Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 1 Jul 2021 17:06:45 -0400
From:   Peilin Ye <yepeilin.cs@gmail.com>
To:     Alexander Larkin <avlarkin82@gmail.com>
Cc:     davem@davemloft.net, johan.hedberg@gmail.com, kuba@kernel.org,
        linux-bluetooth@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org,
        linux-kernel@vger.kernel.org, linux@armlinux.org.uk,
        marcel@holtmann.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
Subject: Re: maybe similar bug exists for HCI_EV_INQUIRY_RESULT* like
 [Linux-kernel-mentees] [PATCH v2] net/bluetooth: slab-out-of-bounds read in
 hci_extended_inquiry_result_evt()
Message-ID: <20210701210645.GA14471@PWN>
References: <20200709130224.214204-1-yepeilin.cs@gmail.com>
 <20210701153936.2954886-1-avlarkin82@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210701153936.2954886-1-avlarkin82@gmail.com>
Precedence: bulk

On Thu, Jul 01, 2021 at 06:39:36PM +0300, Alexander Larkin wrote:
> For the net/bluetooth/hci_event.c , maybe similar bug could be inside
> hci_inquiry_result_with_rssi_evt() that is HCI_EV_INQUIRY_RESULT_WITH_RSSI
> and inside hci_inquiry_result_evt() that is HCI_EV_INQUIRY_RESULT. 

Hi Alexander,

Thanks for looking into this, I believe they were handled in commit
629b49c848ee ("Bluetooth: Prevent out-of-bounds read in
hci_inquiry_result_with_rssi_evt()") and commit 75bbd2ea50ba ("Bluetooth:
Prevent out-of-bounds read in hci_inquiry_result_evt()").

Thanks,
Peilin Ye