* [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid @ 2021-05-28 18:45 Luiz Augusto von Dentz 2021-05-28 20:14 ` [v2] " bluez.test.bot 2021-06-02 19:52 ` [PATCH v2] " Marcel Holtmann 0 siblings, 2 replies; 3+ messages in thread From: Luiz Augusto von Dentz @ 2021-05-28 18:45 UTC (permalink / raw) To: linux-bluetooth From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> This fixes parsing of LTV entries when the length is 0. Found with: tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)" Add Advertising - Success (ScRsp only) - run Sending Add Advertising (0x003e) Test condition added, total 1 [ 11.004577] ================================================================== [ 11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0 [ 11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87 [ 11.006711] [ 11.007176] [ 11.007429] Allocated by task 87: [ 11.008151] [ 11.008438] The buggy address belongs to the object at ffff888002c69580 [ 11.008438] which belongs to the cache kmalloc-64 of size 64 [ 11.010526] The buggy address is located 48 bytes inside of [ 11.010526] 64-byte region [ffff888002c69580, ffff888002c695c0) [ 11.012423] The buggy address belongs to the page: [ 11.013291] [ 11.013544] Memory state around the buggy address: [ 11.014359] ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 11.015453] ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 11.017010] ^ [ 11.017547] ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 11.018296] ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 11.019116] ================================================================== Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> --- net/bluetooth/mgmt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 91d36c3bf23e..b52e39fe0285 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -7590,6 +7590,9 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { cur_len = data[i]; + if (!cur_len) + continue; + if (data[i + 1] == EIR_FLAGS && (!is_adv_data || flags_managed(adv_flags))) return false; -- 2.31.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: [v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid 2021-05-28 18:45 [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid Luiz Augusto von Dentz @ 2021-05-28 20:14 ` bluez.test.bot 2021-06-02 19:52 ` [PATCH v2] " Marcel Holtmann 1 sibling, 0 replies; 3+ messages in thread From: bluez.test.bot @ 2021-05-28 20:14 UTC (permalink / raw) To: linux-bluetooth, luiz.dentz [-- Attachment #1: Type: text/plain, Size: 4206 bytes --] This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=490399 ---Test result--- Test Summary: CheckPatch FAIL 0.80 seconds GitLint FAIL 0.16 seconds BuildKernel PASS 691.61 seconds TestRunner: Setup PASS 449.17 seconds TestRunner: l2cap-tester PASS 3.21 seconds TestRunner: bnep-tester PASS 2.19 seconds TestRunner: mgmt-tester PASS 31.16 seconds TestRunner: rfcomm-tester PASS 2.44 seconds TestRunner: sco-tester PASS 2.34 seconds TestRunner: smp-tester PASS 2.50 seconds TestRunner: userchan-tester PASS 2.25 seconds Details ############################## Test: CheckPatch - FAIL - 0.80 seconds Run checkpatch.pl script with rule in .checkpatch.conf Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid WARNING: Unknown commit id '2bb36870e8cb2', maybe rebased or not pulled? #37: Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check") total: 0 errors, 1 warnings, 0 checks, 9 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. "[PATCH] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid" has style problems, please review. NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. ############################## Test: GitLint - FAIL - 0.16 seconds Run gitlint with rule in .gitlint Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid 12: B1 Line exceeds max length (81>80): "[ 11.004577] ==================================================================" 26: B1 Line exceeds max length (81>80): "[ 11.014359] ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc" 27: B1 Line exceeds max length (81>80): "[ 11.015453] ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc" 28: B1 Line exceeds max length (81>80): "[ 11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc" 30: B1 Line exceeds max length (81>80): "[ 11.017547] ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc" 31: B1 Line exceeds max length (81>80): "[ 11.018296] ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc" 