| Message ID | 20200709130224.214204-1-yepeilin.cs@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [Linux-kernel-mentees,v2] net/bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() | expand |
On Thu, Jul 09, 2020 at 09:02:24AM -0400, Peilin Ye wrote: > Check upon `num_rsp` is insufficient. A malformed event packet with a > large `num_rsp` number makes hci_extended_inquiry_result_evt() go out > of bounds. Fix it. > > This patch fixes the following syzbot bug: > > https://syzkaller.appspot.com/bug?id=4bf11aa05c4ca51ce0df86e500fce486552dc8d2 > > Reported-by: syzbot+d8489a79b781849b9c46@syzkaller.appspotmail.com > Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bluetooth maintainers, can you also add a cc: stable on this so it gets picked up properly there? thanks, greg k-h
For the net/bluetooth/hci_event.c , maybe similar bug could be inside hci_inquiry_result_with_rssi_evt() that is HCI_EV_INQUIRY_RESULT_WITH_RSSI and inside hci_inquiry_result_evt() that is HCI_EV_INQUIRY_RESULT.
On Thu, Jul 01, 2021 at 06:39:36PM +0300, Alexander Larkin wrote: > For the net/bluetooth/hci_event.c , maybe similar bug could be inside > hci_inquiry_result_with_rssi_evt() that is HCI_EV_INQUIRY_RESULT_WITH_RSSI > and inside hci_inquiry_result_evt() that is HCI_EV_INQUIRY_RESULT. Hi Alexander, Thanks for looking into this, I believe they were handled in commit 629b49c848ee ("Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()") and commit 75bbd2ea50ba ("Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()"). Thanks, Peilin Ye
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 03a0759f2fc2..91cb3707d20a 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4375,7 +4375,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, BT_DBG("%s num_rsp %d", hdev->name, num_rsp); - if (!num_rsp) + if (!num_rsp || skb->len < num_rsp * sizeof(*info)) return; if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
Check upon `num_rsp` is insufficient. A malformed event packet with a large `num_rsp` number makes hci_extended_inquiry_result_evt() go out of bounds. Fix it. This patch fixes the following syzbot bug: https://syzkaller.appspot.com/bug?id=4bf11aa05c4ca51ce0df86e500fce486552dc8d2 Reported-by: syzbot+d8489a79b781849b9c46@syzkaller.appspotmail.com Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com> --- Changes in v2: - Use `skb->len` instead of `skb->truesize` as the length limit. - Leave `num_rsp` as of type `int`. net/bluetooth/hci_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)