All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid
@ 2021-05-28 18:45 Luiz Augusto von Dentz
  2021-05-28 20:14 ` [v2] " bluez.test.bot
  2021-06-02 19:52 ` [PATCH v2] " Marcel Holtmann
  0 siblings, 2 replies; 3+ messages in thread
From: Luiz Augusto von Dentz @ 2021-05-28 18:45 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This fixes parsing of LTV entries when the length is 0.

Found with:

tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)"

Add Advertising - Success (ScRsp only) - run
  Sending Add Advertising (0x003e)
  Test condition added, total 1
[   11.004577] ==================================================================
[   11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0
[   11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87
[   11.006711]
[   11.007176]
[   11.007429] Allocated by task 87:
[   11.008151]
[   11.008438] The buggy address belongs to the object at ffff888002c69580
[   11.008438]  which belongs to the cache kmalloc-64 of size 64
[   11.010526] The buggy address is located 48 bytes inside of
[   11.010526]  64-byte region [ffff888002c69580, ffff888002c695c0)
[   11.012423] The buggy address belongs to the page:
[   11.013291]
[   11.013544] Memory state around the buggy address:
[   11.014359]  ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   11.015453]  ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   11.017010]                                      ^
[   11.017547]  ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   11.018296]  ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   11.019116] ==================================================================

Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/mgmt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 91d36c3bf23e..b52e39fe0285 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -7590,6 +7590,9 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
 	for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
 		cur_len = data[i];
 
+		if (!cur_len)
+			continue;
+
 		if (data[i + 1] == EIR_FLAGS &&
 		    (!is_adv_data || flags_managed(adv_flags)))
 			return false;
-- 
2.31.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* RE: [v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid
  2021-05-28 18:45 [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid Luiz Augusto von Dentz
@ 2021-05-28 20:14 ` bluez.test.bot
  2021-06-02 19:52 ` [PATCH v2] " Marcel Holtmann
  1 sibling, 0 replies; 3+ messages in thread
From: bluez.test.bot @ 2021-05-28 20:14 UTC (permalink / raw)
  To: linux-bluetooth, luiz.dentz

[-- Attachment #1: Type: text/plain, Size: 4206 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=490399

---Test result---

Test Summary:
CheckPatch                    FAIL      0.80 seconds
GitLint                       FAIL      0.16 seconds
BuildKernel                   PASS      691.61 seconds
TestRunner: Setup             PASS      449.17 seconds
TestRunner: l2cap-tester      PASS      3.21 seconds
TestRunner: bnep-tester       PASS      2.19 seconds
TestRunner: mgmt-tester       PASS      31.16 seconds
TestRunner: rfcomm-tester     PASS      2.44 seconds
TestRunner: sco-tester        PASS      2.34 seconds
TestRunner: smp-tester        PASS      2.50 seconds
TestRunner: userchan-tester   PASS      2.25 seconds

Details
##############################
Test: CheckPatch - FAIL - 0.80 seconds
Run checkpatch.pl script with rule in .checkpatch.conf
Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid
WARNING: Unknown commit id '2bb36870e8cb2', maybe rebased or not pulled?
#37: 
Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check")

total: 0 errors, 1 warnings, 0 checks, 9 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

"[PATCH] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid" has style problems, please review.

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL - 0.16 seconds
Run gitlint with rule in .gitlint
Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid
12: B1 Line exceeds max length (81>80): "[   11.004577] =================================================================="
26: B1 Line exceeds max length (81>80): "[   11.014359]  ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc"
27: B1 Line exceeds max length (81>80): "[   11.015453]  ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc"
28: B1 Line exceeds max length (81>80): "[   11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc"
30: B1 Line exceeds max length (81>80): "[   11.017547]  ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc"
31: B1 Line exceeds max length (81>80): "[   11.018296]  ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc"
32: B1 Line exceeds max length (81>80): "[   11.019116] =================================================================="


