| From 8bdbfeeb2ea322c38627d5c45a2d6234da219740 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 28 May 2021 11:45:02 -0700 |
| Subject: Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid |
| |
| From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> |
| |
| [ Upstream commit 799acb9347915bfe4eac0ff2345b468f0a1ca207 ] |
| |
| This fixes parsing of LTV entries when the length is 0. |
| |
| Found with: |
| |
| tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)" |
| |
| Add Advertising - Success (ScRsp only) - run |
| Sending Add Advertising (0x003e) |
| Test condition added, total 1 |
| [ 11.004577] ================================================================== |
| [ 11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0 |
| [ 11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87 |
| [ 11.006711] |
| [ 11.007176] |
| [ 11.007429] Allocated by task 87: |
| [ 11.008151] |
| [ 11.008438] The buggy address belongs to the object at ffff888002c69580 |
| [ 11.008438] which belongs to the cache kmalloc-64 of size 64 |
| [ 11.010526] The buggy address is located 48 bytes inside of |
| [ 11.010526] 64-byte region [ffff888002c69580, ffff888002c695c0) |
| [ 11.012423] The buggy address belongs to the page: |
| [ 11.013291] |
| [ 11.013544] Memory state around the buggy address: |
| [ 11.014359] ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc |
| [ 11.015453] ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc |
| [ 11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc |
| [ 11.017010] ^ |
| [ 11.017547] ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc |
| [ 11.018296] ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc |
| [ 11.019116] ================================================================== |
| |
| Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check") |
| Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> |
| Signed-off-by: Marcel Holtmann <marcel@holtmann.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/bluetooth/mgmt.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c |
| index 12d7b368b428..13520c7b4f2f 100644 |
| --- a/net/bluetooth/mgmt.c |
| +++ b/net/bluetooth/mgmt.c |
| @@ -7350,6 +7350,9 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, |
| for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { |
| cur_len = data[i]; |
| |
| + if (!cur_len) |
| + continue; |
| + |
| if (data[i + 1] == EIR_FLAGS && |
| (!is_adv_data || flags_managed(adv_flags))) |
| return false; |
| -- |
| 2.30.2 |
| |