From: Greg Kroah-Hartman Date: Wed, 23 Dec 2020 18:17:08 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v5.10.3~2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3090710ae7a693cd5090525950425166de3aea2a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch --- diff --git a/queue-4.14/bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch b/queue-4.14/bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch new file mode 100644 index 00000000000..4b4f64d31ef --- /dev/null +++ b/queue-4.14/bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch @@ -0,0 +1,53 @@ +From f7e0e8b2f1b0a09b527885babda3e912ba820798 Mon Sep 17 00:00:00 2001 +From: Peilin Ye +Date: Wed, 9 Sep 2020 03:17:00 -0400 +Subject: Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() + +From: Peilin Ye + +commit f7e0e8b2f1b0a09b527885babda3e912ba820798 upstream. + +`num_reports` is not being properly checked. A malformed event packet with +a large `num_reports` number makes hci_le_direct_adv_report_evt() read out +of bounds. Fix it. + +Cc: stable@vger.kernel.org +Fixes: 2f010b55884e ("Bluetooth: Add support for handling LE Direct Advertising Report events") +Reported-and-tested-by: syzbot+24ebd650e20bd263ca01@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=24ebd650e20bd263ca01 +Signed-off-by: Peilin Ye +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hci_event.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5141,20 +5141,18 @@ static void hci_le_direct_adv_report_evt + struct sk_buff *skb) + { + u8 num_reports = skb->data[0]; +- void *ptr = &skb->data[1]; ++ struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1]; + +- hci_dev_lock(hdev); ++ if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1) ++ return; + +- while (num_reports--) { +- struct hci_ev_le_direct_adv_info *ev = ptr; ++ hci_dev_lock(hdev); + ++ for (; num_reports; num_reports--, ev++) + process_adv_report(hdev, ev->evt_type, &ev->bdaddr, + ev->bdaddr_type, &ev->direct_addr, + ev->direct_addr_type, ev->rssi, NULL, 0); + +- ptr += sizeof(*ev); +- } +- + hci_dev_unlock(hdev); + } + diff --git a/queue-4.14/series b/queue-4.14/series index 3b2d849fc62..8721e653305 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -61,3 +61,4 @@ quota-sanity-check-quota-file-headers-on-load.patch media-msi2500-assign-spi-bus-number-dynamically.patch crypto-af_alg-avoid-undefined-behavior-accessing-salg_name.patch md-fix-a-warning-caused-by-a-race-between-concurrent-md_ioctl-s.patch +bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch