Messages in this thread Patch in this message |  | | Date | Sun, 31 Oct 2021 23:16:12 +0300 | Subject | Re: [syzbot] KASAN: slab-out-of-bounds Read in hci_le_meta_evt (2) | From | Pavel Skripkin <> |
| |
On 10/31/21 21:49, syzbot wrote: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com > > Tested on: > > commit: 180eca54 Merge tag 'scsi-fixes' of git://git.kernel.or.. > git tree: upstream > kernel config: https://syzkaller.appspot.com/x/.config?x=6362530af157355b > dashboard link: https://syzkaller.appspot.com/bug?extid=e3fcb9c4f3c2a931dc40 > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > patch: https://syzkaller.appspot.com/x/patch.diff?x=1295a186b00000 > > Note: testing is done by a robot and is best-effort only. >
Ok, let's check more corner cases. Looks like nothing checks them.
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
With regards, Pavel Skripkindiff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 0bca035bf2dc..50d1d62c15ec 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -5780,7 +5780,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) struct hci_ev_le_advertising_info *ev = ptr; s8 rssi; - if (ev->length <= HCI_MAX_AD_LENGTH) { + if (ev->length <= HCI_MAX_AD_LENGTH && + ev->data + ev->length <= skb_tail_pointer(skb)) { rssi = ev->data[ev->length]; process_adv_report(hdev, ev->evt_type, &ev->bdaddr, ev->bdaddr_type, NULL, 0, rssi, @@ -5790,6 +5791,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) } ptr += sizeof(*ev) + ev->length + 1; + + if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) { + bt_dev_err(hdev, "Malicious advertising data. Stopping processing"); + break; + } } hci_dev_unlock(hdev); |  |