public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/net/bluetooth
History
Luiz Augusto von Dentz 799acb9347 Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid 
This fixes parsing of LTV entries when the length is 0.

Found with:

tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)"

Add Advertising - Success (ScRsp only) - run
  Sending Add Advertising (0x003e)
  Test condition added, total 1
[   11.004577] ==================================================================
[   11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0
[   11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87
[   11.006711]
[   11.007176]
[   11.007429] Allocated by task 87:
[   11.008151]
[   11.008438] The buggy address belongs to the object at ffff888002c69580
[   11.008438]  which belongs to the cache kmalloc-64 of size 64
[   11.010526] The buggy address is located 48 bytes inside of
[   11.010526]  64-byte region [ffff888002c69580, ffff888002c695c0)
[   11.012423] The buggy address belongs to the page:
[   11.013291]
[   11.013544] Memory state around the buggy address:
[   11.014359]  ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   11.015453]  ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   11.017010]                                      ^
[   11.017547]  ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   11.018296]  ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   11.019116] ==================================================================

Fixes: 2bb36870e8 ("Bluetooth: Unify advertising instance flags check")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2021-06-26 07:12:35 +02:00
..
bnep net: make ->{get,set}sockopt in proto_ops optional 2020-07-19 18:16:41 -07:00
cmtp Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails 2021-06-26 07:12:25 +02:00
hidp Bluetooth: hidp: use correct wait queue when removing ctrl_wait 2020-11-09 14:02:47 +01:00
rfcomm Bluetooth: RFCOMM: Use DEVICE_ATTR_RO macro 2021-06-26 07:12:33 +02:00
6lowpan.c Bluetooth: 6lowpan: remove unused function 2021-06-26 07:12:27 +02:00
a2mp.c Bluetooth: drop HCI device reference before return 2021-01-25 16:13:52 +01:00
a2mp.h Bluetooth: Replace zero-length array with flexible-array member 2020-02-28 08:30:02 +01:00
af_bluetooth.c Bluetooth: fix indentation and alignment reported by checkpatch 2021-01-29 16:51:45 +01:00
amp.c Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data 2021-02-02 17:23:14 +01:00
amp.h
aosp.c Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
aosp.h Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
ecdh_helper.c crypto: ecdh - move curve_id of ECDH from the key to algorithm name 2021-03-13 00:04:03 +11:00
ecdh_helper.h Fix misc new gcc warnings 2021-04-27 17:05:53 -07:00
hci_conn.c Bluetooth: Fix spelling mistakes 2021-06-02 14:01:55 -07:00
hci_core.c Bluetooth: Shutdown controller after workqueues are flushed or cancelled 2021-06-26 07:12:29 +02:00
hci_debugfs.c Bluetooth: Coding style fix 2021-04-02 11:03:04 +02:00
hci_debugfs.h
hci_event.c Bluetooth: Translate additional address type during le_conn_comp 2021-06-26 07:12:33 +02:00
hci_request.c Bluetooth: disable filter dup when scan for adv monitor 2021-06-26 07:12:34 +02:00
hci_request.h Bluetooth: Resume advertising after LE connection 2020-11-09 13:33:19 +01:00
hci_sock.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net 2021-06-07 13:01:52 -07:00
hci_sysfs.c
Kconfig Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
l2cap_core.c Bluetooth: L2CAP: Fix invalid access on ECRED Connection response 2021-06-26 07:12:32 +02:00
l2cap_sock.c Bluetooth: check for zapped sk before connecting 2021-03-23 16:03:48 +01:00
leds.c
leds.h
lib.c Bluetooth: Introduce debug feature when dynamic debug is disabled 2020-05-11 12:16:27 +02:00
Makefile Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
mgmt.c Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid 2021-06-26 07:12:35 +02:00
mgmt_config.c Bluetooth: Add toggle to switch off interleave scan 2020-12-07 17:01:00 +02:00
mgmt_config.h Bluetooth: mgmt: Add commands for runtime configuration 2020-06-18 13:11:03 +03:00
mgmt_util.c
mgmt_util.h
msft.c Bluetooth: use flexible-array member instead of zero-length array 2021-06-26 07:12:23 +02:00
msft.h Bluetooth: Allow Microsoft extension to indicate curve validation 2021-04-08 12:26:34 +02:00
sco.c Bluetooth: Remove trailing semicolon in macros 2021-03-24 08:56:24 +01:00
selftest.c crypto: ecdh - move curve_id of ECDH from the key to algorithm name 2021-03-13 00:04:03 +11:00
selftest.h
smp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-06-18 19:47:02 -07:00
smp.h Bluetooth: Move force_bredr_smp debugfs into hci_debugfs_create_bredr 2020-11-09 13:52:55 +01:00