Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-2609-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Vlad Pruteanu <vlad.pruteanu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	iulia.tanasescu@nxp.com,
	andrei.istodorescu@nxp.com,
	luiz.dentz@gmail.com,
	Vlad Pruteanu <vlad.pruteanu@nxp.com>
Subject: [PATCH BlueZ 0/3] shared/util: Add util_iov_append function
Date: Tue, 19 Mar 2024 17:19:14 +0200
Message-Id: <20240319151917.834974-1-vlad.pruteanu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?sO+9/KaZf9qx1I0ZWpJxwOnhKT3vMUUokGh/HCYkcphs/D+6A0G68hZgv6vd?=
 =?us-ascii?Q?m6WXFZ9XZ8TqtixsSEgzPRoiWthj+4zV5JseHiBBYqWiXXMf8MSb09KcuQCd?=
 =?us-ascii?Q?ekGzS9zNyi/z1afLwlGX1siC4WGICKgsJty1av7+gsRcEvEZZffq2CVWXhqF?=
 =?us-ascii?Q?AxTJKmK+PZuv6ZNVG6WXQG82uwDgs4rFq4bFsOLWXu4Gz9NUBSqsus1/Pp/v?=
 =?us-ascii?Q?dMUEb2vRPSvGi+0iGtjEkgIt9+1yaXXbzeOu9XVY06VA+9LC0tMWrGhbyYSO?=
 =?us-ascii?Q?oRF2nMf4oWPRNoKbAjSZ5V8d7xCSrc/KxfRz2LZAkTp70P65hvdWzms5+hmd?=
 =?us-ascii?Q?pogVEamKPiBopQWqp4BUk8UQjTb3SNTUPJBpzYlHkIvzkd5aCLki5442B6JY?=
 =?us-ascii?Q?3X5la1Rl2JJrsec5J4Abit9cqIeouLv5s6ZJO8UAuFgjiHOptuipkuDYEl5N?=
 =?us-ascii?Q?CwR4JHCFYawxTwxLnNGIL/vOBNgIrJb2vMdrf5hsEKb53vwtrqSOog7bUiRI?=
 =?us-ascii?Q?Oe+sLnEfrg0HOHR5eyQ1vlTLNn9zq75r9jn1ZKdykTJarK6kLz5rFyvxBVX0?=
 =?us-ascii?Q?u+Wtedl/lamHjIiDiTxdBAMJace58q2eG8NMLImQoof0KrXnjplgw9Lm/bio?=
 =?us-ascii?Q?bwKobn5rL/s1aAcvxNxIfZR0y7ezByDmHd9FQpqLe5oBsuc75ZUbyU7eesz3?=
 =?us-ascii?Q?9tBv0amRieK/YdVizreBK0cDfaHKm4GjM5bsXj07eTRqnEn0zBY3tMGmPHkk?=
 =?us-ascii?Q?Ybplq2jQcc26LWhxZEOfK6Q9uyLUj0DjIGgobjSCysIN+UsEmooy0XufdtPh?=
 =?us-ascii?Q?qreCrvspWmSp2h5fUSztdL4fpPYoawKZ8IrIi3a4PirF3ExgmJH8RenrnDNR?=
 =?us-ascii?Q?bTFbe6tFQvC0H6dzWAMGyLpiB2/HJcPSxz5GYFz6kb6H2+6Y6PeRmpkDlNah?=
 =?us-ascii?Q?DFYatD0+FfHInlixib77QT/jSj3uWFbd069+Eyh/Nx0kDiZrek7aCM7vHqqp?=
 =?us-ascii?Q?b9Qfqq1LKtNe85zb6xqh8GLlidV6IEDT+ulHjXrgej83C2ttGHshByx5reyE?=
 =?us-ascii?Q?gTfEbsqpnMVkjg4WI1FPxxwMS5KLU1cl//a2zh7lJ+H3huWqphkNbJOytHhK?=
 =?us-ascii?Q?G+9G0MReSEUR2QmBi6zLU8vl9zxZ/gtr8dFViN9QOwV0k14SzUcnIdh0GEf8?=
 =?us-ascii?Q?+L1eloLA8CPQ9urTbcqYmN9rSrgG1l7ZViDeZ5ZzmMnlrj3D7N58x68epd0x?=
 =?us-ascii?Q?lyTRV2FBBvj3a2h24h0rp3RYT0/Iqni+C3h+pJeIPSuZkFAPFCXAhZd48YWF?=
 =?us-ascii?Q?mXL7As9ICXB1MJTeWz3yLDsoND/x/rvWNZYC+nYzVL6qSoM2y+TTf8iZvD/M?=
 =?us-ascii?Q?a0tHJhc+JaOrpHAnUQPe2BNngQx/OYAr/rZx0F/corX2pOWHJOyWUYKp7G/Z?=
 =?us-ascii?Q?wWf/MHABv1/WUBTPSPMGPYCpUy3hIIS5fqDrqXBK48sPZgJVELvwWcAAAoFd?=
 =?us-ascii?Q?tzFK3HJ4OigCph03IKgmt9ooicplo6cUe0zs5ZROilkCmp7bgYzGC/WpWM/4?=
 =?us-ascii?Q?wKWixXnPVKhVo9LnfANWBkrXKc/1Un3j62CLv06O?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a8ca8a4c-8b25-4391-cbc8-08dc4827fe57
X-MS-Exchange-CrossTenant-AuthSource: AM6PR04MB5384.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Mar 2024 15:19:39.0130
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: b+efyxVbOtjnEf4cQ2HDjRgiTZO6lCqWOev3ulliwxH20NyQWjmZLtlCh/tcuIXmUacoyKtIKGxlCkok0/56Lw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR04MB7177

Currently iov_append is defined in 2 places, client/player.c and
src/shared/bap.c. The player.c implementation is faulty as it
does not allocate additional memory for the data that it appends
to the original iovec. This can cause buffer overflows such as
the one attached at the end of this message, which was discovered
while running an Unicast setup. Therefore, the implementation from
src/shared/bap.c was used to create util_iov_append as it allocates
new memory appropriately. The existing calls to iov_append from
src/shared/bap.c and client/player.c were replaced with the new
util_iov_append.

==131878==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x602000059dda at pc 0x7feee2e70ea3 bp 0x7ffd415773f0 sp 0x7ffd41576b98
WRITE of size 6 at 0x602000059dda thread T0
0 0x7feee2e70ea2 in __interceptor_memcpy ../../../../src/libsanitizer
/sanitizer_common/sanitizer_common_interceptors.inc:899
1 0x5579661314aa in memcpy /usr/include/x86_64-linux-gnu/bits/
string_fortified.h:29
2 0x5579661314aa in iov_append client/player.c:2120
3 0x557966132169 in endpoint_select_properties_reply client/player.c:2191
4 0x557966132a6f in endpoint_select_properties client/player.c:2268
5 0x55796616e0b4 in process_message gdbus/object.c:246

Vlad Pruteanu (3):
  shared/util: Add util_iov_append function
  shared/bap: Use util_iov_append instead of iov_append
  client/player: Use util_iov_append instead of iov_append

 client/player.c   | 35 ++++++++++-------------------------
 src/shared/bap.c  | 16 +++++-----------
 src/shared/util.c |  6 ++++++
 src/shared/util.h |  1 +
 4 files changed, 22 insertions(+), 36 deletions(-)

-- 
2.39.2