##############################
Test: BuildKernel - PASS - 691.61 seconds
Build Kernel with minimal configuration supports Bluetooth


##############################
Test: TestRunner: Setup - PASS - 449.17 seconds
Setup environment for running Test Runner


##############################
Test: TestRunner: l2cap-tester - PASS - 3.21 seconds
Run test-runner with l2cap-tester
Total: 40, Passed: 40 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: bnep-tester - PASS - 2.19 seconds
Run test-runner with bnep-tester
Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: mgmt-tester - PASS - 31.16 seconds
Run test-runner with mgmt-tester
Total: 433, Passed: 420 (97.0%), Failed: 0, Not Run: 13

##############################
Test: TestRunner: rfcomm-tester - PASS - 2.44 seconds
Run test-runner with rfcomm-tester
Total: 9, Passed: 9 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: sco-tester - PASS - 2.34 seconds
Run test-runner with sco-tester
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: smp-tester - PASS - 2.50 seconds
Run test-runner with smp-tester
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: userchan-tester - PASS - 2.25 seconds
Run test-runner with userchan-tester
Total: 3, Passed: 3 (100.0%), Failed: 0, Not Run: 0



---
Regards,
Linux Bluetooth


[-- Attachment #2: l2cap-tester.log --]
[-- Type: application/octet-stream, Size: 44350 bytes --]

[-- Attachment #3: bnep-tester.log --]
[-- Type: application/octet-stream, Size: 3557 bytes --]

[-- Attachment #4: mgmt-tester.log --]
[-- Type: application/octet-stream, Size: 568393 bytes --]

[-- Attachment #5: rfcomm-tester.log --]
[-- Type: application/octet-stream, Size: 11677 bytes --]

[-- Attachment #6: sco-tester.log --]
[-- Type: application/octet-stream, Size: 9912 bytes --]

[-- Attachment #7: smp-tester.log --]
[-- Type: application/octet-stream, Size: 11823 bytes --]

[-- Attachment #8: userchan-tester.log --]
[-- Type: application/octet-stream, Size: 5453 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid
  2021-05-28 18:45 [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid Luiz Augusto von Dentz
  2021-05-28 20:14 ` [v2] " bluez.test.bot
@ 2021-06-02 19:52 ` Marcel Holtmann
  1 sibling, 0 replies; 3+ messages in thread
From: Marcel Holtmann @ 2021-06-02 19:52 UTC (permalink / raw)
  To: Luiz Augusto von Dentz; +Cc: linux-bluetooth

Hi Luiz,

> This fixes parsing of LTV entries when the length is 0.
> 
> Found with:
> 
> tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)"
> 
> Add Advertising - Success (ScRsp only) - run
>  Sending Add Advertising (0x003e)
>  Test condition added, total 1
> [   11.004577] ==================================================================
> [   11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0
> [   11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87
> [   11.006711]
> [   11.007176]
> [   11.007429] Allocated by task 87:
> [   11.008151]
> [   11.008438] The buggy address belongs to the object at ffff888002c69580
> [   11.008438]  which belongs to the cache kmalloc-64 of size 64
> [   11.010526] The buggy address is located 48 bytes inside of
> [   11.010526]  64-byte region [ffff888002c69580, ffff888002c695c0)
> [   11.012423] The buggy address belongs to the page:
> [   11.013291]
> [   11.013544] Memory state around the buggy address:
> [   11.014359]  ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [   11.015453]  ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [   11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
> [   11.017010]                                      ^
> [   11.017547]  ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
> [   11.018296]  ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [   11.019116] ==================================================================
> 
> Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check")
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/mgmt.c | 3 +++
> 1 file changed, 3 insertions(+)

patch has been applied to bluetooth-next tree.

Regards

Marcel


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-06-02 19:52 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-28 18:45 [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid Luiz Augusto von Dentz
2021-05-28 20:14 ` [v2] " bluez.test.bot
2021-06-02 19:52 ` [PATCH v2] " Marcel Holtmann

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.