From: Greg Kroah-Hartman Date: Mon, 23 Oct 2023 08:41:15 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v4.14.328~18 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=68eb73269bc822c9b8829306a78288ef9f7f9b95;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch --- diff --git a/queue-6.1/bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch b/queue-6.1/bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch new file mode 100644 index 00000000000..0baee6242b4 --- /dev/null +++ b/queue-6.1/bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch @@ -0,0 +1,65 @@ +From cb3871b1cd135a6662b732fbc6b3db4afcdb4a64 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 11 Oct 2023 09:31:44 -0700 +Subject: Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name + +From: Kees Cook + +commit cb3871b1cd135a6662b732fbc6b3db4afcdb4a64 upstream. + +The code pattern of memcpy(dst, src, strlen(src)) is almost always +wrong. In this case it is wrong because it leaves memory uninitialized +if it is less than sizeof(ni->name), and overflows ni->name when longer. + +Normally strtomem_pad() could be used here, but since ni->name is a +trailing array in struct hci_mon_new_index, compilers that don't support +-fstrict-flex-arrays=3 can't tell how large this array is via +__builtin_object_size(). Instead, open-code the helper and use sizeof() +since it will work correctly. + +Additionally mark ni->name as __nonstring since it appears to not be a +%NUL terminated C string. + +Cc: Luiz Augusto von Dentz +Cc: Edward AD +Cc: Marcel Holtmann +Cc: Johan Hedberg +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: linux-bluetooth@vger.kernel.org +Cc: netdev@vger.kernel.org +Fixes: 18f547f3fc07 ("Bluetooth: hci_sock: fix slab oob read in create_monitor_event") +Link: https://lore.kernel.org/lkml/202310110908.F2639D3276@keescook/ +Signed-off-by: Kees Cook +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + include/net/bluetooth/hci_mon.h | 2 +- + net/bluetooth/hci_sock.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/include/net/bluetooth/hci_mon.h ++++ b/include/net/bluetooth/hci_mon.h +@@ -56,7 +56,7 @@ struct hci_mon_new_index { + __u8 type; + __u8 bus; + bdaddr_t bdaddr; +- char name[8]; ++ char name[8] __nonstring; + } __packed; + #define HCI_MON_NEW_INDEX_SIZE 16 + +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -439,7 +439,8 @@ static struct sk_buff *create_monitor_ev + ni->type = hdev->dev_type; + ni->bus = hdev->bus; + bacpy(&ni->bdaddr, &hdev->bdaddr); +- memcpy(ni->name, hdev->name, strlen(hdev->name)); ++ memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name, ++ strnlen(hdev->name, sizeof(ni->name)), '\0'); + + opcode = cpu_to_le16(HCI_MON_NEW_INDEX); + break; diff --git a/queue-6.1/bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch b/queue-6.1/bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch new file mode 100644 index 00000000000..3d00ef01715 --- /dev/null +++ b/queue-6.1/bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch @@ -0,0 +1,31 @@ +From 18f547f3fc074500ab5d419cf482240324e73a7e Mon Sep 17 00:00:00 2001 +From: Edward AD +Date: Tue, 10 Oct 2023 13:36:57 +0800 +Subject: Bluetooth: hci_sock: fix slab oob read in create_monitor_event + +From: Edward AD + +commit 18f547f3fc074500ab5d419cf482240324e73a7e upstream. + +When accessing hdev->name, the actual string length should prevail + +Reported-by: syzbot+c90849c50ed209d77689@syzkaller.appspotmail.com +Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings") +Signed-off-by: Edward AD +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_sock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -439,7 +439,7 @@ static struct sk_buff *create_monitor_ev + ni->type = hdev->dev_type; + ni->bus = hdev->bus; + bacpy(&ni->bdaddr, &hdev->bdaddr); +- memcpy(ni->name, hdev->name, 8); ++ memcpy(ni->name, hdev->name, strlen(hdev->name)); + + opcode = cpu_to_le16(HCI_MON_NEW_INDEX); + break;