Messages in this thread | | | Subject | Re: [PATCH] Bluetooth: stop proccessing malicious adv data | From | Marcel Holtmann <> | Date | Tue, 16 Nov 2021 14:55:46 +0100 |
| |
Hi Pavel,
> Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The > problem was in missing validaion check. > > We should check if data is not malicious and we can read next data block. > If we won't check ptr validness, code can read a way beyond skb->end and > it can cause problems, of course. > > Fixes: e95beb414168 ("Bluetooth: hci_le_adv_report_evt code refactoring") > Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> > --- > net/bluetooth/hci_event.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-)
patch has been applied to bluetooth-next tree.
Regards
Marcel
| |