lkml.org 
[lkml]   [2021]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 242/348] Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid
    Date
    From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

    [ Upstream commit 799acb9347915bfe4eac0ff2345b468f0a1ca207 ]

    This fixes parsing of LTV entries when the length is 0.

    Found with:

    tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)"

    Add Advertising - Success (ScRsp only) - run
    Sending Add Advertising (0x003e)
    Test condition added, total 1
    [ 11.004577] ==================================================================
    [ 11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0
    [ 11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87
    [ 11.006711]
    [ 11.007176]
    [ 11.007429] Allocated by task 87:
    [ 11.008151]
    [ 11.008438] The buggy address belongs to the object at ffff888002c69580
    [ 11.008438] which belongs to the cache kmalloc-64 of size 64
    [ 11.010526] The buggy address is located 48 bytes inside of
    [ 11.010526] 64-byte region [ffff888002c69580, ffff888002c695c0)
    [ 11.012423] The buggy address belongs to the page:
    [ 11.013291]
    [ 11.013544] Memory state around the buggy address:
    [ 11.014359] ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
    [ 11.015453] ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
    [ 11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
    [ 11.017010] ^
    [ 11.017547] ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
    [ 11.018296] ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
    [ 11.019116] ==================================================================

    Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check")
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bluetooth/mgmt.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
    index 5fce559a61bf..db525321da1f 100644
    --- a/net/bluetooth/mgmt.c
    +++ b/net/bluetooth/mgmt.c
    @@ -6461,6 +6461,9 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
    for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
    cur_len = data[i];

    + if (!cur_len)
    + continue;
    +
    if (data[i + 1] == EIR_FLAGS &&
    (!is_adv_data || flags_managed(adv_flags)))
    return false;
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-12 08:40    [W:2.448 / U:0.200 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site