syz test

[Arnaud Lecomte <contact@xxxxxxxxxxxxxx>]

#syz test

--- a/net/bluetooth/coredump.c
+++ b/net/bluetooth/coredump.c
@@ -249,6 +249,11 @@ static void hci_devcd_dump(struct hci_dev *hdev)
 
        size = hdev->dump.tail - hdev->dump.head;
 
+       if (size >SKB_MAX_ALLOC) {
+               bt_dev_err(hdev, "Dump too large (%u bytes)", size);
+               return;
+       }
+
        /* Emit a devcoredump with the available data */
        dev_coredumpv(&hdev->dev, hdev->dump.head, size, GFP_KERNEL);

--