Received: by 2002:a05:6a10:af89:0:0:0:0 with SMTP id iu9csp3639040pxb; Mon, 24 Jan 2022 14:08:52 -0800 (PST) X-Google-Smtp-Source: ABdhPJxHvRx2KPkLsKup+HiP3EkHZV7Ku7ZSueSWZuCfytYD3GlQaoSYDSGnWdF9L5vog5HkYBCv X-Received: by 2002:a17:90a:8b82:: with SMTP id z2mr386560pjn.146.1643062132753; Mon, 24 Jan 2022 14:08:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1643062132; cv=none; d=google.com; s=arc-20160816; b=BTG8YKq88tnSmDa8S9SyswrfY9QHvHNWBrH7+iQt+EueuukuhYKTKILQPhuhjHrzxG RqupvdK5YC7bixn0O1CYazKw3EjOQzTzn83P6UBqRQvN73VZ79cxwSMBkFdn1RZc6rxL C7JG3E/ZW163zm9hUBAQgixjve0KRc0Dr1W9hu/lyAZvuAX74eZqfnWOgp9DbMwUhuMk mBMXoL8iCjGrozRQVqLvxkGEW7oLfjNOUE+W7ebsv9v14jJtY5YtnWv6lh4K8tV5EjEH DC+lfQkmMp2P9K52nMjdTeFQwg9k+3tVcVdWEkPAm7fD39XrE/POmYigR78bSxdYD9F1 BHnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=GFsSCuTBeHQllk2lOGV3expYNSBKxWjdAt9q3ILvYHs=; b=hzoRMkons5YGBadfu+5A1nF2iHAuTownvlPamZF2MHYXja6PJnT/wcA11xpCtNgW3t xzGHcdqwhVY0hWM7bc/nFWF8g/y9G2B2ZobKkkMDhowv7deOehZJkdWuSqei3r3D6/lp HO6XyK4lxI9CZw2Kw04ABy4N39QACRhH8MFrbDQVO2y6hwMqypXy9lNGacAwfeTDQtAh p8jNZ3b18kAaGh6k6otkZAPNucsX+Mgkf6QJHFm3I1f41ZnPhAeEqGnaeN8HAd8CLJ31 Wmxh7FLlC3BFiFgv+JqoSZ4Gi8sNmDLxW0zlglyj/s91lux15y55UgEVsKjkkddu5y43 QuCA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=1IwviWoj; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l17si6717506pls.155.2022.01.24.14.08.31; Mon, 24 Jan 2022 14:08:52 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=1IwviWoj; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1576651AbiAXVzj (ORCPT + 99 others); Mon, 24 Jan 2022 16:55:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51524 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1450848AbiAXVVf (ORCPT ); Mon, 24 Jan 2022 16:21:35 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 11DC5C0604DB; Mon, 24 Jan 2022 12:16:02 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C51CFB8122F; Mon, 24 Jan 2022 20:16:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 06FD8C340E5; Mon, 24 Jan 2022 20:15:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643055359; bh=IGQ79+0mpLsLx4VvMW/Aa9wP8BnjBB2PhCNUg0bhnrg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1IwviWoj1hevjRqkf0U8WLKLkvHXNIAitY+aIjuSKyADdSGe4AIq8vFOxqBJOAvzM o/ZrjrBAnF92O3UzryUldUDEb35iuLjfGKknX65S6zAwnoTN6WJg0L62d0UIRWQkxr 5j+hQA1d7PWHFhQvSv7m39mSQnNsC44l5tr7IVx0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Marcel Holtmann , Sasha Levin , syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com Subject: [PATCH 5.15 126/846] Bluetooth: stop proccessing malicious adv data Date: Mon, 24 Jan 2022 19:34:03 +0100 Message-Id: <20220124184105.320087206@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124184100.867127425@linuxfoundation.org> References: <20220124184100.867127425@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pavel Skripkin [ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ] Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The problem was in missing validaion check. We should check if data is not malicious and we can read next data block. If we won't check ptr validness, code can read a way beyond skb->end and it can cause problems, of course. Fixes: e95beb414168 ("Bluetooth: hci_le_adv_report_evt code refactoring") Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin --- net/bluetooth/hci_event.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 0bca035bf2dcc..50d1d62c15ec8 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -5780,7 +5780,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) struct hci_ev_le_advertising_info *ev = ptr; s8 rssi; - if (ev->length <= HCI_MAX_AD_LENGTH) { + if (ev->length <= HCI_MAX_AD_LENGTH && + ev->data + ev->length <= skb_tail_pointer(skb)) { rssi = ev->data[ev->length]; process_adv_report(hdev, ev->evt_type, &ev->bdaddr, ev->bdaddr_type, NULL, 0, rssi, @@ -5790,6 +5791,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) } ptr += sizeof(*ev) + ev->length + 1; + + if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) { + bt_dev_err(hdev, "Malicious advertising data. Stopping processing"); + break; + } } hci_dev_unlock(hdev); -- 2.34.1