32: B1 Line exceeds max length (81>80): "[ 11.019116] ==================================================================" ############################## Test: BuildKernel - PASS - 691.61 seconds Build Kernel with minimal configuration supports Bluetooth ############################## Test: TestRunner: Setup - PASS - 449.17 seconds Setup environment for running Test Runner ############################## Test: TestRunner: l2cap-tester - PASS - 3.21 seconds Run test-runner with l2cap-tester Total: 40, Passed: 40 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: bnep-tester - PASS - 2.19 seconds Run test-runner with bnep-tester Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: mgmt-tester - PASS - 31.16 seconds Run test-runner with mgmt-tester Total: 433, Passed: 420 (97.0%), Failed: 0, Not Run: 13 ############################## Test: TestRunner: rfcomm-tester - PASS - 2.44 seconds Run test-runner with rfcomm-tester Total: 9, Passed: 9 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: sco-tester - PASS - 2.34 seconds Run test-runner with sco-tester Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: smp-tester - PASS - 2.50 seconds Run test-runner with smp-tester Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0 ############################## Test: TestRunner: userchan-tester - PASS - 2.25 seconds Run test-runner with userchan-tester Total: 3, Passed: 3 (100.0%), Failed: 0, Not Run: 0 --- Regards, Linux Bluetooth [-- Attachment #2: l2cap-tester.log --] [-- Type: application/octet-stream, Size: 44350 bytes --] [-- Attachment #3: bnep-tester.log --] [-- Type: application/octet-stream, Size: 3557 bytes --] [-- Attachment #4: mgmt-tester.log --] [-- Type: application/octet-stream, Size: 568393 bytes --] [-- Attachment #5: rfcomm-tester.log --] [-- Type: application/octet-stream, Size: 11677 bytes --] [-- Attachment #6: sco-tester.log --] [-- Type: application/octet-stream, Size: 9912 bytes --] [-- Attachment #7: smp-tester.log --] [-- Type: application/octet-stream, Size: 11823 bytes --] [-- Attachment #8: userchan-tester.log --] [-- Type: application/octet-stream, Size: 5453 bytes --] ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid 2021-05-28 18:45 [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid Luiz Augusto von Dentz 2021-05-28 20:14 ` [v2] " bluez.test.bot @ 2021-06-02 19:52 ` Marcel Holtmann 1 sibling, 0 replies; 3+ messages in thread From: Marcel Holtmann @ 2021-06-02 19:52 UTC (permalink / raw) To: Luiz Augusto von Dentz; +Cc: linux-bluetooth Hi Luiz, > This fixes parsing of LTV entries when the length is 0. > > Found with: > > tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)" > > Add Advertising - Success (ScRsp only) - run > Sending Add Advertising (0x003e) > Test condition added, total 1 > [ 11.004577] ================================================================== > [ 11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0 > [ 11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87 > [ 11.006711] > [ 11.007176] > [ 11.007429] Allocated by task 87: > [ 11.008151] > [ 11.008438] The buggy address belongs to the object at ffff888002c69580 > [ 11.008438] which belongs to the cache kmalloc-64 of size 64 > [ 11.010526] The buggy address is located 48 bytes inside of > [ 11.010526] 64-byte region [ffff888002c69580, ffff888002c695c0) > [ 11.012423] The buggy address belongs to the page: > [ 11.013291] > [ 11.013544] Memory state around the buggy address: > [ 11.014359] ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 11.015453] ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc > [ 11.017010] ^ > [ 11.017547] ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc > [ 11.018296] ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 11.019116] ================================================================== > > Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check") > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > --- > net/bluetooth/mgmt.c | 3 +++ > 1 file changed, 3 insertions(+) patch has been applied to bluetooth-next tree. Regards Marcel ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-06-02 19:52 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-05-28 18:45 [PATCH v2] Bluetooth: MGTM: Fix slab-out-of-bounds in tlv_data_is_valid Luiz Augusto von Dentz 2021-05-28 20:14 ` [v2] " bluez.test.bot 2021-06-02 19:52 ` [PATCH v2] " Marcel Holtmann
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.