tag length underflow in TLV parser

In the TLVTYPENVM branch of qcatlvcheckdata() the tag loop bound is "while (idx < length - sizeof(struct tlvtypenvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlvtypenvm) is a sizet (12), so "length" is converted to sizet and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlvtypenvm past the end of the short vmalloc'd firmware buffer (and the EDLTAGID* handlers can write past it).

Rewrite the bound as "idx + sizeof(struct tlvtypenvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop.

BUG: KASAN: vmalloc-out-of-bounds in qcadownloadfirmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hcipoweron Call Trace: ... kasanreport (mm/kasan/report.c:595) qcadownloadfirmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qcauartsetup (drivers/bluetooth/btqca.c:948) qcasetup (drivers/bluetooth/hciqca.c:2029) hciuartsetup (drivers/bluetooth/hcildisc.c:438) hcidevopensync (net/bluetooth/hcisync.c:5227) hcipoweron (net/bluetooth/hcicore.c:920) processonework (kernel/workqueue.c:3322) workerthread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry64.S:245)