Date:   Tue, 21 Mar 2023 12:51:16 +0100
From:   Simon Horman <simon.horman@corigine.com>
To:     Sungwoo Kim <iam@sung-woo.kim>
Cc:     wuruoyu@me.com, benquike@gmail.com, daveti@purdue.edu,
        Marcel Holtmann <marcel@holtmann.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] Bluetooth: HCI: Fix global-out-of-bounds
Message-ID: <ZBmaNIij3IRXRwaT@corigine.com>
References: <20230321015018.1759683-1-iam@sung-woo.kim>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230321015018.1759683-1-iam@sung-woo.kim>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?nZse2Cug09xZUAnVCSwRc7MIeyFCK2JOoJtZZoduGsD83oHBQh6DlkzzRfA+?=
 =?us-ascii?Q?gCjRPLpma3C2yWgcRTRvM0lBqUzayGHWnQ+IRQje1CI0OzSAOdLob4h6E3RH?=
 =?us-ascii?Q?vgrMSUJtN6Vi98GMn32TeEsGBBNLs353bWMQQ7Vhy+9nCxQt8MzP/D9MQMHy?=
 =?us-ascii?Q?FuRZ7+muic8iJdWiWd3LzSzll11IqUtTCQWtOwavb+jXTWzN/2ERqwR9EgJ0?=
 =?us-ascii?Q?UdswnW3Fr/fEyT+NC/VHlXktI0/qy4fEnCtl6rZASYwcuhgRbcwD6qtT9GVj?=
 =?us-ascii?Q?JGnewuunildIcO5zNCZ88/hc0pnp+UN9J1E+OZ8V9J98s9on/L2MNvWh/8p+?=
 =?us-ascii?Q?e0LB4wVPPhli/z0WHmfbMMSSdhAJS64PztKURy5lopeNTRxVj3O20hSUOaAo?=
 =?us-ascii?Q?kgzd38k9xnrtBWGPjG8KvIXCwZgrNx8xj6n5rQiBUrHrtkBtuFbnLiqvPUlT?=
 =?us-ascii?Q?ZH99G6wqHnsfBVqGwEoWwk16DzaCrqh5KgSi9Afr1m24yUiZDLt+JIH7sw3U?=
 =?us-ascii?Q?19QKPiP/nxqJdgWZhwDrm2sgkGJTsz7oqweDAyJ9QDRvxDQ8XrrMd9+HnGke?=
 =?us-ascii?Q?9HfJmMSugJQflf81dEPcZn7QsrbW9/3nCyeWrZ/0EBwZerEHF9CIJNLDC8Qv?=
 =?us-ascii?Q?pswOiEXr8Ue4t/DIKY1DRWINBmUpSiKcQ4u5867FY4/j2zQ3mVcphKNZOZUd?=
 =?us-ascii?Q?SYXD+tHUZ4RzKij64Xwl/GW9vknnmgYHd2qAHeLZTl6XrWiESkfQN12Wl4zd?=
 =?us-ascii?Q?9jmzECDKw/3a0i5O4XzIuuzEB9fmIpnNKv5d2iCPakDgjVkt86zpZw9xGU8g?=
 =?us-ascii?Q?mLJg/0hDTSWEbfuhPNeD4qmhWSc4XB3D3y2Ih/Dve2ZcvsKycw8zzAbGgRrs?=
 =?us-ascii?Q?gFLRkpItdKuIwbDb7kzEzXBMdUN9GEAQTlNW3XNsAzK/O/MIbCIj0UB7log1?=
 =?us-ascii?Q?1FgkujFfelPnQ8xlv/5u1OVB2uOFZ5lgz30RGGCXWPrtgXwGXQSs6q+2v+s3?=
 =?us-ascii?Q?ULIc+oO/IGIf+MURNPu+0m3eL/MUKPh6XVr8lESd9WvqFJttK8XSWWHVGZV+?=
 =?us-ascii?Q?vyqVgvix9UKi/p2oHiOiggmgWw2JBS4xUWnqGfu2IIVs1dXqusoSQl/iMRFT?=
 =?us-ascii?Q?juIurXq9kYB+yl5ok7Ib2EpS6zKkwdoZAZbV56aQ0Q2u+6Y4x1sWasyzlxBC?=
 =?us-ascii?Q?Ldkb7ceJL5czbtEMlU++n38/9z6RX/tsoWIZC1E87IrqAnv+Ch6lEtgVk95V?=
 =?us-ascii?Q?LWjLuV6bGFmHkIIk0rUQ4UJ2HN+YgSKbTkLSjOvd78cH5CTlf8dDO2JAt9Kh?=
 =?us-ascii?Q?t2wVJZfC2TIGmQwHm/O9Q/Q81vX0d23/4SQDAWo0+osJHPu3STBAGzZnuCHQ?=
 =?us-ascii?Q?rY+DrriFrWAmpMk4lwQIQ8ES2tuHgedgYciXfF7os6uOrIIxqJ6wnTDUMUbe?=
 =?us-ascii?Q?NAN+00D/Y7+stYLuh3Ds1ahnusT/IUGVGYfouXvvmbA36OP/XQ3RxdNxNIvL?=
 =?us-ascii?Q?+pA/jrfuVrhY50xRS9wQ/SBO8SaopzU4jO5jrS4B+LWEK5iJoCh38GAg/hOk?=
 =?us-ascii?Q?ll5/n1e0ufa0/ot2UlNBLLtbmuykLsxpR2u1O6BfgePFUEhbSn75CHqcCd/h?=
 =?us-ascii?Q?P2sbsAr1M/r1Jh4pL0bhlcgLTcrMiTFjBv42lAYVU0bnLePRmCEtyzUmFU2F?=
 =?us-ascii?Q?o1C9rw=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c45d5a5a-1d1d-4f96-4521-08db2a0298c5
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Mar 2023 11:51:24.8016
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: LCKW2FYDBM900juqJU3edj/8ZdvmfNTsTCWFZz9mROxqq0wTDs50+KJl8y6EOKrImcnVmAAh9s6D1b14K6hJrZOqEoJWq33FXOT3ydIRs6s=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL3PR13MB5075
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

On Mon, Mar 20, 2023 at 09:50:18PM -0400, Sungwoo Kim wrote:
> To loop a variable-length array, hci_init_stage_sync(stage) considers
> that stage[i] is valid as long as stage[i-1].func is valid.
> Thus, the last element of stage[].func should be intentionally invalid
> as hci_init0[], le_init2[], and others did.
> However, amp_init1[] and amp_init2[] have no invalid element, letting
> hci_init_stage_sync() keep accessing amp_init1[] over its valid range.
> This patch fixes this by adding {} in the last of amp_init1[] and
> amp_init2[].

...

> This bug is found by FuzzBT, a modified version of Syzkaller.
> Other contributors for this bug are Ruoyu Wu and Peng Hui.
> 
> Fixes: d0b137062b2d ("Bluetooth: hci_sync: Rework init stages")
> Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>

Reviewed-by: Simon Horman <simon.horman@corigine.com>


...