2022-07-22 11:57:48

by Soenke Huster

Subject: [PATCH] Bluetooth: Fix null pointer deref on unexpected status event

__hci_cmd_sync returns NULL if the controller responds with a status
event. This is unexpected for the commands sent here, but on
occurrence leads to null pointer dereferences and thus must be
handled.

Signed-off-by: Soenke Huster <[email protected]>
---
net/bluetooth/aosp.c | 15 ++++++++++++---
net/bluetooth/msft.c | 15 ++++++++++++---
2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/aosp.c b/net/bluetooth/aosp.c
index 432ae3aac9e3..1d67836e95e1 100644
--- a/net/bluetooth/aosp.c
+++ b/net/bluetooth/aosp.c
@@ -54,7 +54,10 @@ void aosp_do_open(struct hci_dev *hdev)
/* LE Get Vendor Capabilities Command */
skb = __hci_cmd_sync(hdev, hci_opcode_pack(0x3f, 0x153), 0, NULL,
HCI_CMD_TIMEOUT);
- if (IS_ERR(skb)) {
+ if (IS_ERR_OR_NULL(skb)) {
+ if (!skb)
+ skb = ERR_PTR(-EIO);
+
bt_dev_err(hdev, "AOSP get vendor capabilities (%ld)",
PTR_ERR(skb));
return;
@@ -152,7 +155,10 @@ static int enable_quality_report(struct hci_dev *hdev)

skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,
HCI_CMD_TIMEOUT);
- if (IS_ERR(skb)) {
+ if (IS_ERR_OR_NULL(skb)) {
+ if (!skb)
+ skb = ERR_PTR(-EIO);
+
bt_dev_err(hdev, "Enabling Android BQR failed (%ld)",
PTR_ERR(skb));
return PTR_ERR(skb);
@@ -171,7 +177,10 @@ static int disable_quality_report(struct hci_dev *hdev)

skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,
HCI_CMD_TIMEOUT);
- if (IS_ERR(skb)) {
+ if (IS_ERR_OR_NULL(skb)) {
+ if (!skb)
+ skb = ERR_PTR(-EIO);
+
bt_dev_err(hdev, "Disabling Android BQR failed (%ld)",
PTR_ERR(skb));
return PTR_ERR(skb);
diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index 14975769f678..bee6a4c656be 100644
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -120,7 +120,10 @@ static bool read_supported_features(struct hci_dev *hdev,

skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,
HCI_CMD_TIMEOUT);
- if (IS_ERR(skb)) {
+ if (IS_ERR_OR_NULL(skb)) {
+ if (!skb)
+ skb = ERR_PTR(-EIO);
+
bt_dev_err(hdev, "Failed to read MSFT supported features (%ld)",
PTR_ERR(skb));
return false;
@@ -319,8 +322,11 @@ static int msft_remove_monitor_sync(struct hci_dev *hdev,

skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,
HCI_CMD_TIMEOUT);
- if (IS_ERR(skb))
+ if (IS_ERR_OR_NULL(skb)) {
+ if (!skb)
+ return -EIO;
return PTR_ERR(skb);
+ }

return msft_le_cancel_monitor_advertisement_cb(hdev, hdev->msft_opcode,
monitor, skb);
@@ -432,8 +438,11 @@ static int msft_add_monitor_sync(struct hci_dev *hdev,
HCI_CMD_TIMEOUT);
kfree(cp);

- if (IS_ERR(skb))
+ if (IS_ERR_OR_NULL(skb)) {
+ if (!skb)
+ return -EIO;
return PTR_ERR(skb);
+ }

return msft_le_monitor_advertisement_cb(hdev, hdev->msft_opcode,
monitor, skb);
--
2.37.1

2022-07-22 13:44:17

by bluez.test.bot

Subject: RE: Bluetooth: Fix null pointer deref on unexpected status event

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=662224

---Test result---

Test Summary:
CheckPatch PASS 1.51 seconds
GitLint PASS 0.77 seconds
SubjectPrefix PASS 0.61 seconds
BuildKernel PASS 44.25 seconds
BuildKernel32 PASS 38.64 seconds
Incremental Build with patchesPASS 65.34 seconds
TestRunner: Setup PASS 672.66 seconds
TestRunner: l2cap-tester PASS 20.59 seconds
TestRunner: bnep-tester PASS 7.63 seconds
TestRunner: mgmt-tester PASS 125.34 seconds
TestRunner: rfcomm-tester PASS 11.56 seconds
TestRunner: sco-tester PASS 11.17 seconds
TestRunner: smp-tester PASS 11.05 seconds
TestRunner: userchan-tester PASS 7.51 seconds



---
Regards,
Linux Bluetooth

2022-07-29 00:12:02

by patchwork-bot+bluetooth

Subject: Re: [PATCH] Bluetooth: Fix null pointer deref on unexpected status event

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:

On Fri, 22 Jul 2022 13:53:07 +0200 you wrote:
> __hci_cmd_sync returns NULL if the controller responds with a status
> event. This is unexpected for the commands sent here, but on
> occurrence leads to null pointer dereferences and thus must be
> handled.
>
> Signed-off-by: Soenke Huster <[email protected]>
>
> [...]

Here is the summary with links:
- Bluetooth: Fix null pointer deref on unexpected status event
https://git.kernel.org/bluetooth/bluetooth-next/c/aa7c99c75eea

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html