From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+d8489a79b781849b9c46@syzkaller.appspotmail.com,
Peilin Ye <yepeilin.cs@gmail.com>,
Marcel Holtmann <marcel@holtmann.org>
Subject: [PATCH 5.8 15/38] Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
Date: Mon, 10 Aug 2020 17:19:05 +0200 [thread overview]
Message-ID: <20200810151804.642329635@linuxfoundation.org> (raw)
In-Reply-To: <20200810151803.920113428@linuxfoundation.org>
From: Peilin Ye <yepeilin.cs@gmail.com>
commit 51c19bf3d5cfaa66571e4b88ba2a6f6295311101 upstream.
Check upon `num_rsp` is insufficient. A malformed event packet with a
large `num_rsp` number makes hci_extended_inquiry_result_evt() go out
of bounds. Fix it.
This patch fixes the following syzbot bug:
https://syzkaller.appspot.com/bug?id=4bf11aa05c4ca51ce0df86e500fce486552dc8d2
Reported-by: syzbot+d8489a79b781849b9c46@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4382,7 +4382,7 @@ static void hci_extended_inquiry_result_
BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
- if (!num_rsp)
+ if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
return;
if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
next prev parent reply other threads:[~2020-08-10 15:19 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-10 15:18 [PATCH 5.8 00/38] 5.8.1-rc1 review Greg Kroah-Hartman
2020-08-10 15:18 ` [PATCH 5.8 01/38] scsi: ufs: Fix and simplify setup_xfer_req variant operation Greg Kroah-Hartman
2020-08-10 15:18 ` [PATCH 5.8 02/38] USB: serial: qcserial: add EM7305 QDL product ID Greg Kroah-Hartman
2020-08-10 15:18 ` [PATCH 5.8 03/38] USB: iowarrior: fix up report size handling for some devices Greg Kroah-Hartman
2020-08-10 15:18 ` [PATCH 5.8 04/38] usb: xhci: define IDs for various ASMedia host controllers Greg Kroah-Hartman
2020-08-10 15:18 ` [PATCH 5.8 05/38] usb: xhci: Fix ASMedia ASM1142 DMA addressing Greg Kroah-Hartman
2020-08-10 15:18 ` [PATCH 5.8 06/38] Revert "ALSA: hda: call runtime_allow() for all hda controllers" Greg Kroah-Hartman
2020-08-10 15:18 ` [PATCH 5.8 07/38] ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops Greg Kroah-Hartman
2020-08-10 15:18 ` [PATCH 5.8 08/38] ALSA: hda/ca0132 - Add new quirk ID for Recon3D Greg Kroah-Hartman
2020-08-10 15:18 ` [PATCH 5.8 09/38] ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 10/38] ALSA: hda/ca0132 - Fix AE-5 microphone selection commands Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 11/38] ALSA: seq: oss: Serialize ioctls Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 12/38] staging: android: ashmem: Fix lockdep warning for write operation Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 13/38] staging: rtl8712: handle firmware load failure Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 14/38] Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode Greg Kroah-Hartman
2020-08-10 15:19 ` Greg Kroah-Hartman [this message]
2020-08-10 15:19 ` [PATCH 5.8 16/38] Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 17/38] Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 18/38] omapfb: dss: Fix max fclk divider for omap36xx Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 19/38] binder: Prevent context manager from incrementing ref 0 Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 20/38] Smack: fix use-after-free in smk_write_relabel_self() Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 21/38] scripts: add dummy report mode to add_namespace.cocci Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 22/38] lkdtm/heap: Avoid edge and middle of slabs Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 23/38] vgacon: Fix for missing check in scrollback handling Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 24/38] mtd: properly check all write ioctls for permissions Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 25/38] leds: wm831x-status: fix use-after-free on unbind Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 26/38] leds: lm36274: " Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 27/38] leds: da903x: " Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 28/38] leds: lm3533: " Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 29/38] leds: 88pm860x: " Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 30/38] gpio: max77620: Fix missing release of interrupt Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 31/38] xattr: break delegations in {set,remove}xattr Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 32/38] Revert "powerpc/kasan: Fix shadow pages allocation failure" Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 33/38] powerpc/kasan: Fix shadow pages allocation failure Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 34/38] PCI: tegra: Revert tegra124 raw_violation_fixup Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 35/38] ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 36/38] random32: move the pseudo-random 32-bit definitions to prandom.h Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 37/38] random: random.h should include archrandom.h, not the other way around Greg Kroah-Hartman
2020-08-10 15:19 ` [PATCH 5.8 38/38] arm64: kaslr: Use standard early random function Greg Kroah-Hartman
2020-08-10 23:04 ` [PATCH 5.8 00/38] 5.8.1-rc1 review Shuah Khan
2020-08-11 16:19 ` Greg Kroah-Hartman
2020-08-11 6:29 ` Naresh Kamboju
2020-08-11 16:20 ` Greg Kroah-Hartman
2020-08-11 10:54 ` Puranjay Mohan
2020-08-11 14:24 ` Guenter Roeck
2020-08-11 16:20 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200810151804.642329635@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+d8489a79b781849b9c46@syzkaller.appspotmail.com \
--cc=yepeilin.cs@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).