Received: by 2002:a05:6a10:a0d1:0:0:0:0 with SMTP id j17csp1164039pxa; Thu, 20 Aug 2020 04:27:29 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyarDJWTya9/48WSVDnLoRwB1m6ALoOJcTBZWY5Uxn13H7JCWkCn3iyk8jfp5d0uZZCbEeS X-Received: by 2002:a17:906:403:: with SMTP id d3mr2744883eja.522.1597922849277; Thu, 20 Aug 2020 04:27:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597922849; cv=none; d=google.com; s=arc-20160816; b=MeNfNuyKdsYYg/z85s/wHbEf/cM4nW7+ArF7Csp9cqC1rySfxwtkgx2cdj6MshQHQZ 1mEezIynTQk+vDZ6zvHzEYPDuu4reI+GK/gH8AD4sQ66VukopMWsfT+N+0DLZniRJuHy mrLlltAKHi3032vSEvDBfoEdv+4rFDn5DMNVbxZSVjDWHVj/z0s9mfLlCxpHvKVM309s /fZq0Y1i/ywcMrd2hmFC0g8hUB9rL4QV6klfEhKnzIpcfaXCi7DYsqCfzyZb4hZy8l/u t7no74s3vFx9zgAE5eRIfJDHlKw0Ur3fZMGq+ItFYMM6gD17+gtgPMRCZijqlBNA3LVd 0urg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=CMRPKEi5uUOIBm6tMTXGrws+oc1BroRnYAuBOxqvV7g=; b=fwPa8G2WyN5jR2F0Kn36GXKTwXVQqFY/WAL/lvS2IdP+8MdCYQ5uLCevuzkTl9cW5G RN6GzLPbHdEprZgwWAL1vVs0SsxdPIQN2W7cO3CIpAZd0GRpRYZ2RNVyFUP0Qsp2GvVF qVF0H4GgfOolFysWAHk2mM9Ei8SAD3KcVJ4bPVgwGI9C346+6GB/yKITjodvse1gFa66 at6HrZrilUI9nIvVnoLdGphyEqtXL9R/83xpRzzygSO829lPpsx/KyCRJZ1zybC6Q2ZI saRskceYjXa9e/4Qb5j9LuvfcUzkL5VAzdC6+rrPXscAJVuwxDJy3yRhjk9fix86oGfv q26A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=TddyxOz3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id me17si1060531ejb.258.2020.08.20.04.27.05; Thu, 20 Aug 2020 04:27:29 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=TddyxOz3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730508AbgHTLYf (ORCPT + 99 others); Thu, 20 Aug 2020 07:24:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:36660 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729816AbgHTKHB (ORCPT ); Thu, 20 Aug 2020 06:07:01 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A37882067C; Thu, 20 Aug 2020 10:07:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918021; bh=Gg+kEkswDRxTKOBGrIllN4zRgEO19H9gT8252jAy1aY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TddyxOz3FucClvMpbdhlj64ndBXlEP0ttwPyVi0pDy9DbQP14PeqGpZSpcCouk3Mb UvEqoFESSaoL9CPHuSpZo6K/bdjytujGgFvqJq8uFSPfuSI0W3+Dv3HUdEpPb1tLuN VQsLOiKS7hq23mGviGCtck7+XqJ893+cYOJHIzsU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , Marcel Holtmann Subject: [PATCH 4.14 009/228] Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() Date: Thu, 20 Aug 2020 11:19:44 +0200 Message-Id: <20200820091607.989638176@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820091607.532711107@linuxfoundation.org> References: <20200820091607.532711107@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Peilin Ye commit 75bbd2ea50ba1c5d9da878a17e92eac02fe0fd3a upstream. Check `num_rsp` before using it as for-loop counter. Cc: stable@vger.kernel.org Signed-off-by: Peilin Ye Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman --- net/bluetooth/hci_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2094,7 +2094,7 @@ static void hci_inquiry_result_evt(struc BT_DBG("%s num_rsp %d", hdev->name, num_rsp); - if (!num_rsp) + if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1) return; if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))