Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt

hci_le_create_big_complete_evt() iterates over BT_BOUND connections for
a BIG handle using a while loop, accessing ev->bis_handle[i++] on each
iteration.  However, there is no check that i stays within ev->num_bis
before the array access.

When a controller sends a LE_Create_BIG_Complete event with fewer
bis_handle entries than there are BT_BOUND connections for that BIG,
or with num_bis=0, the loop reads beyond the valid bis_handle[] flex
array into adjacent heap memory.  Since the out-of-bounds values
typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()
rejects them and the connection remains in BT_BOUND state.  The same
connection is then found again by hci_conn_hash_lookup_big_state(),
creating an infinite loop with hci_dev_lock held.

Fix this by terminating the BIG if in case not all BIS could be setup
properly.

Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes")
Cc: stable@vger.kernel.org
Signed-off-by: ZhiTao Ou <hkbinbinbin@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b2ee6b6a0f5650d9ab9ae9aede9754f79c559813..1b3b9131affaa331b501fd055dbdd53a8b3ef8aa 100644 (file)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -7118,9 +7118,29 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
                        continue;
                }
 
+               if (ev->num_bis <= i) {
+                       bt_dev_err(hdev,
+                                  "Not enough BIS handles for BIG 0x%2.2x",
+                                  ev->handle);
+                       ev->status = HCI_ERROR_UNSPECIFIED;
+                       hci_connect_cfm(conn, ev->status);
+                       hci_conn_del(conn);
+                       continue;
+               }
+
                if (hci_conn_set_handle(conn,
-                                       __le16_to_cpu(ev->bis_handle[i++])))
+                                       __le16_to_cpu(ev->bis_handle[i++]))) {
+                       bt_dev_err(hdev,
+                                  "Failed to set BIS handle for BIG 0x%2.2x",
+                                  ev->handle);
+                       /* Force error so BIG gets terminated as not all BIS
+                        * could be connected.
+                        */
+                       ev->status = HCI_ERROR_UNSPECIFIED;
+                       hci_connect_cfm(conn, ev->status);
+                       hci_conn_del(conn);
                        continue;
+               }
 
                conn->state = BT_CONNECTED;
                set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
@@ -7129,7 +7149,10 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
                hci_iso_setup_path(conn);
        }
 
-       if (!ev->status && !i)
+       /* If there is an unexpected error or if no BISes have been connected
+        * for the BIG, terminate it.
+        */
+       if (ev->status == HCI_ERROR_UNSPECIFIED || (!ev->status && !i))
                /* If no BISes have been connected for the BIG,
                 * terminate. This is in case all bound connections
                 * have been closed before the BIG creation