| Message ID | 20210528001702.69323-1-luiz.dentz@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid | expand |
This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=489881 ---Test result--- Test Summary: CheckPatch PASS 0.71 seconds GitLint FAIL 0.12 seconds BuildKernel PASS 631.61 seconds TestRunner: Setup PASS 416.11 seconds TestRunner: l2cap-tester PASS 3.04 seconds TestRunner: bnep-tester PASS 2.00 seconds TestRunner: mgmt-tester PASS 29.49 seconds TestRunner: rfcomm-tester PASS 2.45 seconds TestRunner: sco-tester PASS 2.34 seconds TestRunner: smp-tester PASS 2.59 seconds TestRunner: userchan-tester PASS 2.22 seconds Details ############################## Test: CheckPatch - PASS - 0.71 seconds Run checkpatch.pl script with rule in .checkpatch.conf ############################## Test: GitLint - FAIL - 0.12 seconds Run gitlint with rule in .gitlint Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid 10: B1 Line exceeds max length (81>80): "[ 11.004577] ==================================================================" 24: B1 Line exceeds max length (81>80): "[ 11.014359] ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc" 25: B1 Line exceeds max length (81>80): "[ 11.015453] ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc" 26: B1 Line exceeds max length (81>80): "[ 11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc" 28: B1 Line exceeds max length (81>80): "[ 11.017547] ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc" 29: B1 Line exceeds max length (81>80): "[ 11.018296] ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc" 30: B1 Line exceeds max length (81>80): "[ 11.019116] ==================================================================" ############################## Test: BuildKernel - PASS - 631.61 seconds Build Kernel with minimal configuration supports Bluetooth ############################## Test: TestRunner: Setup - PASS - 416.11 seconds Setup environment for running Test Runner ############################## Test: TestRunner: l2cap-tester - PASS - 3.04 seconds Run test-runner with l2cap-tester Total: 40, Passed: 40 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: bnep-tester - PASS - 2.00 seconds Run test-runner with bnep-tester Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: mgmt-tester - PASS - 29.49 seconds Run test-runner with mgmt-tester Total: 433, Passed: 420 (97.0%), Failed: 0, Not Run: 13 ############################## Test: TestRunner: rfcomm-tester - PASS - 2.45 seconds Run test-runner with rfcomm-tester Total: 9, Passed: 9 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: sco-tester - PASS - 2.34 seconds Run test-runner with sco-tester Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: smp-tester - PASS - 2.59 seconds Run test-runner with smp-tester Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: userchan-tester - PASS - 2.22 seconds Run test-runner with userchan-tester Total: 3, Passed: 3 (100.0%), Failed: 0, Not Run: 0 --- Regards, Linux Bluetooth
Hi Luiz, > Found with: > > tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)" > > Add Advertising - Success (ScRsp only) - run > Sending Add Advertising (0x003e) > Test condition added, total 1 > [ 11.004577] ================================================================== > [ 11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0 > [ 11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87 > [ 11.006711] > [ 11.007176] > [ 11.007429] Allocated by task 87: > [ 11.008151] > [ 11.008438] The buggy address belongs to the object at ffff888002c69580 > [ 11.008438] which belongs to the cache kmalloc-64 of size 64 > [ 11.010526] The buggy address is located 48 bytes inside of > [ 11.010526] 64-byte region [ffff888002c69580, ffff888002c695c0) > [ 11.012423] The buggy address belongs to the page: > [ 11.013291] > [ 11.013544] Memory state around the buggy address: > [ 11.014359] ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 11.015453] ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc > [ 11.017010] ^ > [ 11.017547] ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc > [ 11.018296] ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 11.019116] ================================================================== > > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > --- > net/bluetooth/mgmt.c | 3 +++ > 1 file changed, 3 insertions(+) please git blame this and add a Fixes: tag. Regards Marcel
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 91d36c3bf23e..b52e39fe0285 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -7590,6 +7590,9 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { cur_len = data[i]; + if (!cur_len) + continue; + if (data[i + 1] == EIR_FLAGS && (!is_adv_data || flags_managed(adv_flags))) return false;