From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCF87C43381 for ; Mon, 1 Apr 2019 17:45:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9CA6F20830 for ; Mon, 1 Apr 2019 17:45:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1554140754; bh=Yrc8fAV5swKpOA4qxKlf3n297WIDtv+tDO20n8X5AkU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=B16tUPy/J0UucLizaXxM7UBgnxvI0hWHyA8mRLjH5Ca2qSTz2djt2jhvj1HCIm/NI 0rZ7xDzVVEk+ivmMFpsV0yCo7Whwya1tqu9cPmRkMGo1d/iQBqY5kvH8l3r3pSsWTE dImAQWYC9sNAP452IygzsaCoPR0BJGt56ML6alKo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387683AbfDAReA (ORCPT ); Mon, 1 Apr 2019 13:34:00 -0400 Received: from mail.kernel.org ([198.145.29.99]:43286 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728901AbfDARdy (ORCPT ); Mon, 1 Apr 2019 13:33:54 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0708B20856; Mon, 1 Apr 2019 17:33:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1554140033; bh=Yrc8fAV5swKpOA4qxKlf3n297WIDtv+tDO20n8X5AkU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dLFIhsAPzYvdKrJFZkefVte9cnr1l+YrQAOa1wxaJo194YfDKhoJF/UCpnuJnVPgn FOCD1amb/13SRRbKqKB4T3RdQO+FY6gDtf9xOZh4jp0Qzg1n7U33s6g1j5eWlj6J5s PA1K21w72ISjMsn6OSbYqP2akRN4gRj25NCVSH5I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marcel Holtmann , Johan Hedberg Subject: [PATCH 4.4 039/131] Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer Date: Mon, 1 Apr 2019 19:01:49 +0200 Message-Id: <20190401170055.584320800@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190401170051.645954551@linuxfoundation.org> References: <20190401170051.645954551@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Marcel Holtmann commit 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 upstream. The function l2cap_get_conf_opt will return L2CAP_CONF_OPT_SIZE + opt->len as length value. The opt->len however is in control over the remote user and can be used by an attacker to gain access beyond the bounds of the actual packet. To prevent any potential leak of heap memory, it is enough to check that the resulting len calculation after calling l2cap_get_conf_opt is not below zero. A well formed packet will always return >= 0 here and will end with the length value being zero after the last option has been parsed. In case of malformed packets messing with the opt->len field the length value will become negative. If that is the case, then just abort and ignore the option. In case an attacker uses a too short opt->len value, then garbage will be parsed, but that is protected by the unknown option handling and also the option parameter size checks. Signed-off-by: Marcel Holtmann Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hedberg Signed-off-by: Greg Kroah-Hartman --- net/bluetooth/l2cap_core.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3315,6 +3315,8 @@ static int l2cap_parse_conf_req(struct l while (len >= L2CAP_CONF_OPT_SIZE) { len -= l2cap_get_conf_opt(&req, &type, &olen, &val); + if (len < 0) + break; hint = type & L2CAP_CONF_HINT; type &= L2CAP_CONF_MASK; @@ -3533,6 +3535,8 @@ static int l2cap_parse_conf_rsp(struct l while (len >= L2CAP_CONF_OPT_SIZE) { len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); + if (len < 0) + break; switch (type) { case L2CAP_CONF_MTU: @@ -3718,6 +3722,8 @@ static void l2cap_conf_rfc_get(struct l2 while (len >= L2CAP_CONF_OPT_SIZE) { len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); + if (len < 0) + break; switch (type) { case L2CAP_CONF_RFC: